[sdk] Invalid OAuth Scope Error When Referencing GCP Kubeflow Registry Artifact in PipelineJob

[abdulmateen59]

Environment

• kfp: 2.10.1
• kfp-pipeline-spec: 0.5.0
• kfp-server-api: 2.3.0

Steps to reproduce

1. Push a template to the GCP Kubeflow registry.
2. Create a Pipeline object referring to the location of the template in the registry.
3. Use the following code snippet:

pipeline_jobs.PipelineJob(
                project=self.config.project,
                location=self.config.region,
                display_name=self.config.pipeline_name,
                template_path=template_path,
                pipeline_root=self.config.pipeline_path,
                labels={},
                credentials=self.credentials
            )

Expected result

The PipelineJob should be able to refer to the Kubeflow registry artifact without encountering an invalid OAuth scope error.

Materials and Reference

cred = service_account.Credentials.from_service_account_file(
    os.environ['GOOGLE_APPLICATION_CREDENTIALS'],
    scopes=['https://www.googleapis.com/auth/cloud-platform']
)
pipeline_jobs.PipelineJob(
    project=self.config.project,
    location=self.config.region,
    display_name=self.config.pipeline_name,
    template_path=template_path,
    pipeline_root=self.config.pipeline_path,
    labels={},
    credentials=cred
)

When referring to a Kubeflow registry artifact in a PipelineJob, it is necessary to specify the scopes; otherwise, it results in an invalid OAuth scope error.

---

Impacted by this bug? Give it a 👍.