improved CRD comments and using IsLocalRegistry

Signed-off-by: Daniele Martinoli <dmartino@redhat.com>
feast-dev · dmartinol · Dec 1, 2024 · Nov 22, 2024 · Nov 22, 2024 · Nov 22, 2024
commit c9a583c1cd1c894beb4eac822a6795cf35b28d9b
@@ -272,7 +272,15 @@ type AuthConfig struct {
 	KubernetesAuth *KubernetesAuth `json:"kubernetes,omitempty"`
 }
 
+// KubernetesAuth provides a way to define the authorization settings using Kubernetes RBAC resources.
+// https://kubernetes.io/docs/reference/access-authn-authz/rbac/
 type KubernetesAuth struct {
+	// The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
+	// Roles are managed by the operator and created with an empty list of rules.
+	// See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
+	// The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
+	// This configuration option is only providing a way to automate this procedure.
+	// Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
 	Roles []string `json:"roles,omitempty"`
 }
 

@@ -53,8 +53,18 @@ spec:
                   deployed Feast services.
                 properties:
                   kubernetes:
+                    description: |-
+                      KubernetesAuth provides a way to define the authorization settings using Kubernetes RBAC resources.
+                      https://kubernetes.io/docs/reference/access-authn-authz/rbac/
                     properties:
                       roles:
+                        description: |-
+                          The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
+                          Roles are managed by the operator and created with an empty list of rules.
+                          See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
+                          The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
+                          This configuration option is only providing a way to automate this procedure.
+                          Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
                         items:
                           type: string
                         type: array
@@ -1056,8 +1066,18 @@ spec:
                       the deployed Feast services.
                     properties:
                       kubernetes:
+                        description: |-
+                          KubernetesAuth provides a way to define the authorization settings using Kubernetes RBAC resources.
+                          https://kubernetes.io/docs/reference/access-authn-authz/rbac/
                         properties:
                           roles:
+                            description: |-
+                              The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
+                              Roles are managed by the operator and created with an empty list of rules.
+                              See the Feast permission model at https://docs.feast.dev/getting-started/concepts/permission
+                              The feature store admin is not obligated to manage roles using the Feast operator, roles can be managed independently.
+                              This configuration option is only providing a way to automate this procedure.
+                              Important note: the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
                             items:
                               type: string
                             type: array

@@ -61,8 +61,17 @@ spec:
                   deployed Feast services.
                 properties:
                   kubernetes:
+                    description: |-
+                      KubernetesAuth defines the authorization settings using Kubernetes RBAC.
+                      https://kubernetes.io/docs/reference/access-authn-authz/rbac/
                     properties:
                       roles:
+                        description: |-
+                          The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
+                          See the Feast permission model https://docs.feast.dev/getting-started/concepts/permission
+                          Please note that the feature store admin is not obligated to manage roles using the Feast operator.
+                          Roles can be managed independently. This configuration is only providing a way to automate this step.
+                          Note that the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
                         items:
                           type: string
                         type: array
@@ -1064,8 +1073,17 @@ spec:
                       the deployed Feast services.
                     properties:
                       kubernetes:
+                        description: |-
+                          KubernetesAuth defines the authorization settings using Kubernetes RBAC.
+                          https://kubernetes.io/docs/reference/access-authn-authz/rbac/
                         properties:
                           roles:
+                            description: |-
+                              The Kubernetes RBAC roles to be deployed in the same namespace of the FeatureStore.
+                              See the Feast permission model https://docs.feast.dev/getting-started/concepts/permission
+                              Please note that the feature store admin is not obligated to manage roles using the Feast operator.
+                              Roles can be managed independently. This configuration is only providing a way to automate this step.
+                              Note that the operator cannot ensure that these roles will match the ones used in the configured Feast permissions.
                             items:
                               type: string
                             type: array

diff --git a/infra/feast-operator/internal/controller/auth/auth.go b/infra/feast-operator/internal/controller/auth/auth.go
@@ -146,7 +146,7 @@ func (auth *FeastAuth) setFeastRoleBinding(roleBinding *rbacv1.RoleBinding) erro
 			Namespace: auth.Handler.FeatureStore.Namespace,
 		})
 	}
-	if auth.Handler.FeatureStore.Status.Applied.Services.Registry != nil {
+	if services.IsLocalRegistry(auth.Handler.FeatureStore) {
 		roleBinding.Subjects = append(roleBinding.Subjects, rbacv1.Subject{
 			Kind:      rbacv1.ServiceAccountKind,
 			Name:      services.GetFeastServiceName(auth.Handler.FeatureStore, services.RegistryFeastType),

@@ -52,7 +52,7 @@ func getServiceRepoConfig(feastType FeastServiceType, featureStore *feastdevv1al
 	appliedSpec := featureStore.Status.Applied
 
 	repoConfig := getClientRepoConfig(featureStore)
-	isLocalReg := isLocalRegistry(featureStore)
+	isLocalRegistry := IsLocalRegistry(featureStore)
 	if appliedSpec.Services != nil {
 		services := appliedSpec.Services
 

@@ -502,7 +502,7 @@ func (feast *FeastServices) setRemoteRegistryURL() error {
 }
 
 func (feast *FeastServices) isLocalRegistry() bool {
-	return isLocalRegistry(feast.Handler.FeatureStore)
+	return IsLocalRegistry(feast.Handler.FeatureStore)
 }
 
 func (feast *FeastServices) isRemoteRegistry() bool {

@@ -17,7 +17,7 @@ import (
 	"sigs.k8s.io/controller-runtime/pkg/log"
 )
 
-func isLocalRegistry(featureStore *feastdevv1alpha1.FeatureStore) bool {
+func IsLocalRegistry(featureStore *feastdevv1alpha1.FeatureStore) bool {
 	appliedServices := featureStore.Status.Applied.Services
 	return appliedServices != nil && appliedServices.Registry != nil && appliedServices.Registry.Local != nil
 }
@@ -35,7 +35,7 @@ func hasPvcConfig(featureStore *feastdevv1alpha1.FeatureStore, feastType FeastSe
 			pvcConfig = services.OfflineStore.Persistence.FilePersistence.PvcConfig
 		}
 	case RegistryFeastType:
-		if isLocalRegistry(featureStore) && services.Registry.Local.Persistence.FilePersistence != nil {
+		if IsLocalRegistry(featureStore) && services.Registry.Local.Persistence.FilePersistence != nil {
 			pvcConfig = services.Registry.Local.Persistence.FilePersistence.PvcConfig
 		}
 	}