feat: Add packaged feature repository support to Feast Operator - #6652
Conversation
franciscojavierarceo
left a comment
There was a problem hiding this comment.
The packaged repository path validation can be bypassed by non-canonical absolute paths. For example, /opt/.. passes the CEL rules (startsWith('/') and not equal to /), but path.Clean() turns it into /; the init script then executes cp -a -- "${FEAST_PACKAGED_FEATURE_REPO_PATH}/." ..., potentially copying the entire image filesystem (including secrets) into the shared repository volume. Please validate the cleaned path, reject .. traversal segments/root, and add cases such as /opt/.., /../x, and repeated separators to both API-version test suites.
|
@franciscojavierarceo thanks for flagging out! |
5b3985b to
509f8d7
Compare
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #6652 +/- ##
==========================================
- Coverage 46.46% 46.45% -0.01%
==========================================
Files 414 414
Lines 50138 50138
Branches 7173 7173
==========================================
- Hits 23295 23292 -3
- Misses 25204 25205 +1
- Partials 1639 1641 +2
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
|
added a commit to fix init image precedence for a recent merged PR #6598 |
|
@ShumzZzZz can you please rebase and squash, I am not able to rebase as still showing conflicts |
8123bd7 to
a16e787
Compare
Add spec.feastProjectDir.packaged for repositories distributed in feature server images, including staged and direct-use lifecycle modes, canonical path validation, generated CRD artifacts, documentation, and tests. Integrate the init image override introduced by feast-dev#6598 with this precedence: services.initImage, packaged.image, RELATED_IMAGE_FEATURE_SERVER, then DefaultImage. Signed-off-by: Shumin <shumin.zheng@outlook.com>
a16e787 to
d3b41e3
Compare
|
@ntkathole yeah I saw another PR got merged and every time new PR gets merged, the Also the failed task does not seem to be related to this PR. |
What this PR does / why we need it:
This PR adds
spec.feastProjectDir.packaged, allowing the Feast Operator to use a feature repository packaged inside a container image.The Operator currently supports creating a feature repository through
git cloneorfeast init. In air-gapped and artifact-based deployment environments, feature definitions and their Python dependencies are commonly distributed as an immutable container image. The existing workflow requires disabling init containers, configuring images separately for each service, and coordinatingfeast applythrough a separate CI/CD, CronJob, or manual workflow. It also does not provide a first-class way to declare where the packaged repository is located in the image. Therefore a failedfeast applyis surfaced only after the rollout, allowing a service to start against stale or missing definitionsThe new
packagedrepository mode accepts:image: the image containing the feature repository.featureRepoPath: the absolute path to the repository inside that image.It supports two lifecycle modes:
With init containers enabled,
feast-initcopies the packaged repository into the Operator-managed shared directory, replaces itsfeature_store.yamlwith the configuration generated from the FeatureStore CR, andfeast-applyregisters the definitions before the Feast services start.With init containers disabled, services run directly from the packaged repository path and use its baked
feature_store.yaml.The packaged image is used by default for repository initialization,
feast apply, and Feast services. Explicit per-service images continue to take precedence.This enables:
feast applyis surfaced during pod initializationfeast apply, and feature serving.The existing
gitandinitrepository modes remain unchanged.Which issue(s) this PR fixes:
N/A — no linked issue.
Checks
git commit -s)Testing Strategy
Focused Feast Operator controller tests:
GOWORK=off KUBEBUILDER_ASSETS=<envtest-assets> go test ./internal/controller -count=1The controller test suite covers:
packaged,git, andinit.