Skip to content

Commit f487b37

Browse files
aniketpalucursoragent
aniketpalu
and
cursoragent
authored
feat(operator): Auto-create RBAC for spark_application batch engine (#6597)
* feat(operator): auto-create RBAC for spark_application batch engine Reconcile server/driver Roles from an embedded YAML template so FeatureStore materialization works without manual SA/Role setup. Widen the operator ClusterRole only as needed to grant those permissions (including deletecollection for Spark driver cleanup). Signed-off-by: Aniket Paluskar <apaluska@redhat.com> * fix(operator): bake default batch-driver SA into feature_store.yaml When batch_engine.service_account is omitted, inject feast-<cr>-batch-driver so the SparkApplication matches the SA/RBAC the operator already creates (R2-2). Co-authored-by: Cursor <cursoragent@cursor.com> Signed-off-by: Aniket Paluskar <apaluska@redhat.com> * fix(operator): inject batch-driver SA only for spark_application Limit service_account baking to spark_application so other batch engines are not given an unexpected parameter. Signed-off-by: Aniket Paluskar <apaluska@redhat.com> * chore(operator): fix CI fmt and secrets baseline gofmt repo_config_test map literals and refresh .secrets.baseline line numbers after batch-engine RBAC wiring in services.go. Signed-off-by: Aniket Paluskar <apaluska@redhat.com> * refactor(operator): parse batch-engine ConfigMap once per reconcile Share getBatchEngineConfig() for engine type and driver SA resolution instead of fetching/parsing the same ConfigMap twice. Signed-off-by: Aniket Paluskar <apaluska@redhat.com> --------- Signed-off-by: Aniket Paluskar <apaluska@redhat.com> Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent e0a8573 commit f487b37

11 files changed

Lines changed: 711 additions & 12 deletions

File tree

‎.secrets.baseline‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1172,7 +1172,7 @@
11721172
"filename": "infra/feast-operator/internal/controller/services/services.go",
11731173
"hashed_secret": "36dc326eb15c7bdd8d91a6b87905bcea20b637d1",
11741174
"is_verified": false,
1175-
"line_number": 180
1175+
"line_number": 183
11761176
}
11771177
],
11781178
"infra/feast-operator/internal/controller/services/tls_test.go": [
@@ -1555,5 +1555,5 @@
15551555
}
15561556
]
15571557
},
1558-
"generated_at": "2026-07-13T15:26:35Z"
1558+
"generated_at": "2026-07-17T12:34:13Z"
15591559
}

‎infra/feast-operator/bundle/manifests/feast-operator.clusterserviceversion.yaml‎

Lines changed: 46 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ metadata:
147147
}
148148
]
149149
capabilities: Basic Install
150-
createdAt: "2026-06-13T11:22:06Z"
150+
createdAt: "2026-07-09T20:32:45Z"
151151
operators.operatorframework.io/builder: operator-sdk-v1.41.0
152152
operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
153153
name: feast-operator.v0.64.0
@@ -180,11 +180,11 @@ spec:
180180
resources:
181181
- configmaps
182182
- persistentvolumeclaims
183-
- serviceaccounts
184183
- services
185184
verbs:
186185
- create
187186
- delete
187+
- deletecollection
188188
- get
189189
- list
190190
- update
@@ -193,18 +193,45 @@ spec:
193193
- ""
194194
resources:
195195
- namespaces
196-
- pods
197196
- secrets
198197
verbs:
199198
- get
200199
- list
201200
- watch
201+
- apiGroups:
202+
- ""
203+
resources:
204+
- pods
205+
verbs:
206+
- create
207+
- delete
208+
- deletecollection
209+
- get
210+
- list
211+
- watch
202212
- apiGroups:
203213
- ""
204214
resources:
205215
- pods/exec
206216
verbs:
207217
- create
218+
- apiGroups:
219+
- ""
220+
resources:
221+
- pods/log
222+
verbs:
223+
- get
224+
- apiGroups:
225+
- ""
226+
resources:
227+
- serviceaccounts
228+
verbs:
229+
- create
230+
- delete
231+
- get
232+
- list
233+
- update
234+
- watch
208235
- apiGroups:
209236
- apps
210237
resources:
@@ -246,6 +273,14 @@ spec:
246273
- patch
247274
- update
248275
- watch
276+
- apiGroups:
277+
- config.openshift.io
278+
resources:
279+
- apiservers
280+
verbs:
281+
- get
282+
- list
283+
- watch
249284
- apiGroups:
250285
- feast.dev
251286
resources:
@@ -321,6 +356,14 @@ spec:
321356
- list
322357
- update
323358
- watch
359+
- apiGroups:
360+
- sparkoperator.k8s.io
361+
resources:
362+
- sparkapplications
363+
verbs:
364+
- create
365+
- delete
366+
- get
324367
- apiGroups:
325368
- authentication.k8s.io
326369
resources:

‎infra/feast-operator/config/rbac/role.yaml‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,11 +9,11 @@ rules:
99
resources:
1010
- configmaps
1111
- persistentvolumeclaims
12-
- serviceaccounts
1312
- services
1413
verbs:
1514
- create
1615
- delete
16+
- deletecollection
1717
- get
1818
- list
1919
- update
@@ -22,18 +22,45 @@ rules:
2222
- ""
2323
resources:
2424
- namespaces
25-
- pods
2625
- secrets
2726
verbs:
2827
- get
2928
- list
3029
- watch
30+
- apiGroups:
31+
- ""
32+
resources:
33+
- pods
34+
verbs:
35+
- create
36+
- delete
37+
- deletecollection
38+
- get
39+
- list
40+
- watch
3141
- apiGroups:
3242
- ""
3343
resources:
3444
- pods/exec
3545
verbs:
3646
- create
47+
- apiGroups:
48+
- ""
49+
resources:
50+
- pods/log
51+
verbs:
52+
- get
53+
- apiGroups:
54+
- ""
55+
resources:
56+
- serviceaccounts
57+
verbs:
58+
- create
59+
- delete
60+
- get
61+
- list
62+
- update
63+
- watch
3764
- apiGroups:
3865
- apps
3966
resources:
@@ -158,3 +185,11 @@ rules:
158185
- list
159186
- update
160187
- watch
188+
- apiGroups:
189+
- sparkoperator.k8s.io
190+
resources:
191+
- sparkapplications
192+
verbs:
193+
- create
194+
- delete
195+
- get

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22037,11 +22037,11 @@ rules:
2203722037
resources:
2203822038
- configmaps
2203922039
- persistentvolumeclaims
22040-
- serviceaccounts
2204122040
- services
2204222041
verbs:
2204322042
- create
2204422043
- delete
22044+
- deletecollection
2204522045
- get
2204622046
- list
2204722047
- update
@@ -22050,18 +22050,45 @@ rules:
2205022050
- ""
2205122051
resources:
2205222052
- namespaces
22053-
- pods
2205422053
- secrets
2205522054
verbs:
2205622055
- get
2205722056
- list
2205822057
- watch
22058+
- apiGroups:
22059+
- ""
22060+
resources:
22061+
- pods
22062+
verbs:
22063+
- create
22064+
- delete
22065+
- deletecollection
22066+
- get
22067+
- list
22068+
- watch
2205922069
- apiGroups:
2206022070
- ""
2206122071
resources:
2206222072
- pods/exec
2206322073
verbs:
2206422074
- create
22075+
- apiGroups:
22076+
- ""
22077+
resources:
22078+
- pods/log
22079+
verbs:
22080+
- get
22081+
- apiGroups:
22082+
- ""
22083+
resources:
22084+
- serviceaccounts
22085+
verbs:
22086+
- create
22087+
- delete
22088+
- get
22089+
- list
22090+
- update
22091+
- watch
2206522092
- apiGroups:
2206622093
- apps
2206722094
resources:
@@ -22186,6 +22213,14 @@ rules:
2218622213
- list
2218722214
- update
2218822215
- watch
22216+
- apiGroups:
22217+
- sparkoperator.k8s.io
22218+
resources:
22219+
- sparkapplications
22220+
verbs:
22221+
- create
22222+
- delete
22223+
- get
2218922224
---
2219022225
apiVersion: rbac.authorization.k8s.io/v1
2219122226
kind: ClusterRole

‎infra/feast-operator/internal/controller/featurestore_controller.go‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,10 +65,14 @@ type FeatureStoreReconciler struct {
6565
// +kubebuilder:rbac:groups=feast.dev,resources=featurestores/status,verbs=get;update;patch
6666
// +kubebuilder:rbac:groups=feast.dev,resources=featurestores/finalizers,verbs=update
6767
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;create;update;watch;delete
68-
// +kubebuilder:rbac:groups=core,resources=services;configmaps;persistentvolumeclaims;serviceaccounts,verbs=get;list;create;update;watch;delete
68+
// +kubebuilder:rbac:groups=core,resources=services;configmaps;persistentvolumeclaims,verbs=get;list;create;update;watch;delete;deletecollection
69+
// +kubebuilder:rbac:groups=core,resources=serviceaccounts,verbs=get;list;create;update;watch;delete
6970
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings;clusterroles;clusterrolebindings;subjectaccessreviews,verbs=get;list;create;update;watch;delete
70-
// +kubebuilder:rbac:groups=core,resources=secrets;pods;namespaces,verbs=get;list;watch
71+
// +kubebuilder:rbac:groups=core,resources=secrets;namespaces,verbs=get;list;watch
72+
// +kubebuilder:rbac:groups=core,resources=pods,verbs=get;list;watch;create;delete;deletecollection
7173
// +kubebuilder:rbac:groups=core,resources=pods/exec,verbs=create
74+
// +kubebuilder:rbac:groups=core,resources=pods/log,verbs=get
75+
// +kubebuilder:rbac:groups=sparkoperator.k8s.io,resources=sparkapplications,verbs=create;get;delete
7276
// +kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create
7377
// +kubebuilder:rbac:groups=route.openshift.io,resources=routes,verbs=get;list;create;update;watch;delete
7478
// +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get;list;watch;create;update;patch;delete

0 commit comments

Comments
 (0)