feat(auth): add pluggable authenticator support via registry and entry_points

[honnix]

Summary

Currently, flytekit's auth system only supports a fixed set of built-in authentication modes (PKCE, ClientSecret, ExternalCommand, DeviceFlow). Adding a new mode requires modifying flytekit core. This makes it impossible for downstream consumers to provide custom authenticators without forking or shelling out to external processes via ExternalCommand.

This PR makes the authenticator system extensible via two mechanisms:

• Explicit registry — register_authenticator_plugin(name, factory) works in every environment (pip, Bazel, vendored mono-repos). This is the primary mechanism.
• Entry_point discovery — plugins can register under the flytekit.auth entry_point group for automatic discovery in pip-installed environments.

When auth_mode is set to a value that doesn't match any built-in AuthType, get_authenticator() checks the explicit registry first, then falls back to entry_point discovery. Names are compared case-insensitively for consistency with the built-in auth mode handling.

Motivation

At Spotify we use GCP ID token auth with Flyte. Today this requires ExternalCommand mode shelling out to gcloud auth print-identity-token, which is slow and cannot run in parallel (gcloud's SQLite config database locks). A pluggable auth system lets us register an in-process authenticator using google-auth directly — no subprocess, no gcloud, fully parallel-safe.

Plugin contract

A callable (class or factory function) with the signature:

(PlatformConfig, ClientConfigStore) -> Authenticator

Usage

Explicit registration (Bazel / mono-repo):

from flytekit.clients.auth_helper import register_authenticator_plugin

register_authenticator_plugin("gcp_id_token", GcpIdTokenAuthenticator)

Entry_point (pip):

[project.entry-points."flytekit.auth"]
gcp_id_token = "my_package.auth:gcp_id_token_factory"

Config:

FLYTE_CREDENTIALS_AUTH_MODE=GCP_ID_TOKEN

Test plan

• Existing auth tests pass (all built-in types unaffected)
• Plugin loaded via entry_point
• Plugin loaded via explicit registry
• Registry takes precedence over entry_points
• Unknown auth mode without plugin raises ValueError
• Built-in auth types skip plugin lookup entirely
• Case-insensitive matching for both registry and entry_points

🤖 Generated with Claude Code