Skip to content

feat: RBAC Authorization in Feast Operator #4786

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmartinol merged 12 commits into from
Dec 1, 2024
Merged

feat: RBAC Authorization in Feast Operator #4786

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
12 commits
Select commit Hold shift + click to select a range
fa6be07
Initial commit
dmartinol Nov 22, 2024
bcd7fe4
refactoring types with FeastHandler
dmartinol Nov 22, 2024
17e6b43
no private image
dmartinol Nov 22, 2024
0817c9c
removed log-level
dmartinol Nov 25, 2024
62861c6
no empty list for default Role
dmartinol Nov 25, 2024
a4c9378
removed nameLabelKey, using serices.NameLabelKey
dmartinol Nov 25, 2024
c9a583c
improved CRD comments and using IsLocalRegistry
dmartinol Nov 25, 2024
f97ab65
fixing generated code
dmartinol Nov 25, 2024
2f7bf15
renamed auth condition and types
dmartinol Nov 26, 2024
13dd560
post rebase fixes
dmartinol Nov 26, 2024
3e457f1
more renamings
dmartinol Nov 26, 2024
faf215f
Merge branch 'feast-dev:master' into auth_k8s
dmartinol Nov 28, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
refactoring types with FeastHandler 
Signed-off-by: Daniele Martinoli <[email protected]>
  • Loading branch information
@dmartinol
dmartinol committed Nov 26, 2024
commit bcd7fe4dd088a3a5da087475a764bea184992bd7
35 changes: 19 additions & 16 deletions infra/feast-operator/api/v1alpha1/featurestore_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,26 +28,29 @@ const (
FailedPhase = "Failed"

// Feast condition types:
ClientReadyType = "Client"
OfflineStoreReadyType = "OfflineStore"
OnlineStoreReadyType = "OnlineStore"
RegistryReadyType = "Registry"
ReadyType = "FeatureStore"
ClientReadyType = "Client"
OfflineStoreReadyType = "OfflineStore"
OnlineStoreReadyType = "OnlineStore"
RegistryReadyType = "Registry"
ReadyType = "FeatureStore"
KubernetesAuthReadyType = "KubernetesAuth"
Comment thread
dmartinol marked this conversation as resolved.
Outdated

// Feast condition reasons:
ReadyReason = "Ready"
FailedReason = "FeatureStoreFailed"
OfflineStoreFailedReason = "OfflineStoreDeploymentFailed"
OnlineStoreFailedReason = "OnlineStoreDeploymentFailed"
RegistryFailedReason = "RegistryDeploymentFailed"
ClientFailedReason = "ClientDeploymentFailed"
ReadyReason = "Ready"
FailedReason = "FeatureStoreFailed"
OfflineStoreFailedReason = "OfflineStoreDeploymentFailed"
OnlineStoreFailedReason = "OnlineStoreDeploymentFailed"
RegistryFailedReason = "RegistryDeploymentFailed"
ClientFailedReason = "ClientDeploymentFailed"
KubernetesAuthFailedReason = "KubernetesAuthorizationDeploymentFailed"
Comment thread
dmartinol marked this conversation as resolved.
Outdated

// Feast condition messages:
ReadyMessage = "FeatureStore installation complete"
OfflineStoreReadyMessage = "Offline Store installation complete"
OnlineStoreReadyMessage = "Online Store installation complete"
RegistryReadyMessage = "Registry installation complete"
ClientReadyMessage = "Client installation complete"
ReadyMessage = "FeatureStore installation complete"
OfflineStoreReadyMessage = "Offline Store installation complete"
OnlineStoreReadyMessage = "Online Store installation complete"
RegistryReadyMessage = "Registry installation complete"
ClientReadyMessage = "Client installation complete"
KubernetesAuthReadyMessage = "Kubernetes authorization installation complete"
Comment thread
dmartinol marked this conversation as resolved.
Outdated

// entity_key_serialization_version
SerializationVersion = 3
Expand Down
11 changes: 11 additions & 0 deletions infra/feast-operator/config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,3 +62,14 @@ rules:
- get
- patch
- update
- apiGroups:
- rbac.authorization.k8s.io
resources:
- roles
verbs:
- create
- delete
- get
- list
- update
- watch
11 changes: 11 additions & 0 deletions infra/feast-operator/dist/install.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2330,6 +2330,17 @@ rules:
- get
- patch
- update
- apiGroups:
- rbac.authorization.k8s.io
resources:
- roles
verbs:
- create
- delete
- get
- list
- update
- watch
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
Expand Down
49 changes: 37 additions & 12 deletions infra/feast-operator/internal/controller/featurestore_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,18 +23,21 @@ import (

appsv1 "k8s.io/api/apps/v1"
corev1 "k8s.io/api/core/v1"
rbacv1 "k8s.io/api/rbac/v1"
apierrors "k8s.io/apimachinery/pkg/api/errors"
apimeta "k8s.io/apimachinery/pkg/api/meta"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
"k8s.io/apimachinery/pkg/types"
ctrl "sigs.k8s.io/controller-runtime"
"sigs.k8s.io/controller-runtime/pkg/client"
"sigs.k8s.io/controller-runtime/pkg/handler"
handler "sigs.k8s.io/controller-runtime/pkg/handler"
"sigs.k8s.io/controller-runtime/pkg/log"
"sigs.k8s.io/controller-runtime/pkg/reconcile"

feastdevv1alpha1 "github.com/feast-dev/feast/infra/feast-operator/api/v1alpha1"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/auth"
feasthandler "github.com/feast-dev/feast/infra/feast-operator/internal/controller/handler"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/services"
)

Expand Down Expand Up @@ -108,20 +111,39 @@ func (r *FeatureStoreReconciler) deployFeast(ctx context.Context, cr *feastdevv1
Message: feastdevv1alpha1.ReadyMessage,
}

feast := services.FeastServices{
Client: r.Client,
Context: ctx,
FeatureStore: cr,
Scheme: r.Scheme,
auth := auth.FeastAuth{
Handler: feasthandler.FeastHandler{
Client: r.Client,
Context: ctx,
FeatureStore: cr,
Scheme: r.Scheme,
},
}
if err = feast.Deploy(); err != nil {
if err = auth.Deploy(); err != nil {
condition = metav1.Condition{
Type: feastdevv1alpha1.ReadyType,
Status: metav1.ConditionFalse,
Reason: feastdevv1alpha1.FailedReason,
Message: "Error: " + err.Error(),
}
result = ctrl.Result{Requeue: true, RequeueAfter: RequeueDelayError}
} else {
feast := services.FeastServices{
Handler: feasthandler.FeastHandler{
Client: r.Client,
Context: ctx,
FeatureStore: cr,
Scheme: r.Scheme,
}}
if err = feast.Deploy(); err != nil {
condition = metav1.Condition{
Type: feastdevv1alpha1.ReadyType,
Status: metav1.ConditionFalse,
Reason: feastdevv1alpha1.FailedReason,
Message: "Error: " + err.Error(),
}
result = ctrl.Result{Requeue: true, RequeueAfter: RequeueDelayError}
}
}

logger.Info(condition.Message)
Expand All @@ -146,6 +168,8 @@ func (r *FeatureStoreReconciler) SetupWithManager(mgr ctrl.Manager) error {
Owns(&corev1.Service{}).
Owns(&corev1.PersistentVolumeClaim{}).
Owns(&corev1.ServiceAccount{}).
Owns(&rbacv1.RoleBinding{}).
Owns(&rbacv1.Role{}).
Watches(&feastdevv1alpha1.FeatureStore{}, handler.EnqueueRequestsFromMapFunc(r.mapFeastRefsToFeastRequests)).
Complete(r)
}
Expand All @@ -170,11 +194,12 @@ func (r *FeatureStoreReconciler) mapFeastRefsToFeastRequests(ctx context.Context
// this if statement is extra protection against any potential infinite reconcile loops
if feastRefNsName != objNsName {
feast := services.FeastServices{
Client: r.Client,
Context: ctx,
FeatureStore: &obj,
Scheme: r.Scheme,
}
Handler: feasthandler.FeastHandler{
Client: r.Client,
Context: ctx,
FeatureStore: &obj,
Scheme: r.Scheme,
}}
if feast.IsRemoteRefRegistry() {
remoteRef := obj.Status.Applied.Services.Registry.Remote.FeastRef
remoteRefNsName := types.NamespacedName{Name: remoteRef.Name, Namespace: remoteRef.Namespace}
Expand Down
27 changes: 18 additions & 9 deletions infra/feast-operator/internal/controller/featurestore_controller_ephemeral_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ import (

"github.com/feast-dev/feast/infra/feast-operator/api/feastversion"
feastdevv1alpha1 "github.com/feast-dev/feast/infra/feast-operator/api/v1alpha1"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/handler"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/services"
)

Expand Down Expand Up @@ -115,15 +116,18 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
Expect(err).NotTo(HaveOccurred())

feast := services.FeastServices{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
Handler: handler.FeastHandler{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
},
}
Expect(resource.Status).NotTo(BeNil())
Expect(resource.Status.FeastVersion).To(Equal(feastversion.FeastVersion))
Expect(resource.Status.ClientConfigMap).To(Equal(feast.GetFeastServiceName(services.ClientFeastType)))
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
Expect(resource.Status.Applied.AuthConfig).To(Equal(&feastdevv1alpha1.AuthConfig{}))
Expect(resource.Status.Applied.Services).NotTo(BeNil())
Expect(resource.Status.Applied.Services.OfflineStore).NotTo(BeNil())
Expect(resource.Status.Applied.Services.OfflineStore.Persistence).NotTo(BeNil())
Expand Down Expand Up @@ -161,6 +165,9 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
Expect(cond.Type).To(Equal(feastdevv1alpha1.ReadyType))
Expect(cond.Message).To(Equal(feastdevv1alpha1.ReadyMessage))

cond = apimeta.FindStatusCondition(resource.Status.Conditions, feastdevv1alpha1.KubernetesAuthReadyType)
Expect(cond).To(BeNil())

cond = apimeta.FindStatusCondition(resource.Status.Conditions, feastdevv1alpha1.RegistryReadyType)
Expect(cond).ToNot(BeNil())
Expect(cond.Status).To(Equal(metav1.ConditionTrue))
Expand Down Expand Up @@ -249,10 +256,12 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
Expect(cmList.Items).To(HaveLen(1))

feast := services.FeastServices{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
Handler: handler.FeastHandler{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
},
}

// check registry config
Expand Down Expand Up @@ -412,7 +421,7 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
resource = &feastdevv1alpha1.FeatureStore{}
err = k8sClient.Get(ctx, typeNamespacedName, resource)
Expect(err).NotTo(HaveOccurred())
feast.FeatureStore = resource
feast.Handler.FeatureStore = resource

// check registry config
deploy = &appsv1.Deployment{}
Expand Down
29 changes: 19 additions & 10 deletions infra/feast-operator/internal/controller/featurestore_controller_objectstore_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,7 @@ import (

"github.com/feast-dev/feast/infra/feast-operator/api/feastversion"
feastdevv1alpha1 "github.com/feast-dev/feast/infra/feast-operator/api/v1alpha1"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/handler"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/services"
)

Expand Down Expand Up @@ -110,15 +111,18 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
Expect(err).NotTo(HaveOccurred())

feast := services.FeastServices{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
Handler: handler.FeastHandler{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
},
}
Expect(resource.Status).NotTo(BeNil())
Expect(resource.Status.FeastVersion).To(Equal(feastversion.FeastVersion))
Expect(resource.Status.ClientConfigMap).To(Equal(feast.GetFeastServiceName(services.ClientFeastType)))
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
Expect(resource.Status.Applied.AuthConfig).To(Equal(&feastdevv1alpha1.AuthConfig{}))
Expect(resource.Status.Applied.Services).NotTo(BeNil())
Expect(resource.Status.Applied.Services.OfflineStore).To(BeNil())
Expect(resource.Status.Applied.Services.OnlineStore).To(BeNil())
Expand Down Expand Up @@ -146,6 +150,9 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
Expect(cond.Type).To(Equal(feastdevv1alpha1.ReadyType))
Expect(cond.Message).To(Equal(feastdevv1alpha1.ReadyMessage))

cond = apimeta.FindStatusCondition(resource.Status.Conditions, feastdevv1alpha1.KubernetesAuthReadyType)
Expect(cond).To(BeNil())

cond = apimeta.FindStatusCondition(resource.Status.Conditions, feastdevv1alpha1.RegistryReadyType)
Expect(cond).ToNot(BeNil())
Expect(cond.Status).To(Equal(metav1.ConditionTrue))
Expand Down Expand Up @@ -220,7 +227,7 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
resource = &feastdevv1alpha1.FeatureStore{}
err = k8sClient.Get(ctx, typeNamespacedName, resource)
Expect(err).NotTo(HaveOccurred())
feast.FeatureStore = resource
feast.Handler.FeatureStore = resource
Expect(resource.Status.Applied.Services.Registry.Local.Persistence.FilePersistence.S3AdditionalKwargs).NotTo(BeNil())
Expect(resource.Status.Applied.Services.Registry.Local.Persistence.FilePersistence.S3AdditionalKwargs).NotTo(Equal(&s3AdditionalKwargs))
Expect(resource.Status.Applied.Services.Registry.Local.Persistence.FilePersistence.S3AdditionalKwargs).To(Equal(&newS3AdditionalKwargs))
Expand Down Expand Up @@ -274,10 +281,12 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
Expect(cmList.Items).To(HaveLen(1))

feast := services.FeastServices{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
Handler: handler.FeastHandler{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
},
}

// check registry deployment
Expand Down Expand Up @@ -373,7 +382,7 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
resource = &feastdevv1alpha1.FeatureStore{}
err = k8sClient.Get(ctx, typeNamespacedName, resource)
Expect(err).NotTo(HaveOccurred())
feast.FeatureStore = resource
feast.Handler.FeatureStore = resource

// check registry config
deploy = &appsv1.Deployment{}
Expand Down
Loading