Skip to content

Commit 3c70419

Browse files
tchughesivtchughesiv
committed
authz rbac fixes
Signed-off-by: Tommy Hughes <tohughes@redhat.com>
1 parent 648f519 commit 3c70419

File tree

12 files changed

+19
-23
lines changed

12 files changed

+19
-23
lines changed

‎infra/feast-operator/api/v1alpha1/featurestore_types.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ const (
3333
OnlineStoreReadyType = "OnlineStore"
3434
RegistryReadyType = "Registry"
3535
ReadyType = "FeatureStore"
36-
AuthorizationReadyType = "AuthorizationReadyType"
36+
AuthorizationReadyType = "Authorization"
3737

3838
// Feast condition reasons:
3939
ReadyReason = "Ready"

‎infra/feast-operator/config/rbac/role.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,7 @@ rules:
6565
- apiGroups:
6666
- rbac.authorization.k8s.io
6767
resources:
68+
- rolebindings
6869
- roles
6970
verbs:
7071
- create

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2667,6 +2667,7 @@ rules:
26672667
- apiGroups:
26682668
- rbac.authorization.k8s.io
26692669
resources:
2670+
- rolebindings
26702671
- roles
26712672
verbs:
26722673
- create

‎infra/feast-operator/internal/controller/authz/authz.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,8 @@ func (authz *FeastAuthorization) Deploy() error {
2828
_ = authz.Handler.DeleteOwnedFeastObj(authz.initFeastRole())
2929
_ = authz.Handler.DeleteOwnedFeastObj(authz.initFeastRoleBinding())
3030
}
31+
} else {
32+
apimeta.RemoveStatusCondition(&authz.Handler.FeatureStore.Status.Conditions, feastKubernetesAuthConditions[metav1.ConditionTrue].Type)
3133
}
3234
return nil
3335
}

‎infra/feast-operator/internal/controller/featurestore_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ type FeatureStoreReconciler struct {
5757
//+kubebuilder:rbac:groups=feast.dev,resources=featurestores/finalizers,verbs=update
5858
//+kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;create;update;watch;delete
5959
//+kubebuilder:rbac:groups=core,resources=services;configmaps;persistentvolumeclaims;serviceaccounts,verbs=get;list;create;update;watch;delete
60-
//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles,verbs=get;list;create;update;watch;delete
60+
//+kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;create;update;watch;delete
6161
//+kubebuilder:rbac:groups=core,resources=secrets,verbs=get;list
6262

6363
// Reconcile is part of the main kubernetes reconciliation loop which aims to

‎infra/feast-operator/internal/controller/featurestore_controller_ephemeral_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -127,7 +127,7 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
127127
Expect(resource.Status.FeastVersion).To(Equal(feastversion.FeastVersion))
128128
Expect(resource.Status.ClientConfigMap).To(Equal(feast.GetFeastServiceName(services.ClientFeastType)))
129129
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
130-
Expect(resource.Status.Applied.AuthzConfig).To(Equal(&feastdevv1alpha1.AuthzConfig{}))
130+
Expect(resource.Status.Applied.AuthzConfig).To(BeNil())
131131
Expect(resource.Status.Applied.Services).NotTo(BeNil())
132132
Expect(resource.Status.Applied.Services.OfflineStore).NotTo(BeNil())
133133
Expect(resource.Status.Applied.Services.OfflineStore.Persistence).NotTo(BeNil())

‎infra/feast-operator/internal/controller/featurestore_controller_objectstore_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -122,7 +122,7 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
122122
Expect(resource.Status.FeastVersion).To(Equal(feastversion.FeastVersion))
123123
Expect(resource.Status.ClientConfigMap).To(Equal(feast.GetFeastServiceName(services.ClientFeastType)))
124124
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
125-
Expect(resource.Status.Applied.AuthzConfig).To(Equal(&feastdevv1alpha1.AuthzConfig{}))
125+
Expect(resource.Status.Applied.AuthzConfig).To(BeNil())
126126
Expect(resource.Status.Applied.Services).NotTo(BeNil())
127127
Expect(resource.Status.Applied.Services.OfflineStore).To(BeNil())
128128
Expect(resource.Status.Applied.Services.OnlineStore).To(BeNil())

‎infra/feast-operator/internal/controller/featurestore_controller_pvc_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@ var _ = Describe("FeatureStore Controller-Ephemeral services", func() {
153153
Expect(resource.Status.FeastVersion).To(Equal(feastversion.FeastVersion))
154154
Expect(resource.Status.ClientConfigMap).To(Equal(feast.GetFeastServiceName(services.ClientFeastType)))
155155
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
156-
Expect(resource.Status.Applied.AuthzConfig).To(Equal(&feastdevv1alpha1.AuthzConfig{}))
156+
Expect(resource.Status.Applied.AuthzConfig).To(BeNil())
157157
Expect(resource.Status.Applied.Services).NotTo(BeNil())
158158
Expect(resource.Status.Applied.Services.OfflineStore).NotTo(BeNil())
159159
Expect(resource.Status.Applied.Services.OfflineStore.Persistence).NotTo(BeNil())

‎infra/feast-operator/internal/controller/featurestore_controller_test.go‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -134,7 +134,7 @@ var _ = Describe("FeatureStore Controller", func() {
134134
Expect(resource.Status.ServiceHostnames.OnlineStore).To(BeEmpty())
135135
Expect(resource.Status.ServiceHostnames.Registry).To(Equal(feast.GetFeastServiceName(services.RegistryFeastType) + "." + resource.Namespace + ".svc.cluster.local:80"))
136136
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
137-
Expect(resource.Status.Applied.AuthzConfig).To(Equal(&feastdevv1alpha1.AuthzConfig{}))
137+
Expect(resource.Status.Applied.AuthzConfig).To(BeNil())
138138
Expect(resource.Status.Applied.Services).NotTo(BeNil())
139139
Expect(resource.Status.Applied.Services.OfflineStore).To(BeNil())
140140
Expect(resource.Status.Applied.Services.OnlineStore).To(BeNil())
@@ -152,6 +152,8 @@ var _ = Describe("FeatureStore Controller", func() {
152152
Expect(cond.Reason).To(Equal(feastdevv1alpha1.ReadyReason))
153153
Expect(cond.Type).To(Equal(feastdevv1alpha1.ReadyType))
154154
Expect(cond.Message).To(Equal(feastdevv1alpha1.ReadyMessage))
155+
cond = apimeta.FindStatusCondition(resource.Status.Conditions, feastdevv1alpha1.AuthorizationReadyType)
156+
Expect(cond).To(BeNil())
155157

156158
cond = apimeta.FindStatusCondition(resource.Status.Conditions, feastdevv1alpha1.RegistryReadyType)
157159
Expect(cond).ToNot(BeNil())
@@ -459,7 +461,7 @@ var _ = Describe("FeatureStore Controller", func() {
459461
Expect(resource.Status.FeastVersion).To(Equal(feastversion.FeastVersion))
460462
Expect(resource.Status.ClientConfigMap).To(Equal(feast.GetFeastServiceName(services.ClientFeastType)))
461463
Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
462-
Expect(resource.Status.Applied.AuthzConfig).To(Equal(&feastdevv1alpha1.AuthzConfig{}))
464+
Expect(resource.Status.Applied.AuthzConfig).To(BeNil())
463465
Expect(resource.Status.Applied.Services).NotTo(BeNil())
464466
Expect(resource.Status.Applied.Services.OfflineStore).NotTo(BeNil())
465467
Expect(resource.Status.Applied.Services.OfflineStore.Persistence).NotTo(BeNil())

‎infra/feast-operator/internal/controller/services/repo_config.go‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -248,16 +248,11 @@ func getClientRepoConfig(featureStore *feastdevv1alpha1.FeatureStore) RepoConfig
248248
}
249249
}
250250

251-
if status.Applied.AuthzConfig.KubernetesAuthz == nil {
252-
clientRepoConfig.AuthzConfig = AuthzConfig{
253-
Type: NoAuthAuthType,
254-
}
255-
} else {
256-
if status.Applied.AuthzConfig.KubernetesAuthz != nil {
257-
clientRepoConfig.AuthzConfig = AuthzConfig{
258-
Type: KubernetesAuthType,
259-
}
260-
}
251+
clientRepoConfig.AuthzConfig = AuthzConfig{
252+
Type: NoAuthAuthType,
253+
}
254+
if status.Applied.AuthzConfig != nil && status.Applied.AuthzConfig.KubernetesAuthz != nil {
255+
clientRepoConfig.AuthzConfig.Type = KubernetesAuthType
261256
}
262257
return clientRepoConfig
263258
}

0 commit comments

Comments
 (0)