Skip to content

Commit 3881263

Browse files
jyejarejyejare
authored
docs: Feast Operator documentation showing feature-server API interaction (#5392)
A new TLS/Openshift based RBAC example, made Operator RBAC a NonTLS kubernetes example Signed-off-by: jyejare <jyejare@redhat.com>
1 parent de650de commit 3881263

15 files changed

+3483
-1090
lines changed

‎examples/operator-rbac-openshift-tls/1-setup-operator-rbac.ipynb‎

Lines changed: 741 additions & 0 deletions
Large diffs are not rendered by default.

‎examples/operator-rbac-openshift-tls/2-client-rbac-test-pod.ipynb‎

Lines changed: 715 additions & 0 deletions
Large diffs are not rendered by default.

‎examples/operator-rbac-openshift-tls/3-uninstall.ipynb‎

Lines changed: 221 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,221 @@
1+
{
2+
"cells": [
3+
{
4+
"cell_type": "code",
5+
"execution_count": null,
6+
"id": "bd1a081f3f7f5752",
7+
"metadata": {},
8+
"outputs": [],
9+
"source": [
10+
"## Uninstall"
11+
]
12+
},
13+
{
14+
"cell_type": "markdown",
15+
"id": "1175f3d6c5ee9bf0",
16+
"metadata": {},
17+
"source": [
18+
"### Uninstall the Operator and Feast Instance"
19+
]
20+
},
21+
{
22+
"cell_type": "code",
23+
"execution_count": 1,
24+
"id": "f4b4c6fa4a1fe0a8",
25+
"metadata": {
26+
"ExecuteTime": {
27+
"end_time": "2025-03-14T14:45:22.053112Z",
28+
"start_time": "2025-03-14T14:45:15.816729Z"
29+
}
30+
},
31+
"outputs": [
32+
{
33+
"name": "stdout",
34+
"output_type": "stream",
35+
"text": [
36+
"featurestore.feast.dev \"sample-kubernetes-auth\" deleted\n",
37+
"namespace \"feast-operator-system\" deleted\n",
38+
"customresourcedefinition.apiextensions.k8s.io \"featurestores.feast.dev\" deleted\n",
39+
"serviceaccount \"feast-operator-controller-manager\" deleted\n",
40+
"role.rbac.authorization.k8s.io \"feast-operator-leader-election-role\" deleted\n",
41+
"clusterrole.rbac.authorization.k8s.io \"feast-operator-featurestore-editor-role\" deleted\n",
42+
"clusterrole.rbac.authorization.k8s.io \"feast-operator-featurestore-viewer-role\" deleted\n",
43+
"clusterrole.rbac.authorization.k8s.io \"feast-operator-manager-role\" deleted\n",
44+
"clusterrole.rbac.authorization.k8s.io \"feast-operator-metrics-auth-role\" deleted\n",
45+
"clusterrole.rbac.authorization.k8s.io \"feast-operator-metrics-reader\" deleted\n",
46+
"rolebinding.rbac.authorization.k8s.io \"feast-operator-leader-election-rolebinding\" deleted\n",
47+
"clusterrolebinding.rbac.authorization.k8s.io \"feast-operator-manager-rolebinding\" deleted\n",
48+
"clusterrolebinding.rbac.authorization.k8s.io \"feast-operator-metrics-auth-rolebinding\" deleted\n",
49+
"service \"feast-operator-controller-manager-metrics-service\" deleted\n",
50+
"deployment.apps \"feast-operator-controller-manager\" deleted\n"
51+
]
52+
}
53+
],
54+
"source": [
55+
"!kubectl delete -f ../../infra/feast-operator/config/samples/v1alpha1_featurestore_kubernetes_auth.yaml\n",
56+
"!kubectl delete -f ../../infra/feast-operator/dist/install.yaml"
57+
]
58+
},
59+
{
60+
"cell_type": "markdown",
61+
"id": "2a2aa884aeddfb99",
62+
"metadata": {},
63+
"source": [
64+
"## Delete RoleBindings and ServiceAccounts\n"
65+
]
66+
},
67+
{
68+
"cell_type": "code",
69+
"execution_count": 2,
70+
"id": "6ce30879d64bbd06",
71+
"metadata": {
72+
"ExecuteTime": {
73+
"end_time": "2025-03-14T14:45:47.419179Z",
74+
"start_time": "2025-03-14T14:45:46.325817Z"
75+
}
76+
},
77+
"outputs": [
78+
{
79+
"name": "stdout",
80+
"output_type": "stream",
81+
"text": [
82+
"Deleting RoleBindings...\n",
83+
"rolebinding.rbac.authorization.k8s.io \"feast-user-rolebinding\" deleted\n",
84+
"rolebinding.rbac.authorization.k8s.io \"feast-admin-rolebinding\" deleted\n",
85+
"Deleting ServiceAccounts...\n",
86+
"serviceaccount \"feast-user-sa\" deleted\n",
87+
"serviceaccount \"feast-admin-sa\" deleted\n",
88+
"serviceaccount \"feast-unauthorized-user-sa\" deleted\n"
89+
]
90+
}
91+
],
92+
"source": [
93+
"!echo \"Deleting RoleBindings...\"\n",
94+
"!kubectl delete rolebinding feast-user-rolebinding -n feast --ignore-not-found\n",
95+
"!kubectl delete rolebinding feast-admin-rolebinding -n feast --ignore-not-found\n",
96+
"\n",
97+
"!echo \"Deleting ServiceAccounts...\"\n",
98+
"!kubectl delete serviceaccount feast-user-sa -n feast --ignore-not-found\n",
99+
"!kubectl delete serviceaccount feast-admin-sa -n feast --ignore-not-found\n",
100+
"!kubectl delete serviceaccount feast-unauthorized-user-sa -n feast --ignore-not-found\n"
101+
]
102+
},
103+
{
104+
"cell_type": "markdown",
105+
"id": "fa7a79763774f770",
106+
"metadata": {},
107+
"source": [
108+
"### Delete Client Example Deployments"
109+
]
110+
},
111+
{
112+
"cell_type": "code",
113+
"execution_count": 3,
114+
"id": "7bc23b3eb0153c75",
115+
"metadata": {
116+
"ExecuteTime": {
117+
"end_time": "2025-03-14T14:46:05.998191Z",
118+
"start_time": "2025-03-14T14:46:05.344334Z"
119+
}
120+
},
121+
"outputs": [
122+
{
123+
"name": "stdout",
124+
"output_type": "stream",
125+
"text": [
126+
"deployment.apps \"client-admin-user\" deleted\n",
127+
"deployment.apps \"client-readonly-user\" deleted\n",
128+
"deployment.apps \"client-unauthorized-user\" deleted\n",
129+
"configmap \"client-feature-repo-config\" deleted\n"
130+
]
131+
}
132+
],
133+
"source": [
134+
"!kubectl delete -f client/admin_user_deployment_tls.yaml\n",
135+
"!kubectl delete -f client/readonly_user_deployment_tls.yaml\n",
136+
"!kubectl delete -f client/unauthorized_user_deployment_tls.yaml\n",
137+
"!kubectl delete configmap client-feature-repo-config -n feast"
138+
]
139+
},
140+
{
141+
"cell_type": "markdown",
142+
"id": "ce8ef7c832d146dd",
143+
"metadata": {},
144+
"source": [
145+
"### Validate all Objects Removed from Namespace and Delete the Namespace"
146+
]
147+
},
148+
{
149+
"cell_type": "code",
150+
"execution_count": 4,
151+
"id": "587eb85352a8a353",
152+
"metadata": {
153+
"ExecuteTime": {
154+
"end_time": "2025-03-14T14:46:14.626703Z",
155+
"start_time": "2025-03-14T14:46:14.429984Z"
156+
}
157+
},
158+
"outputs": [
159+
{
160+
"name": "stdout",
161+
"output_type": "stream",
162+
"text": [
163+
"\u001b[33;1mWarning:\u001b[0m apps.openshift.io/v1 DeploymentConfig is deprecated in v4.14+, unavailable in v4.10000+\n",
164+
"NAME READY STATUS RESTARTS AGE\n",
165+
"pod/client-admin-user-69b5448688-srvg5 1/1 Terminating 0 83s\n",
166+
"pod/client-readonly-user-6bf689d-ggb8f 1/1 Terminating 0 5m36s\n",
167+
"pod/client-unauthorized-user-74f795fd9f-zmcxp 1/1 Terminating 0 3m40s\n",
168+
"pod/feast-sample-kubernetes-auth-d98b89bcc-wx7xj 2/4 Terminating 0 32m\n"
169+
]
170+
}
171+
],
172+
"source": [
173+
"!kubectl get all -n feast\n"
174+
]
175+
},
176+
{
177+
"cell_type": "code",
178+
"execution_count": 5,
179+
"id": "7a0ce2d9e4a92828",
180+
"metadata": {
181+
"ExecuteTime": {
182+
"end_time": "2025-03-14T14:46:26.127988Z",
183+
"start_time": "2025-03-14T14:46:20.865605Z"
184+
}
185+
},
186+
"outputs": [
187+
{
188+
"name": "stdout",
189+
"output_type": "stream",
190+
"text": [
191+
"namespace \"feast\" deleted\n"
192+
]
193+
}
194+
],
195+
"source": [
196+
"!kubectl delete namespace feast"
197+
]
198+
}
199+
],
200+
"metadata": {
201+
"kernelspec": {
202+
"display_name": ".venv",
203+
"language": "python",
204+
"name": "python3"
205+
},
206+
"language_info": {
207+
"codemirror_mode": {
208+
"name": "ipython",
209+
"version": 3
210+
},
211+
"file_extension": ".py",
212+
"mimetype": "text/x-python",
213+
"name": "python",
214+
"nbconvert_exporter": "python",
215+
"pygments_lexer": "ipython3",
216+
"version": "3.11.11"
217+
}
218+
},
219+
"nbformat": 4,
220+
"nbformat_minor": 5
221+
}

‎examples/operator-rbac-openshift-tls/README.md‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# Feast Operator RBAC with TLS (OpenShift)
2+
3+
This directory contains examples and configurations for using Feast with Role-Based Access Control (RBAC) in an OpenShift environment with TLS authentication.
4+
5+
## Contents
6+
7+
- `1-setup-operator-rbac.ipynb`: Jupyter notebook for setting up RBAC with TLS in OpenShift
8+
- `2-client-rbac-test-pod.ipynb`: Jupyter notebook demonstrating RBAC testing with TLS in OpenShift
9+
- `3-uninstall.ipynb`: Jupyter notebook for cleaning up the RBAC setup
10+
- `permissions_apply.py`: Python script for applying RBAC permissions with TLS configuration
11+
- `client/`: Directory containing client configurations
12+
- `readonly_user_deployment_tls.yaml`: Deployment configuration for readonly users with TLS
13+
- `admin_user_deployment_tls.yaml`: Deployment configuration for admin users with TLS
14+
- `unauthorized_user_deployment_tls.yaml`: Deployment configuration for unauthorized users with TLS
15+
- `feature_repo/`: Feature repository configurations
16+
- `feature_store.yaml`: Feature store configuration with TLS settings
17+
- `test.py`: Contents numerous tests for validation of permissions while accessing feast objects
18+
19+
## Key Features
20+
21+
- TLS certificate configuration for secure communication
22+
- OpenShift service CA certificate integration
23+
- RBAC with service account authentication
24+
- HTTPS endpoints (port 443)
25+
- Separate configurations for admin, readonly, and unauthorized users
26+
27+
## Usage
28+
29+
1. Set up RBAC with TLS:
30+
- Option 1: Run `1-setup-operator-rbac.ipynb` notebook
31+
- Option 2: Run `python permissions_apply.py` script
32+
33+
2. Apply the appropriate deployment configurations
34+
35+
3. Test RBAC functionality with TLS authentication using `2-client-rbac-test-pod.ipynb`
36+
37+
4. Clean up resources using `3-uninstall.ipynb` when done
38+
39+
For more details, refer to the [Feast documentation](https://docs.feast.dev/master/getting-started/components/authz_manager#kubernetes-rbac-authorization).

‎examples/operator-rbac-openshift-tls/client/admin_user_deployment_tls.yaml‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
apiVersion: apps/v1
2+
kind: Deployment
3+
metadata:
4+
name: client-admin-user
5+
namespace: feast
6+
labels:
7+
app: client-admin
8+
spec:
9+
replicas: 1
10+
selector:
11+
matchLabels:
12+
app: client-admin
13+
template:
14+
metadata:
15+
labels:
16+
app: client-admin
17+
spec:
18+
serviceAccountName: feast-admin-sa
19+
containers:
20+
- name: client-admin-container
21+
image: quay.io/feastdev/feature-server:latest
22+
imagePullPolicy: Always
23+
command: ["sleep", "infinity"]
24+
volumeMounts:
25+
- name: client-feature-repo-config
26+
mountPath: /opt/app-root/src
27+
- name: feast-service-ca
28+
mountPath: /etc/pki/tls/custom-certs/service-ca.crt
29+
subPath: service-ca.crt
30+
volumes:
31+
- name: client-feature-repo-config
32+
configMap:
33+
name: client-feature-repo-config
34+
- name: feast-service-ca
35+
configMap:
36+
name: feast-sample-kubernetes-auth-client-ca

‎examples/operator-rbac-openshift-tls/client/feature_repo/feature_store.yaml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
project: feast_rbac
2+
provider: local
3+
offline_store:
4+
host: feast-sample-kubernetes-auth-offline.feast.svc.cluster.local
5+
type: remote
6+
port: 443
7+
scheme: https
8+
cert: /etc/pki/tls/custom-certs/service-ca.crt
9+
online_store:
10+
path: https://feast-sample-kubernetes-auth-online.feast.svc.cluster.local:443
11+
type: remote
12+
cert: /etc/pki/tls/custom-certs/service-ca.crt
13+
registry:
14+
path: feast-sample-kubernetes-auth-registry.feast.svc.cluster.local:443
15+
registry_type: remote
16+
cert: /etc/pki/tls/custom-certs/service-ca.crt
17+
auth:
18+
type: kubernetes
19+
entity_key_serialization_version: 3

0 commit comments

Comments
 (0)