Skip to content

Commit 51c16b1

Browse files
ntkatholentkathole
authored
fix: Fixed tls issue when running both grpc and rest servers (#5617)
* fix: Fixed tls issue when running both grpc and rest servers Signed-off-by: ntkathole <[email protected]> * fix: Fixed cache_mode bug introduced in 3c7a022 Signed-off-by: ntkathole <[email protected]> --------- Signed-off-by: ntkathole <[email protected]>
1 parent 3c7a022 commit 51c16b1

3 files changed

Lines changed: 48 additions & 9 deletions

File tree

‎infra/feast-operator/internal/controller/services/services.go‎

Lines changed: 27 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -665,7 +665,33 @@ func (feast *FeastServices) setService(svc *corev1.Service, feastType FeastServi
665665
if len(svc.Annotations) == 0 {
666666
svc.Annotations = map[string]string{}
667667
}
668-
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = svc.Name + tlsNameSuffix
668+
669+
// For registry services, we need special handling based on which services are enabled
670+
if feastType == RegistryFeastType && feast.isRegistryServer() {
671+
grpcEnabled := feast.isRegistryGrpcEnabled()
672+
restEnabled := feast.isRegistryRestEnabled()
673+
674+
if grpcEnabled && restEnabled {
675+
// Both services enabled: Use gRPC service name as primary, add REST as SAN
676+
grpcSvcName := feast.initFeastSvc(RegistryFeastType).Name
677+
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = grpcSvcName + tlsNameSuffix
678+
679+
// Add Subject Alternative Names (SANs) for both services
680+
grpcHostname := grpcSvcName + "." + svc.Namespace + ".svc.cluster.local"
681+
restHostname := feast.GetFeastRestServiceName(RegistryFeastType) + "." + svc.Namespace + ".svc.cluster.local"
682+
svc.Annotations["service.beta.openshift.io/serving-cert-sans"] = grpcHostname + "," + restHostname
683+
} else if grpcEnabled && !restEnabled {
684+
// Only gRPC enabled: Use gRPC service name
685+
grpcSvcName := feast.initFeastSvc(RegistryFeastType).Name
686+
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = grpcSvcName + tlsNameSuffix
687+
} else if !grpcEnabled && restEnabled {
688+
// Only REST enabled: Use REST service name
689+
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = svc.Name + tlsNameSuffix
690+
}
691+
} else {
692+
// Standard behavior for non-registry services
693+
svc.Annotations["service.beta.openshift.io/serving-cert-secret-name"] = svc.Name + tlsNameSuffix
694+
}
669695
}
670696

671697
var port int32 = HttpPort

‎infra/feast-operator/internal/controller/services/tls.go‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,18 +71,31 @@ func (feast *FeastServices) setOpenshiftTls() error {
7171
}
7272
}
7373
if feast.localRegistryOpenshiftTls() {
74-
if feast.isRegistryRestEnabled() {
74+
grpcEnabled := feast.isRegistryGrpcEnabled()
75+
restEnabled := feast.isRegistryRestEnabled()
76+
77+
if grpcEnabled && restEnabled {
78+
// Both services enabled: Use gRPC service name as primary certificate
79+
// The certificate will include both hostnames as SANs via service annotations
7580
appliedServices.Registry.Local.Server.TLS = &feastdevv1alpha1.TlsConfigs{
7681
SecretRef: &corev1.LocalObjectReference{
77-
Name: feast.initFeastRestSvc(RegistryFeastType).Name + tlsNameSuffix,
82+
Name: feast.initFeastSvc(RegistryFeastType).Name + tlsNameSuffix,
7883
},
7984
}
80-
} else {
85+
} else if grpcEnabled && !restEnabled {
86+
// Only gRPC enabled: Use gRPC service name
8187
appliedServices.Registry.Local.Server.TLS = &feastdevv1alpha1.TlsConfigs{
8288
SecretRef: &corev1.LocalObjectReference{
8389
Name: feast.initFeastSvc(RegistryFeastType).Name + tlsNameSuffix,
8490
},
8591
}
92+
} else if !grpcEnabled && restEnabled {
93+
// Only REST enabled: Use REST service name
94+
appliedServices.Registry.Local.Server.TLS = &feastdevv1alpha1.TlsConfigs{
95+
SecretRef: &corev1.LocalObjectReference{
96+
Name: feast.initFeastRestSvc(RegistryFeastType).Name + tlsNameSuffix,
97+
},
98+
}
8699
}
87100
} else if remote, err := feast.remoteRegistryOpenshiftTls(); remote {
88101
// if the remote registry reference is using openshift's service serving certificates, we can use the injected service CA bundle configMap

‎sdk/python/feast/infra/registry/sql.py‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -269,17 +269,17 @@ def __init__(
269269
registry_config.thread_pool_executor_worker_count
270270
)
271271
self.purge_feast_metadata = registry_config.purge_feast_metadata
272+
super().__init__(
273+
project=project,
274+
cache_ttl_seconds=registry_config.cache_ttl_seconds,
275+
cache_mode=registry_config.cache_mode,
276+
)
272277
# Sync feast_metadata to projects table
273278
# when purge_feast_metadata is set to True, Delete data from
274279
# feast_metadata table and list_project_metadata will not return any data
275280
self._sync_feast_metadata_to_projects_table()
276281
if not self.purge_feast_metadata:
277282
self._maybe_init_project_metadata(project)
278-
super().__init__(
279-
project=project,
280-
cache_ttl_seconds=registry_config.cache_ttl_seconds,
281-
cache_mode=registry_config.cache_mode,
282-
)
283283

284284
def _sync_feast_metadata_to_projects_table(self):
285285
feast_metadata_projects: dict = {}

0 commit comments

Comments
 (0)