initial commit

Signed-off-by: Daniele Martinoli <dmartino@redhat.com>
feast-dev · dmartinol · Dec 4, 2024 · Nov 22, 2024 · Nov 22, 2024 · Nov 25, 2024
commit 82085d66e95b6bf75280869bb5681a5550ba0b76
@@ -280,8 +280,10 @@ type OptionalConfigs struct {
 }
 
 // AuthzConfig defines the authorization settings for the deployed Feast services.
+// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc)].exists_one(c, c)",message="One selection required between kubernetes or oidc."
 type AuthzConfig struct {
 	KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
+	OidcAuthz       *OidcAuthz       `json:"oidc,omitempty"`
 }
 
 // KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
@@ -296,6 +298,12 @@ type KubernetesAuthz struct {
 	Roles []string `json:"roles,omitempty"`
 }
 
+// OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
+// https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
+type OidcAuthz struct {
+	SecretRef corev1.LocalObjectReference `json:"secretRef"`
+}
+
 // TlsConfigs configures server TLS for a feast service. in an openshift cluster, this is configured by default using service serving certificates.
 // +kubebuilder:validation:XValidation:rule="(!has(self.disable) || !self.disable) ? has(self.secretRef) : true",message="`secretRef` required if `disable` is false."
 type TlsConfigs struct {

@@ -69,7 +69,31 @@ spec:
                           type: string
                         type: array
                     type: object
+                  oidc:
+                    description: |-
+                      OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
+                      https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
+                    properties:
+                      secretRef:
+                        description: |-
+                          LocalObjectReference contains enough information to let you locate the
+                          referenced object inside the same namespace.
+                        properties:
+                          name:
+                            description: |-
+                              Name of the referent.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              TODO: Add other useful fields. apiVersion, kind, uid?
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    required:
+                    - secretRef
+                    type: object
                 type: object
+                x-kubernetes-validations:
+                - message: One selection required between kubernetes or oidc.
+                  rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
               feastProject:
                 description: FeastProject is the Feast project id. This can be any
                   alphanumeric string with underscores, but it cannot start with an
@@ -1238,7 +1262,32 @@ spec:
                               type: string
                             type: array
                         type: object
+                      oidc:
+                        description: |-
+                          OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
+                          https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
+                        properties:
+                          secretRef:
+                            description: |-
+                              LocalObjectReference contains enough information to let you locate the
+                              referenced object inside the same namespace.
+                            properties:
+                              name:
+                                description: |-
+                                  Name of the referent.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  TODO: Add other useful fields. apiVersion, kind, uid?
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        required:
+                        - secretRef
+                        type: object
                     type: object
+                    x-kubernetes-validations:
+                    - message: One selection required between kubernetes or oidc.
+                      rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
+                        c)'
                   feastProject:
                     description: FeastProject is the Feast project id. This can be
                       any alphanumeric string with underscores, but it cannot start

@@ -77,7 +77,31 @@ spec:
                           type: string
                         type: array
                     type: object
+                  oidc:
+                    description: |-
+                      OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
+                      https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
+                    properties:
+                      secretRef:
+                        description: |-
+                          LocalObjectReference contains enough information to let you locate the
+                          referenced object inside the same namespace.
+                        properties:
+                          name:
+                            description: |-
+                              Name of the referent.
+                              More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                              TODO: Add other useful fields. apiVersion, kind, uid?
+                            type: string
+                        type: object
+                        x-kubernetes-map-type: atomic
+                    required:
+                    - secretRef
+                    type: object
                 type: object
+                x-kubernetes-validations:
+                - message: One selection required between kubernetes or oidc.
+                  rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
               feastProject:
                 description: FeastProject is the Feast project id. This can be any
                   alphanumeric string with underscores, but it cannot start with an
@@ -1246,7 +1270,32 @@ spec:
                               type: string
                             type: array
                         type: object
+                      oidc:
+                        description: |-
+                          OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
+                          https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
+                        properties:
+                          secretRef:
+                            description: |-
+                              LocalObjectReference contains enough information to let you locate the
+                              referenced object inside the same namespace.
+                            properties:
+                              name:
+                                description: |-
+                                  Name of the referent.
+                                  More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+                                  TODO: Add other useful fields. apiVersion, kind, uid?
+                                type: string
+                            type: object
+                            x-kubernetes-map-type: atomic
+                        required:
+                        - secretRef
+                        type: object
                     type: object
+                    x-kubernetes-validations:
+                    - message: One selection required between kubernetes or oidc.
+                      rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
+                        c)'
                   feastProject:
                     description: FeastProject is the Feast project id. This can be
                       any alphanumeric string with underscores, but it cannot start

@@ -18,15 +18,13 @@ import (
 // Deploy the feast authorization
 func (authz *FeastAuthorization) Deploy() error {
 	if authz.isKubernetesAuth() {
-		if err := authz.deployKubernetesAuth(); err != nil {
-			return err
-		}
-	} else {
-		authz.removeOrphanedRoles()
-		_ = authz.Handler.DeleteOwnedFeastObj(authz.initFeastRole())
-		_ = authz.Handler.DeleteOwnedFeastObj(authz.initFeastRoleBinding())
-		apimeta.RemoveStatusCondition(&authz.Handler.FeatureStore.Status.Conditions, feastKubernetesAuthConditions[metav1.ConditionTrue].Type)
+		return authz.deployKubernetesAuth()
 	}
+
+	authz.removeOrphanedRoles()
+	_ = authz.Handler.DeleteOwnedFeastObj(authz.initFeastRole())
+	_ = authz.Handler.DeleteOwnedFeastObj(authz.initFeastRoleBinding())
+	apimeta.RemoveStatusCondition(&authz.Handler.FeatureStore.Status.Conditions, feastKubernetesAuthConditions[metav1.ConditionTrue].Type)
 	return nil
 }
 

@@ -333,9 +333,9 @@ var _ = Describe("FeatureStore Controller-Kubernetes authorization", func() {
 			Expect(err).To(HaveOccurred())
 			Expect(errors.IsNotFound(err)).To(BeTrue())
 
-			By("Clearing the kubernetes authorizatino and reconciling")
+			By("Clearing the kubernetes authorization and reconciling")
 			resourceNew = resource.DeepCopy()
-			resourceNew.Spec.AuthzConfig = &feastdevv1alpha1.AuthzConfig{}
+			resourceNew.Spec.AuthzConfig = nil
 			err = k8sClient.Update(ctx, resourceNew)
 			Expect(err).NotTo(HaveOccurred())
 			_, err = controllerReconciler.Reconcile(ctx, reconcile.Request{

@@ -964,7 +964,6 @@ var _ = Describe("FeatureStore Controller", func() {
 				},
 				Spec: feastdevv1alpha1.FeatureStoreSpec{
 					FeastProject: referencedRegistry.Spec.FeastProject,
-					AuthzConfig:  &feastdevv1alpha1.AuthzConfig{},
 					Services: &feastdevv1alpha1.FeatureStoreServices{
 						OnlineStore:  &feastdevv1alpha1.OnlineStore{},
 						OfflineStore: &feastdevv1alpha1.OfflineStore{},

@@ -47,7 +47,7 @@ func (feast *FeastServices) createClientConfigMap() error {
 
 func (feast *FeastServices) setClientConfigMap(cm *corev1.ConfigMap) error {
 	cm.Labels = feast.getLabels(ClientFeastType)
-	clientYaml, err := feast.getClientFeatureStoreYaml()
+	clientYaml, err := feast.getClientFeatureStoreYaml(feast.extractConfigFromSecret)
 	if err != nil {
 		return err
 	}

@@ -47,10 +47,34 @@ func (feast *FeastServices) getServiceRepoConfig(feastType FeastServiceType) (Re
 	return getServiceRepoConfig(feastType, feast.Handler.FeatureStore, feast.extractConfigFromSecret)
 }
 
-func getServiceRepoConfig(feastType FeastServiceType, featureStore *feastdevv1alpha1.FeatureStore, secretExtractionFunc func(secretRef string, secretKeyName string) (map[string]interface{}, error)) (RepoConfig, error) {
+func getServiceRepoConfig(
+	feastType FeastServiceType,
+	featureStore *feastdevv1alpha1.FeatureStore,
+	secretExtractionFunc func(secretRef string, secretKeyName string) (map[string]interface{}, error)) (RepoConfig, error) {
 	appliedSpec := featureStore.Status.Applied
 
-	repoConfig := getClientRepoConfig(featureStore)
+	repoConfig, err := getClientRepoConfig(featureStore, secretExtractionFunc)
+	if err != nil {
+		return repoConfig, err
+	}
+
+	if appliedSpec.AuthzConfig != nil && appliedSpec.AuthzConfig.OidcAuthz != nil {
+		propertiesMap, err := secretExtractionFunc(appliedSpec.AuthzConfig.OidcAuthz.SecretRef.Name, "")
+		if err != nil {
+			return repoConfig, err
+		}
+
+		oidcServerProperties := map[string]interface{}{}
+		for _, oidcServerProperty := range OidcServerProperties {
+			if val, exists := propertiesMap[string(oidcServerProperty)]; exists {
+				oidcServerProperties[string(oidcServerProperty)] = val
+			} else {
+				return repoConfig, missingOidcSecretProperty(oidcServerProperty)
+			}
+		}
+		repoConfig.AuthzConfig.OidcParameters = oidcServerProperties
+	}
+
 	if appliedSpec.Services != nil {
 		services := appliedSpec.Services
 
@@ -200,11 +224,17 @@ func setRepoConfigOffline(services *feastdevv1alpha1.FeatureStoreServices, secre
 	return nil
 }
 
-func (feast *FeastServices) getClientFeatureStoreYaml() ([]byte, error) {
-	return yaml.Marshal(getClientRepoConfig(feast.Handler.FeatureStore))
+func (feast *FeastServices) getClientFeatureStoreYaml(secretExtractionFunc func(secretRef string, secretKeyName string) (map[string]interface{}, error)) ([]byte, error) {
+	clientRepo, err := getClientRepoConfig(feast.Handler.FeatureStore, secretExtractionFunc)
+	if err != nil {
+		return []byte{}, err
+	}
+	return yaml.Marshal(clientRepo)
 }
 
-func getClientRepoConfig(featureStore *feastdevv1alpha1.FeatureStore) RepoConfig {
+func getClientRepoConfig(
+	featureStore *feastdevv1alpha1.FeatureStore,
+	secretExtractionFunc func(secretRef string, secretKeyName string) (map[string]interface{}, error)) (RepoConfig, error) {
 	status := featureStore.Status
 	appliedServices := status.Applied.Services
 	clientRepoConfig := RepoConfig{
@@ -248,13 +278,37 @@ func getClientRepoConfig(featureStore *feastdevv1alpha1.FeatureStore) RepoConfig
 		}
 	}
 
-	clientRepoConfig.AuthzConfig = AuthzConfig{
-		Type: NoAuthAuthType,
-	}
-	if status.Applied.AuthzConfig != nil && status.Applied.AuthzConfig.KubernetesAuthz != nil {
-		clientRepoConfig.AuthzConfig.Type = KubernetesAuthType
+	if status.Applied.AuthzConfig == nil {
+		clientRepoConfig.AuthzConfig = AuthzConfig{
+			Type: NoAuthAuthType,
+		}
+	} else {
+		if status.Applied.AuthzConfig.KubernetesAuthz != nil {
+			clientRepoConfig.AuthzConfig = AuthzConfig{
+				Type: KubernetesAuthType,
+			}
+		} else if status.Applied.AuthzConfig.OidcAuthz != nil {
+			clientRepoConfig.AuthzConfig = AuthzConfig{
+				Type: OidcAuthType,
+			}
+
+			propertiesMap, err := secretExtractionFunc(status.Applied.AuthzConfig.OidcAuthz.SecretRef.Name, "")
+			if err != nil {
+				return clientRepoConfig, err
+			}
+
+			oidcClientProperties := map[string]interface{}{}
+			for _, oidcClientProperty := range OidcClientProperties {
+				if val, exists := propertiesMap[string(oidcClientProperty)]; exists {
+					oidcClientProperties[string(oidcClientProperty)] = val
+				} else {
+					return clientRepoConfig, missingOidcSecretProperty(oidcClientProperty)
+				}
+			}
+			clientRepoConfig.AuthzConfig.OidcParameters = oidcClientProperties
+		}
 	}
-	return clientRepoConfig
+	return clientRepoConfig, nil
 }
 
 func getActualPath(filePath string, pvcConfig *feastdevv1alpha1.PvcConfig) string {
@@ -271,24 +325,33 @@ func (feast *FeastServices) extractConfigFromSecret(secretRef string, secretKeyN
 	}
 	parameters := map[string]interface{}{}
 
-	val, exists := secret.Data[secretKeyName]
-	if !exists {
-		return nil, fmt.Errorf("secret key %s doesn't exist in secret %s", secretKeyName, secretRef)
-	}
-
-	err = yaml.Unmarshal(val, &parameters)
-	if err != nil {
-		return nil, fmt.Errorf("secret %s contains invalid value", secretKeyName)
-	}
-
-	_, exists = parameters["type"]
-	if exists {
-		return nil, fmt.Errorf("secret key %s in secret %s contains invalid tag named type", secretKeyName, secretRef)
-	}
+	if secretKeyName != "" {
+		val, exists := secret.Data[secretKeyName]
+		if !exists {
+			return nil, fmt.Errorf("secret key %s doesn't exist in secret %s", secretKeyName, secretRef)
+		}
+		err = yaml.Unmarshal(val, &parameters)
+		if err != nil {
+			return nil, fmt.Errorf("secret %s contains invalid value", secretKeyName)
+		}
+		_, exists = parameters["type"]
+		if exists {
+			return nil, fmt.Errorf("secret key %s in secret %s contains invalid tag named type", secretKeyName, secretRef)
+		}
 
-	_, exists = parameters["registry_type"]
-	if exists {
-		return nil, fmt.Errorf("secret key %s in secret %s contains invalid tag named registry_type", secretKeyName, secretRef)
+		_, exists = parameters["registry_type"]
+		if exists {
+			return nil, fmt.Errorf("secret key %s in secret %s contains invalid tag named registry_type", secretKeyName, secretRef)
+		}
+	} else {
+		for k, v := range secret.Data {
+			var val interface{}
+			err := yaml.Unmarshal(v, &val)
+			if err != nil {
+				return nil, fmt.Errorf("secret %s contains invalid value %v", k, v)
+			}
+			parameters[k] = val
+		}
 	}
 
 	return parameters, nil