Skip to content

feat: Add TLS support to the Operator #4796

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dmartinol merged 4 commits into from
Dec 2, 2024
Merged

feat: Add TLS support to the Operator #4796

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
727883c
add tls support to the operator
tchughesiv Nov 19, 2024
274eb6a
operator tls review fix: if statement
tchughesiv Dec 1, 2024
648f519
rebase fixes
tchughesiv Dec 1, 2024
d4c3229
authz rbac fixes
tchughesiv Dec 1, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
rebase fixes 
Signed-off-by: Tommy Hughes <tohughes@redhat.com>
  • Loading branch information
@tchughesiv
tchughesiv committed Dec 1, 2024
commit 648f5190301fda8e5abaf463679c5ea6cd260c8d
36 changes: 15 additions & 21 deletions infra/feast-operator/internal/controller/featurestore_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,40 +108,34 @@ func (r *FeatureStoreReconciler) deployFeast(ctx context.Context, cr *feastdevv1
Reason: feastdevv1alpha1.ReadyReason,
Message: feastdevv1alpha1.ReadyMessage,
}

authz := authz.FeastAuthorization{
feast := services.FeastServices{
Handler: feasthandler.FeastHandler{
Client: r.Client,
Context: ctx,
FeatureStore: cr,
Scheme: r.Scheme,
},
}
if err = authz.Deploy(); err != nil {
authz := authz.FeastAuthorization{
Handler: feast.Handler,
}

// status defaults must be applied before deployments
errResult := ctrl.Result{Requeue: true, RequeueAfter: RequeueDelayError}
if err = feast.ApplyDefaults(); err != nil {
result = errResult
} else if err = authz.Deploy(); err != nil {
result = errResult
} else if err = feast.Deploy(); err != nil {
result = errResult
}
if err != nil {
condition = metav1.Condition{
Type: feastdevv1alpha1.ReadyType,
Status: metav1.ConditionFalse,
Reason: feastdevv1alpha1.FailedReason,
Message: "Error: " + err.Error(),
}
result = ctrl.Result{Requeue: true, RequeueAfter: RequeueDelayError}
} else {
feast := services.FeastServices{
Handler: feasthandler.FeastHandler{
Client: r.Client,
Context: ctx,
FeatureStore: cr,
Scheme: r.Scheme,
}}
if err = feast.Deploy(); err != nil {
condition = metav1.Condition{
Type: feastdevv1alpha1.ReadyType,
Status: metav1.ConditionFalse,
Reason: feastdevv1alpha1.FailedReason,
Message: "Error: " + err.Error(),
}
result = ctrl.Result{Requeue: true, RequeueAfter: RequeueDelayError}
}
}

logger.Info(condition.Message)
Expand Down
33 changes: 21 additions & 12 deletions infra/feast-operator/internal/controller/featurestore_controller_tls_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,7 @@ import (

"github.com/feast-dev/feast/infra/feast-operator/api/feastversion"
feastdevv1alpha1 "github.com/feast-dev/feast/infra/feast-operator/api/v1alpha1"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/handler"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/services"
)

Expand Down Expand Up @@ -114,10 +115,12 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
err = k8sClient.Get(ctx, typeNamespacedName, resource)
Expect(err).NotTo(HaveOccurred())
feast := services.FeastServices{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
Handler: handler.FeastHandler{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
},
}

Expect(resource.Status).NotTo(BeNil())
Expand Down Expand Up @@ -209,10 +212,12 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
err = k8sClient.Get(ctx, typeNamespacedName, resource)
Expect(err).NotTo(HaveOccurred())
feast := services.FeastServices{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
Handler: handler.FeastHandler{
Client: controllerReconciler.Client,
Context: ctx,
Scheme: controllerReconciler.Scheme,
FeatureStore: resource,
},
}

req, err := labels.NewRequirement(services.NameLabelKey, selection.Equals, []string{resource.Name})
Expand Down Expand Up @@ -264,6 +269,7 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
RegistryType: services.RegistryFileConfigType,
Path: services.DefaultRegistryEphemeralPath,
},
AuthzConfig: noAuthzConfig(),
}
Expect(repoConfig).To(Equal(testConfig))

Expand Down Expand Up @@ -301,7 +307,8 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
OfflineStore: services.OfflineStoreConfig{
Type: services.OfflineFilePersistenceDaskConfigType,
},
Registry: regRemote,
Registry: regRemote,
AuthzConfig: noAuthzConfig(),
}
Expect(repoConfigOffline).To(Equal(offlineConfig))

Expand Down Expand Up @@ -343,7 +350,8 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
Path: services.DefaultOnlineStoreEphemeralPath,
Type: services.OnlineSqliteConfigType,
},
Registry: regRemote,
Registry: regRemote,
AuthzConfig: noAuthzConfig(),
}
Expect(repoConfigOnline).To(Equal(onlineConfig))
Expect(deploy.Spec.Template.Spec.Containers[0].Env).To(HaveLen(1))
Expand All @@ -370,7 +378,8 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
Type: services.OnlineRemoteConfigType,
Cert: services.GetTlsPath(services.OnlineFeastType) + "tls.crt",
},
Registry: regRemote,
Registry: regRemote,
AuthzConfig: noAuthzConfig(),
}
Expect(repoConfigClient).To(Equal(clientConfig))

Expand Down Expand Up @@ -412,7 +421,7 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
resource = &feastdevv1alpha1.FeatureStore{}
err = k8sClient.Get(ctx, typeNamespacedName, resource)
Expect(err).NotTo(HaveOccurred())
feast.FeatureStore = resource
feast.Handler.FeatureStore = resource

// check registry
deploy = &appsv1.Deployment{}
Expand Down
8 changes: 4 additions & 4 deletions infra/feast-operator/internal/controller/services/client.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,9 +57,9 @@ func (feast *FeastServices) setClientConfigMap(cm *corev1.ConfigMap) error {
}

func (feast *FeastServices) createCaConfigMap() error {
logger := log.FromContext(feast.Context)
logger := log.FromContext(feast.Handler.Context)
cm := feast.initCaConfigMap()
if op, err := controllerutil.CreateOrUpdate(feast.Context, feast.Client, cm, controllerutil.MutateFn(func() error {
if op, err := controllerutil.CreateOrUpdate(feast.Handler.Context, feast.Handler.Client, cm, controllerutil.MutateFn(func() error {
return feast.setCaConfigMap(cm)
})); err != nil {
return err
Expand All @@ -71,12 +71,12 @@ func (feast *FeastServices) createCaConfigMap() error {

func (feast *FeastServices) setCaConfigMap(cm *corev1.ConfigMap) error {
cm.Labels = map[string]string{
NameLabelKey: feast.FeatureStore.Name,
NameLabelKey: feast.Handler.FeatureStore.Name,
}
cm.Annotations = map[string]string{
"service.beta.openshift.io/inject-cabundle": "true",
}
return controllerutil.SetControllerReference(feast.FeatureStore, cm, feast.Scheme)
return controllerutil.SetControllerReference(feast.Handler.FeatureStore, cm, feast.Handler.Scheme)
}

func (feast *FeastServices) initCaConfigMap() *corev1.ConfigMap {
Expand Down
27 changes: 12 additions & 15 deletions infra/feast-operator/internal/controller/services/services.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,20 @@ import (
"sigs.k8s.io/controller-runtime/pkg/log"
)

// Deploy the feast services
func (feast *FeastServices) Deploy() error {
// initial status defaults must be applied before feast deployment
if err := feast.ApplyDefaults(); err != nil {
// Apply defaults and set service hostnames in FeatureStore status
func (feast *FeastServices) ApplyDefaults() error {
ApplyDefaultsToStatus(feast.Handler.FeatureStore)
if err := feast.setTlsDefaults(); err != nil {
return err
}
if err := feast.setServiceHostnames(); err != nil {
return err
}
return nil
}

// Deploy the feast services
func (feast *FeastServices) Deploy() error {
openshiftTls, err := feast.checkOpenshiftTls()
if err != nil {
return err
Expand Down Expand Up @@ -212,17 +220,6 @@ func (feast *FeastServices) removeFeastServiceByType(feastType FeastServiceType)
return nil
}

func (feast *FeastServices) ApplyDefaults() error {
ApplyDefaultsToStatus(feast.Handler.FeatureStore)
if err := feast.setTlsDefaults(); err != nil {
return err
}
if err := feast.setServiceHostnames(); err != nil {
return err
}
return nil
}

func (feast *FeastServices) createService(feastType FeastServiceType) error {
logger := log.FromContext(feast.Handler.Context)
svc := feast.initFeastSvc(feastType)
Expand Down
32 changes: 16 additions & 16 deletions infra/feast-operator/internal/controller/services/tls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ func (feast *FeastServices) setTlsDefaults() error {
if err := feast.setOpenshiftTls(); err != nil {
return err
}
appliedServices := feast.FeatureStore.Status.Applied.Services
appliedServices := feast.Handler.FeatureStore.Status.Applied.Services
if feast.isOfflinStore() && appliedServices.OfflineStore.TLS != nil {
tlsDefaults(&appliedServices.OfflineStore.TLS.TlsConfigs)
}
Expand All @@ -41,7 +41,7 @@ func (feast *FeastServices) setTlsDefaults() error {
}

func (feast *FeastServices) setOpenshiftTls() error {
appliedServices := feast.FeatureStore.Status.Applied.Services
appliedServices := feast.Handler.FeatureStore.Status.Applied.Services
tlsConfigs := &feastdevv1alpha1.TlsConfigs{
SecretRef: &corev1.LocalObjectReference{},
}
Expand Down Expand Up @@ -94,7 +94,7 @@ func (feast *FeastServices) isOpenShiftTls(feastType FeastServiceType) (isOpenSh
}

func (feast *FeastServices) getTlsConfigs(feastType FeastServiceType) (tls *feastdevv1alpha1.TlsConfigs) {
appliedServices := feast.FeatureStore.Status.Applied.Services
appliedServices := feast.Handler.FeatureStore.Status.Applied.Services
switch feastType {
case OfflineFeastType:
if feast.isOfflinStore() && appliedServices.OfflineStore.TLS != nil {
Expand All @@ -115,23 +115,23 @@ func (feast *FeastServices) getTlsConfigs(feastType FeastServiceType) (tls *feas
// True if running in an openshift cluster and Tls not configured in the service Spec
func (feast *FeastServices) offlineOpenshiftTls() bool {
return isOpenShift &&
feast.isOfflinStore() && feast.FeatureStore.Spec.Services.OfflineStore.TLS == nil
feast.isOfflinStore() && feast.Handler.FeatureStore.Spec.Services.OfflineStore.TLS == nil
}

// True if running in an openshift cluster and Tls not configured in the service Spec
func (feast *FeastServices) onlineOpenshiftTls() bool {
return isOpenShift &&
feast.isOnlinStore() && feast.FeatureStore.Spec.Services.OnlineStore.TLS == nil
feast.isOnlinStore() && feast.Handler.FeatureStore.Spec.Services.OnlineStore.TLS == nil
}

// True if running in an openshift cluster and Tls not configured in the service Spec
func (feast *FeastServices) localRegistryOpenshiftTls() bool {
return isOpenShift &&
feast.isLocalRegistry() &&
(feast.FeatureStore.Spec.Services == nil ||
feast.FeatureStore.Spec.Services.Registry == nil ||
feast.FeatureStore.Spec.Services.Registry.Local == nil ||
feast.FeatureStore.Spec.Services.Registry.Local.TLS == nil)
(feast.Handler.FeatureStore.Spec.Services == nil ||
feast.Handler.FeatureStore.Spec.Services.Registry == nil ||
feast.Handler.FeatureStore.Spec.Services.Registry.Local == nil ||
feast.Handler.FeatureStore.Spec.Services.Registry.Local.TLS == nil)
}

// True if running in an openshift cluster, and using a remote registry in the same cluster, with no remote Tls set in the service Spec
Expand All @@ -142,24 +142,24 @@ func (feast *FeastServices) remoteRegistryOpenshiftTls() (bool, error) {
return false, err
}
return (remoteFeast != nil && remoteFeast.localRegistryOpenshiftTls() &&
feast.FeatureStore.Spec.Services.Registry.Remote.TLS == nil),
feast.Handler.FeatureStore.Spec.Services.Registry.Remote.TLS == nil),
nil
}
return false, nil
}

func (feast *FeastServices) offlineTls() bool {
return feast.isOfflinStore() &&
feast.FeatureStore.Status.Applied.Services.OfflineStore.TLS != nil &&
(&feast.FeatureStore.Status.Applied.Services.OfflineStore.TLS.TlsConfigs).IsTLS()
feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS != nil &&
(&feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS.TlsConfigs).IsTLS()
}

func (feast *FeastServices) localRegistryTls() bool {
return localRegistryTls(feast.FeatureStore)
return localRegistryTls(feast.Handler.FeatureStore)
}

func (feast *FeastServices) remoteRegistryTls() bool {
return remoteRegistryTls(feast.FeatureStore)
return remoteRegistryTls(feast.Handler.FeatureStore)
}

func (feast *FeastServices) mountRegistryClientTls(podSpec *corev1.PodSpec) {
Expand All @@ -168,7 +168,7 @@ func (feast *FeastServices) mountRegistryClientTls(podSpec *corev1.PodSpec) {
feast.mountTlsConfig(RegistryFeastType, podSpec)
} else if feast.remoteRegistryTls() {
mountTlsRemoteRegistryConfig(RegistryFeastType, podSpec,
feast.FeatureStore.Status.Applied.Services.Registry.Remote.TLS)
feast.Handler.FeatureStore.Status.Applied.Services.Registry.Remote.TLS)
}
}
}
Expand Down Expand Up @@ -233,7 +233,7 @@ func tlsDefaults(tls *feastdevv1alpha1.TlsConfigs) {
}

func localRegistryTls(featureStore *feastdevv1alpha1.FeatureStore) bool {
return isLocalRegistry(featureStore) && featureStore.Status.Applied.Services.Registry.Local.TLS.IsTLS()
return IsLocalRegistry(featureStore) && featureStore.Status.Applied.Services.Registry.Local.TLS.IsTLS()
}

func remoteRegistryTls(featureStore *feastdevv1alpha1.FeatureStore) bool {
Expand Down
25 changes: 14 additions & 11 deletions infra/feast-operator/internal/controller/services/tls_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@ import (
. "github.com/onsi/gomega"

feastdevv1alpha1 "github.com/feast-dev/feast/infra/feast-operator/api/v1alpha1"
"github.com/feast-dev/feast/infra/feast-operator/internal/controller/handler"
corev1 "k8s.io/api/core/v1"
"k8s.io/apimachinery/pkg/runtime"
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
Expand All @@ -44,8 +45,10 @@ var _ = Describe("TLS Config", func() {

// registry service w/o tls
feast := FeastServices{
FeatureStore: minimalFeatureStore(),
Scheme: scheme,
Handler: handler.FeastHandler{
FeatureStore: minimalFeatureStore(),
Scheme: scheme,
},
}
err := feast.ApplyDefaults()
Expect(err).To(BeNil())
Expand All @@ -67,7 +70,7 @@ var _ = Describe("TLS Config", func() {

// registry service w/ openshift tls
testSetIsOpenShift()
feast.FeatureStore = minimalFeatureStore()
feast.Handler.FeatureStore = minimalFeatureStore()
err = feast.ApplyDefaults()
Expect(err).To(BeNil())

Expand Down Expand Up @@ -95,11 +98,11 @@ var _ = Describe("TLS Config", func() {
Expect(openshiftTls).To(BeTrue())

// all services w/ openshift tls
feast.FeatureStore = minimalFeatureStoreWithAllServices()
feast.Handler.FeatureStore = minimalFeatureStoreWithAllServices()
err = feast.ApplyDefaults()
Expect(err).To(BeNil())

repoConfig := getClientRepoConfig(feast.FeatureStore)
repoConfig := getClientRepoConfig(feast.Handler.FeatureStore)
Expect(repoConfig.OfflineStore.Port).To(Equal(HttpsPort))
Expect(repoConfig.OfflineStore.Scheme).To(Equal(HttpsScheme))
Expect(repoConfig.OfflineStore.Cert).To(ContainSubstring(string(OfflineFeastType)))
Expand Down Expand Up @@ -147,8 +150,8 @@ var _ = Describe("TLS Config", func() {
Expect(onlineDeploy.Spec.Template.Spec.Volumes).To(HaveLen(3))

// registry service w/ tls and in an openshift cluster
feast.FeatureStore = minimalFeatureStore()
feast.FeatureStore.Spec.Services = &feastdevv1alpha1.FeatureStoreServices{
feast.Handler.FeatureStore = minimalFeatureStore()
feast.Handler.FeatureStore.Spec.Services = &feastdevv1alpha1.FeatureStoreServices{
OnlineStore: &feastdevv1alpha1.OnlineStore{
TLS: &feastdevv1alpha1.TlsConfigs{},
},
Expand Down Expand Up @@ -190,12 +193,12 @@ var _ = Describe("TLS Config", func() {
Expect(openshiftTls).To(BeFalse())

// all services w/ tls and in an openshift cluster
feast.FeatureStore = minimalFeatureStoreWithAllServices()
feast.Handler.FeatureStore = minimalFeatureStoreWithAllServices()
disable := true
feast.FeatureStore.Spec.Services.OnlineStore.TLS = &feastdevv1alpha1.TlsConfigs{
feast.Handler.FeatureStore.Spec.Services.OnlineStore.TLS = &feastdevv1alpha1.TlsConfigs{
Disable: &disable,
}
feast.FeatureStore.Spec.Services.Registry = &feastdevv1alpha1.Registry{
feast.Handler.FeatureStore.Spec.Services.Registry = &feastdevv1alpha1.Registry{
Local: &feastdevv1alpha1.LocalRegistryConfig{
TLS: &feastdevv1alpha1.TlsConfigs{
Disable: &disable,
Expand All @@ -205,7 +208,7 @@ var _ = Describe("TLS Config", func() {
err = feast.ApplyDefaults()
Expect(err).To(BeNil())

repoConfig = getClientRepoConfig(feast.FeatureStore)
repoConfig = getClientRepoConfig(feast.Handler.FeatureStore)
Expect(repoConfig.OfflineStore.Port).To(Equal(HttpsPort))
Expect(repoConfig.OfflineStore.Scheme).To(Equal(HttpsScheme))
Expect(repoConfig.OfflineStore.Cert).To(ContainSubstring(string(OfflineFeastType)))
Expand Down