Skip to content

Commit e89ee80

Browse files
lokeshranginenilokeshrangineni
committed
rough working instructions to set up postgres in TLS mode and setting up the feast using operator.
Signed-off-by: lrangine <19699092+lokeshrangineni@users.noreply.github.com>
1 parent f4afcd2 commit e89ee80

File tree

5 files changed

+751
-0
lines changed

5 files changed

+751
-0
lines changed

‎examples/operator-postgres-ssl-demo/README.md‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
# Install and run a Feature Store on Kubernetes with the Feast Operator
2+
3+
The following notebooks will guide you through how to install and use Feast on Kubernetes with the Feast Go Operator.
4+
5+
* [01-Install.ipynb](./01-Install.ipynb): Install and configure a Feature Store in Kubernetes with the Operator.
6+
* [02-Demo.ipynb](./02-Demo.ipynb): Validate the feature store with demo application.
7+
* [03-Uninstall.ipynb](./03-Uninstall.ipynb): Clear the installed deployments.
8+
9+
# Here are the steps to deploy
10+
11+
* Generate certificates and create kubernetes secrets.
12+
* helm install postgresql bitnami/postgresql -f values.yaml
13+
* kubectl apply -f feast.yaml
14+
15+
16+
# Some of the important commands to debug while setting up the postgres in TLS setup.
17+
helm show chart bitnami/postgresql
18+
19+
helm install postgresql -f values.yaml bitnami/postgresql --version 16.4.6
20+
21+
helm uninstall postgresql
22+
23+
make test
24+
make docker-build docker-push IMG=quay.io/lrangine/feast-operator:0.53.0
25+
make install
26+
make deploy IMG=quay.io/lrangine/feast-operator:0.53.0
27+
28+
kubectl exec -it postgresql-0 -- env PGPASSWORD=secret psql -U admin -d mydb -c "SHOW ssl;"
29+
30+
kubectl exec -it postgresql-0 -- env PGPASSWORD=password psql -U admin -d mydatabase -c "SHOW ssl;"
31+
32+
33+
kubectl exec -it my-postgres-postgresql-0 -- bash
34+
35+
36+
37+
kubectl create secret generic postgres-tls-secret \
38+
--from-file=tls.crt=postgres-certs/server.crt \
39+
--from-file=tls.key=postgres-certs/server.key \
40+
--from-file=ca.crt=postgres-certs/ca.crt
41+
42+
kubectl create secret generic postgres-tls-certs-new \
43+
--from-file=tls.crt=postgres-tls-certs-new/server.crt \
44+
--from-file=tls.key=postgres-tls-certs-new/server.key \
45+
--from-file=ca.crt=postgres-tls-certs-new/ca.crt
46+
47+
48+
49+
kubectl run -it --rm --image=postgres:latest --restart=Never postgresql-client -- psql "host=postgresql.default.svc.cluster.local dbname=mydatabase user=admin password=mypassword sslmode=require"
50+
51+
52+
kubectl exec -it postgresql-client -- psql \
53+
"host=postgresql.default.svc.cluster.local dbname=mydatabase user=admin password=mypassword sslmode=verify-full sslcert=/etc/ssl/postgres/client.crt sslkey=/etc/ssl/postgres/client.key sslrootcert=/etc/ssl/postgres/ca.crt"
54+
55+
postgresql+psycopg://admin:password@postgresql.default.svc.cluster.local:5432/mydb?sslmode=require&sslrootcert=postgres-tls-certs/ca.crt&sslcert=postgres-tls-certs/client.crt&sslkey=postgres-tls-certs/client.key
56+
57+
58+
kubectl exec -it postgresql-0 -- cat /opt/bitnami/postgresql/conf/postgresql.conf | grep ssl
59+
60+
sslcert=postgres-tls-certs-new/server.crt&sslkey=postgres-tls-certs-new/server.key
61+
62+
postgresql+psycopg://admin:password@localhost:5432/mydatabase?sslmode=disable&sslrootcert=postgres-tls-certs-new/ca.crt&sslcert=postgres-tls-certs-new/server.crt&sslkey=postgres-tls-certs-new/server.key
63+
64+
65+
kubectl exec -it postgresql-0 -- env PGPASSWORD=password psql -U admin -d mydatabase -c '\l'
66+
67+
68+
helm install postgresql -f values.yaml bitnami/postgresql --version 16.4.6
69+
70+
helm uninstall postgresql
71+
72+
helm template postgresql bitnami/postgresql --values values.yaml --version 16.4.6 > postgresql-export.yaml
73+
74+
75+
kubectl create secret generic postgresql-client-certs \
76+
--from-file=ca.crt=./postgres-tls-certs/ca.crt \
77+
--from-file=tls.crt=./postgres-tls-certs/client.crt \
78+
--from-file=tls.key=./postgres-tls-certs/client.key \
79+
--dry-run=client -o yaml | kubectl apply -f -
80+
81+
82+
!kubectl exec deploy/postgres -- psql -h localhost -U feast feast -c '\dt'
83+
84+
kubectl exec -it postgresql-0 -- env PGPASSWORD=password psql -U admin -d mydatabase -c '\dt'

‎examples/operator-postgres-ssl-demo/feast.yaml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
apiVersion: v1
2+
kind: Secret
3+
metadata:
4+
name: postgres-secret
5+
namespace: default
6+
labels:
7+
app: postgres
8+
stringData:
9+
POSTGRES_DB: mydatabase
10+
POSTGRES_USER: admin
11+
POSTGRES_PASSWORD: password
12+
---
13+
apiVersion: v1
14+
kind: Secret
15+
metadata:
16+
name: feast-data-stores
17+
namespace: default
18+
stringData:
19+
redis: |
20+
connection_string: redis.feast.svc.cluster.local:6379
21+
sql: |
22+
path: postgresql+psycopg://admin:password@postgresql.default.svc.cluster.local:5432/mydatabase?sslmode=require&sslrootcert=/var/lib/postgresql/certs/ca.crt&sslcert=/var/lib/postgresql/certs/tls.crt&sslkey=/var/lib/postgresql/certs/tls.key
23+
cache_ttl_seconds: 60
24+
sqlalchemy_config_kwargs:
25+
echo: false
26+
pool_pre_ping: true
27+
---
28+
apiVersion: feast.dev/v1alpha1
29+
kind: FeatureStore
30+
metadata:
31+
name: example
32+
namespace: default
33+
spec:
34+
feastProject: credit_scoring_local
35+
services:
36+
volumes:
37+
- name: ca-cert
38+
secret:
39+
secretName: postgresql-client-certs
40+
items:
41+
- key: ca.crt
42+
path: ca.crt
43+
mode: 0644 # Readable by all, required by PostgreSQL
44+
45+
- name: client-cert
46+
secret:
47+
secretName: postgresql-client-certs
48+
items:
49+
- key: tls.crt
50+
path: tls.crt
51+
mode: 0644 # Required for the client certificate
52+
53+
- name: client-key
54+
secret:
55+
secretName: postgresql-client-certs
56+
items:
57+
- key: tls.key
58+
path: tls.key
59+
mode: 0640 # Required for the private key
60+
offlineStore:
61+
volumeMounts:
62+
- name: ca-cert
63+
mountPath: /var/lib/postgresql/certs/ca.crt
64+
subPath: ca.crt
65+
readOnly: true
66+
67+
- name: client-cert
68+
mountPath: /var/lib/postgresql/certs/tls.crt
69+
subPath: tls.crt
70+
readOnly: true
71+
72+
- name: client-key
73+
mountPath: /var/lib/postgresql/certs/tls.key
74+
subPath: tls.key
75+
readOnly: true
76+
persistence:
77+
file:
78+
type: duckdb
79+
envFrom:
80+
- secretRef:
81+
name: postgres-secret
82+
onlineStore:
83+
volumeMounts:
84+
- name: ca-cert
85+
mountPath: /var/lib/postgresql/certs/ca.crt
86+
subPath: ca.crt
87+
readOnly: true
88+
89+
- name: client-cert
90+
mountPath: /var/lib/postgresql/certs/tls.crt
91+
subPath: tls.crt
92+
readOnly: true
93+
94+
- name: client-key
95+
mountPath: /var/lib/postgresql/certs/tls.key
96+
subPath: tls.key
97+
readOnly: true
98+
persistence:
99+
store:
100+
type: redis
101+
secretRef:
102+
name: feast-data-stores
103+
envFrom:
104+
- secretRef:
105+
name: postgres-secret
106+
registry:
107+
local:
108+
volumeMounts:
109+
- name: ca-cert
110+
mountPath: /var/lib/postgresql/certs/ca.crt
111+
subPath: ca.crt
112+
readOnly: true
113+
114+
- name: client-cert
115+
mountPath: /var/lib/postgresql/certs/tls.crt
116+
subPath: tls.crt
117+
readOnly: true
118+
119+
- name: client-key
120+
mountPath: /var/lib/postgresql/certs/tls.key
121+
subPath: tls.key
122+
readOnly: true
123+
persistence:
124+
store:
125+
type: sql
126+
secretRef:
127+
name: feast-data-stores
128+
envFrom:
129+
- secretRef:
130+
name: postgres-secret
131+
env:
132+
- name: MPLCONFIGDIR
133+
value: /tmp
134+
resources:
135+
requests:
136+
cpu: 150m
137+
memory: 128Mi

0 commit comments

Comments
 (0)