Skip to content

Commit fe272fd

Browse files
ntkatholentkathole
committed
fix: Add noAuth option to FeatureStore CRD for explicit auth opt-out
1 parent a9219d9 commit fe272fd

11 files changed

Lines changed: 143 additions & 28 deletions

File tree

‎infra/feast-operator/api/v1/featurestore_types.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -889,10 +889,15 @@ type OptionalCtrConfigs struct {
889889
}
890890

891891
// AuthzConfig defines the authorization settings for the deployed Feast services.
892-
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc)].exists_one(c, c)",message="One selection required between kubernetes or oidc."
892+
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c, c)",message="One selection required between kubernetes, oidc, or noAuth."
893893
type AuthzConfig struct {
894894
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
895895
OidcAuthz *OidcAuthz `json:"oidc,omitempty"`
896+
// NoAuth explicitly disables authentication and authorization.
897+
// When set to true, Feast services run without any auth checks.
898+
// Use only for development or testing environments.
899+
// +optional
900+
NoAuth *bool `json:"noAuth,omitempty"`
896901
}
897902

898903
// KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.

‎infra/feast-operator/api/v1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/feast-operator/api/v1alpha1/featurestore_types.go‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -621,10 +621,15 @@ type OptionalCtrConfigs struct {
621621
}
622622

623623
// AuthzConfig defines the authorization settings for the deployed Feast services.
624-
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc)].exists_one(c, c)",message="One selection required between kubernetes or oidc."
624+
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c, c)",message="One selection required between kubernetes, oidc, or noAuth."
625625
type AuthzConfig struct {
626626
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
627627
OidcAuthz *OidcAuthz `json:"oidc,omitempty"`
628+
// NoAuth explicitly disables authentication and authorization.
629+
// When set to true, Feast services run without any auth checks.
630+
// Use only for development or testing environments.
631+
// +optional
632+
NoAuth *bool `json:"noAuth,omitempty"`
628633
}
629634

630635
// KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.

‎infra/feast-operator/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 5 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/feast-operator/bundle/manifests/feast.dev_featurestores.yaml‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ spec:
5757
type: string
5858
type: array
5959
type: object
60+
noAuth:
61+
description: NoAuth explicitly disables authentication and authorization.
62+
When set to true, Feast services run without any auth checks.
63+
Use only for development or testing environments.
64+
type: boolean
6065
oidc:
6166
description: |-
6267
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -109,8 +114,9 @@ spec:
109114
type: object
110115
type: object
111116
x-kubernetes-validations:
112-
- message: One selection required between kubernetes or oidc.
113-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
117+
- message: One selection required between kubernetes, oidc, or noAuth.
118+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
119+
c)'
114120
batchEngine:
115121
description: BatchEngineConfig defines the batch compute engine configuration.
116122
properties:
@@ -6366,6 +6372,11 @@ spec:
63666372
type: string
63676373
type: array
63686374
type: object
6375+
noAuth:
6376+
description: NoAuth explicitly disables authentication and
6377+
authorization. When set to true, Feast services run without
6378+
any auth checks. Use only for development or testing environments.
6379+
type: boolean
63696380
oidc:
63706381
description: |-
63716382
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -6418,8 +6429,9 @@ spec:
64186429
type: object
64196430
type: object
64206431
x-kubernetes-validations:
6421-
- message: One selection required between kubernetes or oidc.
6422-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
6432+
- message: One selection required between kubernetes, oidc, or
6433+
noAuth.
6434+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
64236435
c)'
64246436
batchEngine:
64256437
description: BatchEngineConfig defines the batch compute engine
@@ -12883,6 +12895,11 @@ spec:
1288312895
type: string
1288412896
type: array
1288512897
type: object
12898+
noAuth:
12899+
description: NoAuth explicitly disables authentication and authorization.
12900+
When set to true, Feast services run without any auth checks.
12901+
Use only for development or testing environments.
12902+
type: boolean
1288612903
oidc:
1288712904
description: |-
1288812905
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -12907,8 +12924,9 @@ spec:
1290712924
type: object
1290812925
type: object
1290912926
x-kubernetes-validations:
12910-
- message: One selection required between kubernetes or oidc.
12911-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
12927+
- message: One selection required between kubernetes, oidc, or noAuth.
12928+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
12929+
c)'
1291212930
cronJob:
1291312931
description: FeastCronJob defines a CronJob to execute against a Feature
1291412932
Store deployment.
@@ -17392,6 +17410,11 @@ spec:
1739217410
type: string
1739317411
type: array
1739417412
type: object
17413+
noAuth:
17414+
description: NoAuth explicitly disables authentication and
17415+
authorization. When set to true, Feast services run without
17416+
any auth checks. Use only for development or testing environments.
17417+
type: boolean
1739517418
oidc:
1739617419
description: |-
1739717420
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -17416,8 +17439,9 @@ spec:
1741617439
type: object
1741717440
type: object
1741817441
x-kubernetes-validations:
17419-
- message: One selection required between kubernetes or oidc.
17420-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
17442+
- message: One selection required between kubernetes, oidc, or
17443+
noAuth.
17444+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
1742117445
c)'
1742217446
cronJob:
1742317447
description: FeastCronJob defines a CronJob to execute against

‎infra/feast-operator/config/crd/bases/feast.dev_featurestores.yaml‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ spec:
5757
type: string
5858
type: array
5959
type: object
60+
noAuth:
61+
description: NoAuth explicitly disables authentication and authorization.
62+
When set to true, Feast services run without any auth checks.
63+
Use only for development or testing environments.
64+
type: boolean
6065
oidc:
6166
description: |-
6267
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -109,8 +114,9 @@ spec:
109114
type: object
110115
type: object
111116
x-kubernetes-validations:
112-
- message: One selection required between kubernetes or oidc.
113-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
117+
- message: One selection required between kubernetes, oidc, or noAuth.
118+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
119+
c)'
114120
batchEngine:
115121
description: BatchEngineConfig defines the batch compute engine configuration.
116122
properties:
@@ -6366,6 +6372,11 @@ spec:
63666372
type: string
63676373
type: array
63686374
type: object
6375+
noAuth:
6376+
description: NoAuth explicitly disables authentication and
6377+
authorization. When set to true, Feast services run without
6378+
any auth checks. Use only for development or testing environments.
6379+
type: boolean
63696380
oidc:
63706381
description: |-
63716382
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -6418,8 +6429,9 @@ spec:
64186429
type: object
64196430
type: object
64206431
x-kubernetes-validations:
6421-
- message: One selection required between kubernetes or oidc.
6422-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
6432+
- message: One selection required between kubernetes, oidc, or
6433+
noAuth.
6434+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
64236435
c)'
64246436
batchEngine:
64256437
description: BatchEngineConfig defines the batch compute engine
@@ -12883,6 +12895,11 @@ spec:
1288312895
type: string
1288412896
type: array
1288512897
type: object
12898+
noAuth:
12899+
description: NoAuth explicitly disables authentication and authorization.
12900+
When set to true, Feast services run without any auth checks.
12901+
Use only for development or testing environments.
12902+
type: boolean
1288612903
oidc:
1288712904
description: |-
1288812905
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -12907,8 +12924,9 @@ spec:
1290712924
type: object
1290812925
type: object
1290912926
x-kubernetes-validations:
12910-
- message: One selection required between kubernetes or oidc.
12911-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
12927+
- message: One selection required between kubernetes, oidc, or noAuth.
12928+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
12929+
c)'
1291212930
cronJob:
1291312931
description: FeastCronJob defines a CronJob to execute against a Feature
1291412932
Store deployment.
@@ -17392,6 +17410,11 @@ spec:
1739217410
type: string
1739317411
type: array
1739417412
type: object
17413+
noAuth:
17414+
description: NoAuth explicitly disables authentication and
17415+
authorization. When set to true, Feast services run without
17416+
any auth checks. Use only for development or testing environments.
17417+
type: boolean
1739517418
oidc:
1739617419
description: |-
1739717420
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -17416,8 +17439,9 @@ spec:
1741617439
type: object
1741717440
type: object
1741817441
x-kubernetes-validations:
17419-
- message: One selection required between kubernetes or oidc.
17420-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
17442+
- message: One selection required between kubernetes, oidc, or
17443+
noAuth.
17444+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
1742117445
c)'
1742217446
cronJob:
1742317447
description: FeastCronJob defines a CronJob to execute against

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,11 @@ spec:
6565
type: string
6666
type: array
6767
type: object
68+
noAuth:
69+
description: NoAuth explicitly disables authentication and authorization.
70+
When set to true, Feast services run without any auth checks.
71+
Use only for development or testing environments.
72+
type: boolean
6873
oidc:
6974
description: |-
7075
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -117,8 +122,9 @@ spec:
117122
type: object
118123
type: object
119124
x-kubernetes-validations:
120-
- message: One selection required between kubernetes or oidc.
121-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
125+
- message: One selection required between kubernetes, oidc, or noAuth.
126+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
127+
c)'
122128
batchEngine:
123129
description: BatchEngineConfig defines the batch compute engine configuration.
124130
properties:
@@ -6374,6 +6380,11 @@ spec:
63746380
type: string
63756381
type: array
63766382
type: object
6383+
noAuth:
6384+
description: NoAuth explicitly disables authentication and
6385+
authorization. When set to true, Feast services run without
6386+
any auth checks. Use only for development or testing environments.
6387+
type: boolean
63776388
oidc:
63786389
description: |-
63796390
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -6426,8 +6437,9 @@ spec:
64266437
type: object
64276438
type: object
64286439
x-kubernetes-validations:
6429-
- message: One selection required between kubernetes or oidc.
6430-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
6440+
- message: One selection required between kubernetes, oidc, or
6441+
noAuth.
6442+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
64316443
c)'
64326444
batchEngine:
64336445
description: BatchEngineConfig defines the batch compute engine
@@ -12891,6 +12903,11 @@ spec:
1289112903
type: string
1289212904
type: array
1289312905
type: object
12906+
noAuth:
12907+
description: NoAuth explicitly disables authentication and authorization.
12908+
When set to true, Feast services run without any auth checks.
12909+
Use only for development or testing environments.
12910+
type: boolean
1289412911
oidc:
1289512912
description: |-
1289612913
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -12915,8 +12932,9 @@ spec:
1291512932
type: object
1291612933
type: object
1291712934
x-kubernetes-validations:
12918-
- message: One selection required between kubernetes or oidc.
12919-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
12935+
- message: One selection required between kubernetes, oidc, or noAuth.
12936+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
12937+
c)'
1292012938
cronJob:
1292112939
description: FeastCronJob defines a CronJob to execute against a Feature
1292212940
Store deployment.
@@ -17400,6 +17418,11 @@ spec:
1740017418
type: string
1740117419
type: array
1740217420
type: object
17421+
noAuth:
17422+
description: NoAuth explicitly disables authentication and
17423+
authorization. When set to true, Feast services run without
17424+
any auth checks. Use only for development or testing environments.
17425+
type: boolean
1740317426
oidc:
1740417427
description: |-
1740517428
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -17424,8 +17447,9 @@ spec:
1742417447
type: object
1742517448
type: object
1742617449
x-kubernetes-validations:
17427-
- message: One selection required between kubernetes or oidc.
17428-
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
17450+
- message: One selection required between kubernetes, oidc, or
17451+
noAuth.
17452+
rule: '[has(self.kubernetes), has(self.oidc), has(self.noAuth)].exists_one(c,
1742917453
c)'
1743017454
cronJob:
1743117455
description: FeastCronJob defines a CronJob to execute against

‎infra/feast-operator/docs/api/markdown/ref.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ _Appears in:_
2525
| Field | Description |
2626
| --- | --- |
2727
| `kubernetes` _[KubernetesAuthz](#kubernetesauthz)_ | |
28+
| `noAuth` _boolean_ | NoAuth explicitly disables authentication and authorization. When set to true, Feast services run without any auth checks. Use only for development or testing environments. |
2829
| `oidc` _[OidcAuthz](#oidcauthz)_ | |
2930

3031

‎infra/feast-operator/internal/controller/services/repo_config.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -620,7 +620,11 @@ func getRepoConfig(featureStore *feastdevv1.FeatureStore) RepoConfig {
620620
status := featureStore.Status
621621
repoConfig := initRepoConfig(status.Applied.FeastProject)
622622
if status.Applied.AuthzConfig != nil {
623-
if status.Applied.AuthzConfig.KubernetesAuthz != nil {
623+
if status.Applied.AuthzConfig.NoAuth != nil && *status.Applied.AuthzConfig.NoAuth {
624+
repoConfig.AuthzConfig = AuthzConfig{
625+
Type: NoAuthAuthType,
626+
}
627+
} else if status.Applied.AuthzConfig.KubernetesAuthz != nil {
624628
repoConfig.AuthzConfig = AuthzConfig{
625629
Type: KubernetesAuthType,
626630
}

0 commit comments

Comments
 (0)