Skip to content

Commit 0ef5acc

Browse files
dmartinoldmartinol
authored
feat: RBAC Authorization in Feast Operator (#4786)
* Initial commit Signed-off-by: Daniele Martinoli <[email protected]> * refactoring types with FeastHandler Signed-off-by: Daniele Martinoli <[email protected]> * no private image Signed-off-by: Daniele Martinoli <[email protected]> * removed log-level Signed-off-by: Daniele Martinoli <[email protected]> * no empty list for default Role Signed-off-by: Daniele Martinoli <[email protected]> * removed nameLabelKey, using serices.NameLabelKey Signed-off-by: Daniele Martinoli <[email protected]> * improved CRD comments and using IsLocalRegistry Signed-off-by: Daniele Martinoli <[email protected]> * fixing generated code Signed-off-by: Daniele Martinoli <[email protected]> * renamed auth condition and types Signed-off-by: Daniele Martinoli <[email protected]> * post rebase fixes Signed-off-by: Daniele Martinoli <[email protected]> * more renamings Signed-off-by: Daniele Martinoli <[email protected]> --------- Signed-off-by: Daniele Martinoli <[email protected]>
1 parent f226cb9 commit 0ef5acc

24 files changed

Lines changed: 1461 additions & 193 deletions

‎infra/feast-operator/api/v1alpha1/featurestore_types.go‎

Lines changed: 37 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,26 +28,29 @@ const (
2828
FailedPhase = "Failed"
2929

3030
// Feast condition types:
31-
ClientReadyType = "Client"
32-
OfflineStoreReadyType = "OfflineStore"
33-
OnlineStoreReadyType = "OnlineStore"
34-
RegistryReadyType = "Registry"
35-
ReadyType = "FeatureStore"
31+
ClientReadyType = "Client"
32+
OfflineStoreReadyType = "OfflineStore"
33+
OnlineStoreReadyType = "OnlineStore"
34+
RegistryReadyType = "Registry"
35+
ReadyType = "FeatureStore"
36+
AuthorizationReadyType = "AuthorizationReadyType"
3637

3738
// Feast condition reasons:
38-
ReadyReason = "Ready"
39-
FailedReason = "FeatureStoreFailed"
40-
OfflineStoreFailedReason = "OfflineStoreDeploymentFailed"
41-
OnlineStoreFailedReason = "OnlineStoreDeploymentFailed"
42-
RegistryFailedReason = "RegistryDeploymentFailed"
43-
ClientFailedReason = "ClientDeploymentFailed"
39+
ReadyReason = "Ready"
40+
FailedReason = "FeatureStoreFailed"
41+
OfflineStoreFailedReason = "OfflineStoreDeploymentFailed"
42+
OnlineStoreFailedReason = "OnlineStoreDeploymentFailed"
43+
RegistryFailedReason = "RegistryDeploymentFailed"
44+
ClientFailedReason = "ClientDeploymentFailed"
45+
KubernetesAuthzFailedReason = "KubernetesAuthorizationDeploymentFailed"
4446

4547
// Feast condition messages:
46-
ReadyMessage = "FeatureStore installation complete"
47-
OfflineStoreReadyMessage = "Offline Store installation complete"
48-
OnlineStoreReadyMessage = "Online Store installation complete"
49-
RegistryReadyMessage = "Registry installation complete"
50-
ClientReadyMessage = "Client installation complete"
48+
ReadyMessage = "FeatureStore installation complete"
49+
OfflineStoreReadyMessage = "Offline Store installation complete"
50+
OnlineStoreReadyMessage = "Online Store installation complete"
51+
RegistryReadyMessage = "Registry installation complete"
52+
ClientReadyMessage = "Client installation complete"
53+
KubernetesAuthzReadyMessage = "Kubernetes authorization installation complete"
5154

5255
// entity_key_serialization_version
5356
SerializationVersion = 3
@@ -59,6 +62,7 @@ type FeatureStoreSpec struct {
5962
// FeastProject is the Feast project id. This can be any alphanumeric string with underscores, but it cannot start with an underscore. Required.
6063
FeastProject string `json:"feastProject"`
6164
Services *FeatureStoreServices `json:"services,omitempty"`
65+
AuthzConfig *AuthzConfig `json:"authz,omitempty"`
6266
}
6367

6468
// FeatureStoreServices defines the desired feast service deployments. ephemeral registry is deployed by default.
@@ -263,6 +267,23 @@ type OptionalConfigs struct {
263267
Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
264268
}
265269

270+
// AuthzConfig defines the authorization settings for the deployed Feast services.
271+
type AuthzConfig struct {
272+
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
273+
}
274+
275+
// KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
276+
// https://kubernetes.io/docs/reference/access-authn-authz/rbac/
277+
type KubernetesAuthz struct {
278+
// The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
279+
// Roles are managed by the operator and created with an empty list of rules.
280+
// See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
281+
// The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
282+
// This configuration option is only providing a way to automate this procedure.
283+
// Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
284+
Roles []string `json:"roles,omitempty"`
285+
}
286+
266287
// FeatureStoreStatus defines the observed state of FeatureStore
267288
type FeatureStoreStatus struct {
268289
// Shows the currently applied feast configuration, including any pertinent defaults

‎infra/feast-operator/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 45 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/feast-operator/config/crd/bases/feast.dev_featurestores.yaml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,28 @@ spec:
4848
spec:
4949
description: FeatureStoreSpec defines the desired state of FeatureStore
5050
properties:
51+
authz:
52+
description: AuthzConfig defines the authorization settings for the
53+
deployed Feast services.
54+
properties:
55+
kubernetes:
56+
description: |-
57+
KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
58+
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
59+
properties:
60+
roles:
61+
description: |-
62+
The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
63+
Roles are managed by the operator and created with an empty list of rules.
64+
See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
65+
The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
66+
This configuration option is only providing a way to automate this procedure.
67+
Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
68+
items:
69+
type: string
70+
type: array
71+
type: object
72+
type: object
5173
feastProject:
5274
description: FeastProject is the Feast project id. This can be any
5375
alphanumeric string with underscores, but it cannot start with an
@@ -1048,6 +1070,28 @@ spec:
10481070
description: Shows the currently applied feast configuration, including
10491071
any pertinent defaults
10501072
properties:
1073+
authz:
1074+
description: AuthzConfig defines the authorization settings for
1075+
the deployed Feast services.
1076+
properties:
1077+
kubernetes:
1078+
description: |-
1079+
KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
1080+
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
1081+
properties:
1082+
roles:
1083+
description: |-
1084+
The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
1085+
Roles are managed by the operator and created with an empty list of rules.
1086+
See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
1087+
The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
1088+
This configuration option is only providing a way to automate this procedure.
1089+
Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
1090+
items:
1091+
type: string
1092+
type: array
1093+
type: object
1094+
type: object
10511095
feastProject:
10521096
description: FeastProject is the Feast project id. This can be
10531097
any alphanumeric string with underscores, but it cannot start

‎infra/feast-operator/config/rbac/role.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -62,3 +62,14 @@ rules:
6262
- get
6363
- patch
6464
- update
65+
- apiGroups:
66+
- rbac.authorization.k8s.io
67+
resources:
68+
- roles
69+
verbs:
70+
- create
71+
- delete
72+
- get
73+
- list
74+
- update
75+
- watch

‎infra/feast-operator/config/samples/v1alpha1_featurestore_all_services_default.yaml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: feast.dev/v1alpha1
2+
kind: FeatureStore
3+
metadata:
4+
name: sample-all-default
5+
spec:
6+
feastProject: my_project
7+
services:
8+
onlineStore:
9+
image: 'feastdev/feature-server:0.40.0'
10+
offlineStore:
11+
image: 'feastdev/feature-server:0.40.0'
12+
registry:
13+
local:
14+
image: 'feastdev/feature-server:0.40.0'

‎infra/feast-operator/config/samples/v1alpha1_featurestore_kubernetes_auth.yaml‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
apiVersion: feast.dev/v1alpha1
2+
kind: FeatureStore
3+
metadata:
4+
name: sample-kubernetes-auth
5+
spec:
6+
feastProject: my_project
7+
services:
8+
onlineStore:
9+
persistence:
10+
file:
11+
path: /data/online_store.db
12+
offlineStore:
13+
persistence:
14+
file:
15+
type: dask
16+
registry:
17+
local:
18+
persistence:
19+
file:
20+
path: /data/registry.db
21+
authz:
22+
kubernetes:
23+
roles:
24+
- reader
25+
- writer

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,28 @@ spec:
5656
spec:
5757
description: FeatureStoreSpec defines the desired state of FeatureStore
5858
properties:
59+
authz:
60+
description: AuthzConfig defines the authorization settings for the
61+
deployed Feast services.
62+
properties:
63+
kubernetes:
64+
description: |-
65+
KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
66+
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
67+
properties:
68+
roles:
69+
description: |-
70+
The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
71+
Roles are managed by the operator and created with an empty list of rules.
72+
See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
73+
The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
74+
This configuration option is only providing a way to automate this procedure.
75+
Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
76+
items:
77+
type: string
78+
type: array
79+
type: object
80+
type: object
5981
feastProject:
6082
description: FeastProject is the Feast project id. This can be any
6183
alphanumeric string with underscores, but it cannot start with an
@@ -1056,6 +1078,28 @@ spec:
10561078
description: Shows the currently applied feast configuration, including
10571079
any pertinent defaults
10581080
properties:
1081+
authz:
1082+
description: AuthzConfig defines the authorization settings for
1083+
the deployed Feast services.
1084+
properties:
1085+
kubernetes:
1086+
description: |-
1087+
KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
1088+
https://kubernetes.io/docs/reference/access-authn-authz/rbac/
1089+
properties:
1090+
roles:
1091+
description: |-
1092+
The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
1093+
Roles are managed by the operator and created with an empty list of rules.
1094+
See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
1095+
The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
1096+
This configuration option is only providing a way to automate this procedure.
1097+
Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
1098+
items:
1099+
type: string
1100+
type: array
1101+
type: object
1102+
type: object
10591103
feastProject:
10601104
description: FeastProject is the Feast project id. This can be
10611105
any alphanumeric string with underscores, but it cannot start
@@ -2324,6 +2368,17 @@ rules:
23242368
- get
23252369
- patch
23262370
- update
2371+
- apiGroups:
2372+
- rbac.authorization.k8s.io
2373+
resources:
2374+
- roles
2375+
verbs:
2376+
- create
2377+
- delete
2378+
- get
2379+
- list
2380+
- update
2381+
- watch
23272382
---
23282383
apiVersion: rbac.authorization.k8s.io/v1
23292384
kind: ClusterRole

0 commit comments

Comments
 (0)