Skip to content

Commit 6a4690a

Browse files
ntkatholentkathole
committed
fix: Default authentication to kubernetes auth
Signed-off-by: ntkathole <[email protected]>
1 parent cf3ed14 commit 6a4690a

32 files changed

Lines changed: 485 additions & 147 deletions

‎.github/workflows/operator-e2e-integration-tests.yml‎

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,7 +98,32 @@ jobs:
9898
- name: Debug KIND Cluster when there is a failure
9999
if: failure()
100100
run: |
101-
kubectl get pods --all-namespaces
101+
echo "=== FeatureStore CRs and conditions ==="
102+
kubectl get featurestores.feast.dev --all-namespaces -o yaml || true
103+
echo ""
104+
echo "=== Pods ==="
105+
kubectl get pods --all-namespaces -o wide
106+
echo ""
107+
echo "=== Pod details for non-Running pods ==="
108+
for ns in $(kubectl get ns -o jsonpath='{.items[*].metadata.name}'); do
109+
for pod in $(kubectl get pods -n "$ns" --field-selector='status.phase!=Running' -o jsonpath='{.items[*].metadata.name}' 2>/dev/null); do
110+
echo "--- Pod $ns/$pod ---"
111+
kubectl describe pod "$pod" -n "$ns" 2>/dev/null | tail -30
112+
echo "--- Logs ---"
113+
kubectl logs "$pod" -n "$ns" --all-containers --tail=50 2>/dev/null || true
114+
done
115+
done
116+
echo ""
117+
echo "=== Operator logs ==="
118+
kubectl logs -n feast-operator-system deploy/feast-operator-controller-manager --tail=100 2>/dev/null || true
119+
echo ""
120+
echo "=== Cluster RBAC for feast ==="
121+
kubectl get clusterroles,clusterrolebindings -o name | grep feast || true
122+
echo ""
123+
echo "=== Events ==="
124+
kubectl get events --all-namespaces --sort-by='.lastTimestamp' | tail -50
125+
echo ""
126+
echo "=== Nodes ==="
102127
kubectl describe nodes
103128
104129
- name: Clean up

‎.secrets.baseline‎

Lines changed: 10 additions & 10 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎docs/getting-started/components/authz_manager.md‎

Lines changed: 69 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,21 +21,89 @@ the authorization tokens that the server can properly identify and use to enforc
2121
The server-side implementation of the authorization functionality is defined [here](./../../../sdk/python/feast/permissions/server).
2222
Few of the key models, classes to understand the authorization implementation on the client side can be found [here](./../../../sdk/python/feast/permissions/client).
2323

24+
## Default Authorization Behavior
25+
26+
### Feast Operator (Kubernetes Deployments)
27+
28+
When deploying Feast using the [Feast operator](../../../infra/feast-operator/docs/api/markdown/ref.md), **Kubernetes authentication is enabled by default**. If no `authz` section is specified in the `FeatureStore` CR, the operator automatically configures `kubernetes` auth for all deployed services.
29+
30+
This follows an **"Authenticated by Default, Authorized Gradually"** security model:
31+
- All Feast endpoints require a valid Kubernetes bearer token by default.
32+
- If no explicit `Permission` objects are defined (via `permissions.py` + `feast apply`), **all authenticated users are granted full access**. A warning is logged to remind administrators to define fine-grained permissions.
33+
- Unauthenticated requests are rejected.
34+
35+
This ensures that Feast deployments are never accidentally exposed without authentication, while allowing teams to incrementally adopt fine-grained RBAC.
36+
37+
#### Disabling Authentication with `noAuth`
38+
39+
For development, testing, or environments where authentication is handled externally, you can explicitly disable authentication using the `noAuth` option in the `FeatureStore` CR:
40+
41+
```yaml
42+
apiVersion: feast.dev/v1
43+
kind: FeatureStore
44+
metadata:
45+
name: my-feature-store
46+
spec:
47+
feastProject: my_project
48+
authz:
49+
noAuth: true
50+
```
51+
52+
{% hint style="warning" %}
53+
Setting `noAuth: true` disables all authentication and authorization. All endpoints become publicly accessible without any identity checks. Only use this for local development or testing environments. For production, use `kubernetes` or `oidc` authentication.
54+
{% endhint %}
55+
56+
#### Explicit Kubernetes Auth (Default)
57+
58+
This is equivalent to the default behavior when no `authz` section is provided:
59+
60+
```yaml
61+
apiVersion: feast.dev/v1
62+
kind: FeatureStore
63+
metadata:
64+
name: my-feature-store
65+
spec:
66+
feastProject: my_project
67+
authz:
68+
kubernetes: {}
69+
```
70+
71+
#### OIDC Auth via Operator
72+
73+
```yaml
74+
apiVersion: feast.dev/v1
75+
kind: FeatureStore
76+
metadata:
77+
name: my-feature-store
78+
spec:
79+
feastProject: my_project
80+
authz:
81+
oidc:
82+
secretRef:
83+
name: feast-oidc-secret
84+
```
85+
86+
### Standalone Deployments (feature_store.yaml)
87+
2488
## Configuring Authorization
2589
The authorization is configured using a dedicated `auth` section in the `feature_store.yaml` configuration.
2690

2791
**Note**: As a consequence, when deploying the Feast servers with the Helm [charts](../../../infra/charts/feast-feature-server/README.md),
2892
the `feature_store_yaml_base64` value must include the `auth` section to specify the authorization configuration.
2993

3094
### No Authorization
31-
This configuration applies the default `no_auth` authorization:
95+
This configuration applies the `no_auth` authorization:
3296
```yaml
3397
project: my-project
3498
auth:
3599
type: no_auth
36100
...
37101
```
38102

103+
{% hint style="warning" %}
104+
Running with `auth.type: no_auth` leaves all endpoints unauthenticated. This is suitable for local development only. For production deployments, configure `kubernetes` or `oidc` authentication.
105+
{% endhint %}
106+
39107
### OIDC Authorization
40108
With OIDC authorization, the Feast client proxies retrieve the JWT token from an OIDC server (or [Identity Provider](https://openid.net/developers/how-connect-works/))
41109
and append it in every request to a Feast server, using an [Authorization Bearer Token](https://developer.mozilla.org/en-US/docs/Web/HTTP/Authentication#bearer).

‎docs/reference/auth/kubernetes_auth_setup.md‎

Lines changed: 51 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,45 @@ Feast supports extracting user groups, namespaces and roles of both Service Acco
1010
- **Namespaces**: Kubernetes namespaces associated with User/SA
1111
- **Roles**: Kubernetes roles associated with User/SA
1212

13+
## Operator Default Behavior
14+
15+
When deploying Feast using the Feast operator, **Kubernetes authentication is enabled by default**. You do not need to explicitly configure `authz` in the `FeatureStore` CR — the operator automatically applies `kubernetes` auth to all deployed services.
16+
17+
### What This Means
18+
19+
- All HTTP/gRPC requests to Feast services must include a valid Kubernetes bearer token in the `Authorization` header.
20+
- The server validates the token via the Kubernetes Token Access Review API and extracts user identity (username, groups, namespaces, roles).
21+
- If no `Permission` objects are defined, authenticated users get full access (with a warning logged).
22+
- Unauthenticated requests receive a `401 Unauthorized` response.
23+
24+
### Disabling Authentication
25+
26+
If you need to run Feast without authentication (e.g., for local development or testing), explicitly set `noAuth: true` in the `FeatureStore` CR:
27+
28+
```yaml
29+
apiVersion: feast.dev/v1
30+
kind: FeatureStore
31+
metadata:
32+
name: my-feature-store
33+
spec:
34+
feastProject: my_project
35+
authz:
36+
noAuth: true
37+
```
38+
39+
{% hint style="warning" %}
40+
`noAuth: true` disables all authentication and authorization checks. All endpoints become publicly accessible. Use only in non-production environments.
41+
{% endhint %}
42+
43+
### Choosing an Auth Mode
44+
45+
| `spec.authz` Setting | Behavior |
46+
| --- | --- |
47+
| _(not specified)_ | Kubernetes auth enabled (default) |
48+
| `kubernetes: {}` | Kubernetes auth enabled (explicit) |
49+
| `oidc: { ... }` | OIDC auth enabled |
50+
| `noAuth: true` | All auth disabled |
51+
1352
## Key Features
1453

1554
### Setting Up Kubernetes RBAC for Feast
@@ -142,20 +181,29 @@ Run `feast apply` from CLI/API/SDK on server or from client(if permitted) to app
142181

143182
### Common Issues
144183

145-
1. **Token Access Review Fails**
184+
1. **401 Unauthorized After Upgrading**
185+
- The Feast operator now defaults to Kubernetes authentication. If your existing FeatureStore CR did not specify `authz`, the upgrade enables auth automatically.
186+
- **Quick fix for testing**: Add `authz.noAuth: true` to your `FeatureStore` CR to restore the previous unauthenticated behavior.
187+
- **Recommended**: Update your client applications to include a valid Kubernetes bearer token in requests.
188+
189+
2. **Token Access Review Fails**
146190
- Check that the Feast server has the required RBAC permissions
147191
- Verify the token is valid and not expired
148192
- Check server logs for detailed error messages in debug mode
149193

150-
2. **Groups/Namespaces Not Extracted**
194+
3. **Groups/Namespaces Not Extracted**
151195
- Verify the token contains the expected claims
152196
- Check that the user is properly configured in Kubernetes/ODH/RHOAI
153197

154-
3. **Permission Denied**
198+
4. **Permission Denied**
155199
- Verify the user is added to required groups/namespaces Or has the required role assigned
156200
- Check that the policy is correctly configured
157201
- Review the permission evaluation logs
158202

203+
5. **"No permissions defined" Warning in Logs**
204+
- This is expected when Kubernetes auth is enabled but no `Permission` objects have been applied.
205+
- Authenticated users get full access by default. Define permissions via `permissions.py` + `feast apply` to enforce fine-grained authorization.
206+
159207
## Migration Guide
160208

161209
### From Role-Based to Group/Namespace-Based

‎infra/feast-operator/api/v1/featurestore_types.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -949,10 +949,15 @@ type OptionalCtrConfigs struct {
949949
}
950950

951951
// AuthzConfig defines the authorization settings for the deployed Feast services.
952-
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc)].exists_one(c, c)",message="One selection required between kubernetes or oidc."
952+
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c, c)",message="One selection required between kubernetes, oidc, or noAuth."
953953
type AuthzConfig struct {
954954
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
955955
OidcAuthz *OidcAuthz `json:"oidc,omitempty"`
956+
// NoAuth explicitly disables authentication and authorization.
957+
// When set to true, Feast services run without any auth checks.
958+
// Use only for development or testing environments.
959+
// +optional
960+
NoAuth *bool `json:"noAuth,omitempty"`
956961
}
957962

958963
// KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.

‎infra/feast-operator/api/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/feast-operator/api/v1alpha1/featurestore_types.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -622,10 +622,15 @@ type OptionalCtrConfigs struct {
622622
}
623623

624624
// AuthzConfig defines the authorization settings for the deployed Feast services.
625-
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc)].exists_one(c, c)",message="One selection required between kubernetes or oidc."
625+
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c, c)",message="One selection required between kubernetes, oidc, or noAuth."
626626
type AuthzConfig struct {
627627
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
628628
OidcAuthz *OidcAuthz `json:"oidc,omitempty"`
629+
// NoAuth explicitly disables authentication and authorization.
630+
// When set to true, Feast services run without any auth checks.
631+
// Use only for development or testing environments.
632+
// +optional
633+
NoAuth *bool `json:"noAuth,omitempty"`
629634
}
630635

631636
// KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.

‎infra/feast-operator/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)