Skip to content

Commit c254703

Browse files
dmartinoldharmisha
dmartinol
authored and
dharmisha
committed
feat: OIDC authorization in Feast Operator (feast-dev#4801)
* Initial commit Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * no private image Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * removed nameLabelKey, using serices.NameLabelKey Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * improved CRD comments and using IsLocalRegistry Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * fixing generated code Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * renamed auth condition and types Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * more renamings Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * initial commit Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * oidc IT Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * with sample Signed-off-by: Daniele Martinoli <dmartino@redhat.com> * no private image Signed-off-by: Daniele Martinoli <dmartino@redhat.com> --------- Signed-off-by: Daniele Martinoli <dmartino@redhat.com>
1 parent 04a1b2b commit c254703

14 files changed

Lines changed: 479 additions & 21 deletions

‎infra/feast-operator/api/v1alpha1/featurestore_types.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,14 +421,20 @@ type OptionalConfigs struct {
421421

422422
// AuthzConfig defines the authorization settings for the deployed Feast services.
423423
<<<<<<< HEAD
424+
<<<<<<< HEAD
425+
=======
426+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
424427
// +kubebuilder:validation:XValidation:rule="[has(self.kubernetes), has(self.oidc)].exists_one(c, c)",message="One selection required between kubernetes or oidc."
425428
type AuthzConfig struct {
426429
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
427430
OidcAuthz *OidcAuthz `json:"oidc,omitempty"`
431+
<<<<<<< HEAD
428432
=======
429433
type AuthzConfig struct {
430434
KubernetesAuthz *KubernetesAuthz `json:"kubernetes,omitempty"`
431435
>>>>>>> 39eb4d80c (feat: RBAC Authorization in Feast Operator (#4786))
436+
=======
437+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
432438
}
433439

434440
// KubernetesAuthz provides a way to define the authorization settings using Kubernetes RBAC resources.
@@ -445,14 +451,20 @@ type KubernetesAuthz struct {
445451

446452
<<<<<<< HEAD
447453
<<<<<<< HEAD
454+
<<<<<<< HEAD
455+
=======
456+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
448457
// OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
449458
// https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
450459
type OidcAuthz struct {
451460
SecretRef corev1.LocalObjectReference `json:"secretRef"`
452461
}
453462

463+
<<<<<<< HEAD
454464
=======
455465
>>>>>>> 668d47b8e (feat: Add TLS support to the Operator (#4796))
466+
=======
467+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
456468
// TlsConfigs configures server TLS for a feast service. in an openshift cluster, this is configured by default using service serving certificates.
457469
// +kubebuilder:validation:XValidation:rule="(!has(self.disable) || !self.disable) ? has(self.secretRef) : true",message="`secretRef` required if `disable` is false."
458470
type TlsConfigs struct {

‎infra/feast-operator/api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 22 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/feast-operator/config/crd/bases/feast.dev_featurestores.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,9 @@ spec:
7070
type: array
7171
type: object
7272
<<<<<<< HEAD
73+
<<<<<<< HEAD
74+
=======
75+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
7376
oidc:
7477
description: |-
7578
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -95,9 +98,12 @@ spec:
9598
x-kubernetes-validations:
9699
- message: One selection required between kubernetes or oidc.
97100
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
101+
<<<<<<< HEAD
98102
=======
99103
type: object
100104
>>>>>>> 39eb4d80c (feat: RBAC Authorization in Feast Operator (#4786))
105+
=======
106+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
101107
feastProject:
102108
description: FeastProject is the Feast project id. This can be any
103109
alphanumeric string with underscores, but it cannot start with an
@@ -1616,6 +1622,9 @@ spec:
16161622
type: array
16171623
type: object
16181624
<<<<<<< HEAD
1625+
<<<<<<< HEAD
1626+
=======
1627+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
16191628
oidc:
16201629
description: |-
16211630
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -1642,9 +1651,12 @@ spec:
16421651
- message: One selection required between kubernetes or oidc.
16431652
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
16441653
c)'
1654+
<<<<<<< HEAD
16451655
=======
16461656
type: object
16471657
>>>>>>> 39eb4d80c (feat: RBAC Authorization in Feast Operator (#4786))
1658+
=======
1659+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
16481660
feastProject:
16491661
description: FeastProject is the Feast project id. This can be
16501662
any alphanumeric string with underscores, but it cannot start

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,9 @@ spec:
7878
type: array
7979
type: object
8080
<<<<<<< HEAD
81+
<<<<<<< HEAD
82+
=======
83+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
8184
oidc:
8285
description: |-
8386
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -103,9 +106,12 @@ spec:
103106
x-kubernetes-validations:
104107
- message: One selection required between kubernetes or oidc.
105108
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c, c)'
109+
<<<<<<< HEAD
106110
=======
107111
type: object
108112
>>>>>>> 39eb4d80c (feat: RBAC Authorization in Feast Operator (#4786))
113+
=======
114+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
109115
feastProject:
110116
description: FeastProject is the Feast project id. This can be any
111117
alphanumeric string with underscores, but it cannot start with an
@@ -1624,6 +1630,9 @@ spec:
16241630
type: array
16251631
type: object
16261632
<<<<<<< HEAD
1633+
<<<<<<< HEAD
1634+
=======
1635+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
16271636
oidc:
16281637
description: |-
16291638
OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
@@ -1650,9 +1659,12 @@ spec:
16501659
- message: One selection required between kubernetes or oidc.
16511660
rule: '[has(self.kubernetes), has(self.oidc)].exists_one(c,
16521661
c)'
1662+
<<<<<<< HEAD
16531663
=======
16541664
type: object
16551665
>>>>>>> 39eb4d80c (feat: RBAC Authorization in Feast Operator (#4786))
1666+
=======
1667+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
16561668
feastProject:
16571669
description: FeastProject is the Feast project id. This can be
16581670
any alphanumeric string with underscores, but it cannot start

‎infra/feast-operator/internal/controller/featurestore_controller_kubernetes_auth_test.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -391,6 +391,7 @@ var _ = Describe("FeatureStore Controller-Kubernetes authorization", func() {
391391
Expect(err).To(HaveOccurred())
392392
Expect(errors.IsNotFound(err)).To(BeTrue())
393393

394+
<<<<<<< HEAD
394395
<<<<<<< HEAD
395396
By("Clearing the kubernetes authorization and reconciling")
396397
resourceNew = resource.DeepCopy()
@@ -400,6 +401,11 @@ var _ = Describe("FeatureStore Controller-Kubernetes authorization", func() {
400401
resourceNew = resource.DeepCopy()
401402
resourceNew.Spec.AuthzConfig = &feastdevv1alpha1.AuthzConfig{}
402403
>>>>>>> 39eb4d80c (feat: RBAC Authorization in Feast Operator (#4786))
404+
=======
405+
By("Clearing the kubernetes authorization and reconciling")
406+
resourceNew = resource.DeepCopy()
407+
resourceNew.Spec.AuthzConfig = nil
408+
>>>>>>> cd341f8f6 (feat: OIDC authorization in Feast Operator (#4801))
403409
err = k8sClient.Update(ctx, resourceNew)
404410
Expect(err).NotTo(HaveOccurred())
405411
_, err = controllerReconciler.Reconcile(ctx, reconcile.Request{

0 commit comments

Comments
 (0)