[BUG] Keyring errors when intialising flyte remote client

[Tom-Newton]

Describe the bug

Get a keyring error when initialising a simple flyte remote client. It seems to only happen on some systems and the exact error varies slightly. I've seen
InitError: Failed to create the collection: Prompt dismissed..
KeyringLocked: Failed to unlock the collection!

Expected behavior

I'm not trying to use any authentication so I would expect it to ignore any exceptions about the system keyring. Alternatively we could add AuthType.NONE so that all keyvault related code can be avoided.

Additional context to reproduce

On my system I can reproduce with:

from flytekit.configuration import Config
from flytekit.remote import FlyteRemote

config = Config.for_sandbox()
remote = FlyteRemote(config=config)
remote.client

This is SSHing from one linux system to another linux system. Both are used with a Desktop setup so they probably have the GNOME keyring installed.

I tried using all the different Auth types but they all failed for one reason or another (this is largely expected because we do not have any authentication configured on our flyte deployment).

Full stack trace:
stack_trace.txt

Screenshots

No response

Are you sure this issue hasn't been raised already?

• Yes

Have you read the Code of Conduct?

• Yes

[Future-Outlier]

We should not use PKCE as the default

[taieeuu]

#take

[wild-endeavor]

this is the weird part of the stack trace

│ /home/tomnewton/.local/lib/python3.8/site-packages/flytekit/remote/remote.py:205 in client                                                                                                                                                                 │
│ ❱  205 │   │   │   self._client = SynchronousFlyteClient(self.config.platform, **self._kwargs)                                                                                                                                                             │
│ /home/tomnewton/.local/lib/python3.8/site-packages/flytekit/clients/raw.py:44 in __init__                                                                                                                                                                  │
│ ❱  44 │   │   self._channel = wrap_exceptions_channel(cfg, upgrade_channel_to_authenticated(cf                                                                                                                                                             │
│ /home/tomnewton/.local/lib/python3.8/site-packages/flytekit/clients/auth_helper.py:111 in 
upgrade_channel_to_authenticated                                                                                                                                 │
│
│ ❱ 111 │   authenticator = get_authenticator(cfg, RemoteClientConfigStore(in_channel))                                                                                                                                                                      │
│ /home/tomnewton/.local/lib/python3.8/site-packages/flytekit/clients/auth_helper.py:69 in get_authenticator                                                                                                                                                 │
│ ❱  69 │   │   return PKCEAuthenticator(cfg.endpoint, cfg_store, verify=verify)                                                                                                                                                                             

if there's no 401 received, we shouldn't be trying to instantiate a PKCEAuthenticator or any other Authenticator. not sure what's happening. the only weird part of the auth stuff is this line. maybe there's another error happening? Technically we should only be checking for e.code() == grpc.StatusCode.UNAUTHENTICATED. But we added e.code() == grpc.StatusCode.UNKNOWN as a hack because some reverse-proxy setups + grpc versions?? were not returning the correct error.

[wild-endeavor]

hmmm I guess we always call upgrade_channel_to_authenticated which will always call get_authenticator which will always initialize the pkce authenticator if that's the selected option.

can we delay this somehow please? can we make it so that only when there's an error, do we create the authenticator? or something like that.

[Future-Outlier]

@Tom-Newton can you help me test this one?
flyteorg/flytekit#2962