Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: RBAC Authorization in Feast Operator #4786

Open
wants to merge 11 commits into
base: master
Choose a base branch
from

Conversation

dmartinol
Copy link
Contributor

@dmartinol dmartinol commented Nov 22, 2024

What this PR does / why we need it:

Adding support to define the kubernetes authorization manager with the Feast Operator.

  • All services are configured to adopt this authorization manager.
  • Services runs with a ServiceAccount that is bound to a newly created Role allowing to get, list, watch the other Roles and RoleBindings in the same namespace.
  • Admins are not requested to perform any manual configuration once the custom resource is installed.

Sample manifest to configure the deployments:

apiVersion: feast.dev/v1alpha1
kind: FeatureStore
metadata:
  name: sample-kubernetes-auth
spec:
  feastProject: my_project
  services:
    onlineStore: {}
    offlineStore: {}
    registry: {}
  authz:
    kubernetes:
      roles:
        - reader
        - writer

Which issue(s) this PR fixes:

Relates to #4765
Next PR will add support for the OIDC authorization.

@dmartinol dmartinol requested a review from a team as a code owner November 22, 2024 21:34
@dmartinol
Copy link
Contributor Author

Copy link
Contributor

@tchughesiv tchughesiv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks for this! only a few nits so far

Copy link
Contributor

@tchughesiv tchughesiv left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

a few nits ... otherwise lgtm

Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
Signed-off-by: Daniele Martinoli <[email protected]>
@dmartinol
Copy link
Contributor Author

@feast-dev/reviewers-and-approvers please TAL

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants