Skip to content

Commit c8bf4e2

Browse files
jyejarejyejare
committed
[pydantic issue] User token parsing fixed
Signed-off-by: jyejare <[email protected]>
1 parent 6337a00 commit c8bf4e2

File tree

5 files changed

+219
-64
lines changed

5 files changed

+219
-64
lines changed

‎infra/feast-operator/config/rbac/role.yaml‎

Lines changed: 11 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,12 @@ rules:
1515
- list
1616
- update
1717
- watch
18+
- apiGroups:
19+
- authentication.k8s.io
20+
resources:
21+
- tokenreviews
22+
verbs:
23+
- create
1824
- apiGroups:
1925
- batch
2026
resources:
@@ -44,11 +50,13 @@ rules:
4450
- apiGroups:
4551
- ""
4652
resources:
53+
- namespaces
4754
- pods
4855
- secrets
4956
verbs:
5057
- get
5158
- list
59+
- watch
5260
- apiGroups:
5361
- ""
5462
resources:
@@ -84,8 +92,11 @@ rules:
8492
- apiGroups:
8593
- rbac.authorization.k8s.io
8694
resources:
95+
- clusterrolebindings
96+
- clusterroles
8797
- rolebindings
8898
- roles
99+
- subjectaccessreviews
89100
verbs:
90101
- create
91102
- delete
@@ -104,32 +115,3 @@ rules:
104115
- list
105116
- update
106117
- watch
107-
# Token Access Review permissions for Feast server RBAC creation
108-
- apiGroups:
109-
- authentication.k8s.io
110-
resources:
111-
- tokenreviews
112-
verbs:
113-
- create
114-
- apiGroups:
115-
- rbac.authorization.k8s.io
116-
resources:
117-
- subjectaccessreviews
118-
verbs:
119-
- create
120-
- apiGroups:
121-
- ""
122-
resources:
123-
- namespaces
124-
verbs:
125-
- get
126-
- list
127-
- watch
128-
- apiGroups:
129-
- rbac.authorization.k8s.io
130-
resources:
131-
- clusterroles
132-
- clusterrolebindings
133-
verbs:
134-
- get
135-
- list

‎infra/feast-operator/internal/controller/authz/authz.go‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,23 @@ func (authz *FeastAuthorization) deployKubernetesAuth() error {
3737
if authz.isKubernetesAuth() {
3838
authz.removeOrphanedRoles()
3939

40+
// Create namespace-scoped RBAC resources
4041
if err := authz.createFeastRole(); err != nil {
4142
return authz.setFeastKubernetesAuthCondition(err)
4243
}
4344
if err := authz.createFeastRoleBinding(); err != nil {
4445
return authz.setFeastKubernetesAuthCondition(err)
4546
}
4647

48+
// Create cluster-scoped RBAC resources (separate from namespace resources)
49+
if err := authz.createFeastClusterRole(); err != nil {
50+
return authz.setFeastKubernetesAuthCondition(err)
51+
}
52+
if err := authz.createFeastClusterRoleBinding(); err != nil {
53+
return authz.setFeastKubernetesAuthCondition(err)
54+
}
55+
56+
// Create custom auth roles
4757
for _, roleName := range authz.Handler.FeatureStore.Status.Applied.AuthzConfig.KubernetesAuthz.Roles {
4858
if err := authz.createAuthRole(roleName); err != nil {
4959
return authz.setFeastKubernetesAuthCondition(err)
@@ -89,6 +99,80 @@ func (authz *FeastAuthorization) createFeastRole() error {
8999
return nil
90100
}
91101

102+
func (authz *FeastAuthorization) createFeastClusterRole() error {
103+
logger := log.FromContext(authz.Handler.Context)
104+
clusterRole := authz.initFeastClusterRole()
105+
if op, err := controllerutil.CreateOrUpdate(authz.Handler.Context, authz.Handler.Client, clusterRole, controllerutil.MutateFn(func() error {
106+
return authz.setFeastClusterRole(clusterRole)
107+
})); err != nil {
108+
return err
109+
} else if op == controllerutil.OperationResultCreated || op == controllerutil.OperationResultUpdated {
110+
logger.Info("Successfully reconciled", "ClusterRole", clusterRole.Name, "operation", op)
111+
}
112+
113+
return nil
114+
}
115+
116+
func (authz *FeastAuthorization) initFeastClusterRole() *rbacv1.ClusterRole {
117+
clusterRole := &rbacv1.ClusterRole{
118+
ObjectMeta: metav1.ObjectMeta{Name: authz.getFeastClusterRoleName()},
119+
}
120+
clusterRole.SetGroupVersionKind(rbacv1.SchemeGroupVersion.WithKind("ClusterRole"))
121+
return clusterRole
122+
}
123+
124+
func (authz *FeastAuthorization) setFeastClusterRole(clusterRole *rbacv1.ClusterRole) error {
125+
clusterRole.Labels = authz.getLabels()
126+
clusterRole.Rules = []rbacv1.PolicyRule{
127+
{
128+
APIGroups: []string{rbacv1.GroupName},
129+
Resources: []string{"rolebindings"},
130+
Verbs: []string{"list"},
131+
},
132+
}
133+
return nil
134+
}
135+
136+
func (authz *FeastAuthorization) initFeastClusterRoleBinding() *rbacv1.ClusterRoleBinding {
137+
clusterRoleBinding := &rbacv1.ClusterRoleBinding{
138+
ObjectMeta: metav1.ObjectMeta{Name: authz.getFeastClusterRoleBindingName()},
139+
}
140+
clusterRoleBinding.SetGroupVersionKind(rbacv1.SchemeGroupVersion.WithKind("ClusterRoleBinding"))
141+
return clusterRoleBinding
142+
}
143+
144+
func (authz *FeastAuthorization) setFeastClusterRoleBinding(clusterRoleBinding *rbacv1.ClusterRoleBinding) error {
145+
clusterRoleBinding.Labels = authz.getLabels()
146+
clusterRoleBinding.Subjects = []rbacv1.Subject{
147+
{
148+
Kind: "ServiceAccount",
149+
Name: authz.getFeastServiceAccountName(),
150+
Namespace: authz.Handler.FeatureStore.Namespace,
151+
},
152+
}
153+
clusterRoleBinding.RoleRef = rbacv1.RoleRef{
154+
APIGroup: rbacv1.GroupName,
155+
Kind: "ClusterRole",
156+
Name: authz.getFeastClusterRoleName(),
157+
}
158+
return nil
159+
}
160+
161+
// Create ClusterRoleBinding
162+
func (authz *FeastAuthorization) createFeastClusterRoleBinding() error {
163+
logger := log.FromContext(authz.Handler.Context)
164+
clusterRoleBinding := authz.initFeastClusterRoleBinding()
165+
if op, err := controllerutil.CreateOrUpdate(authz.Handler.Context, authz.Handler.Client, clusterRoleBinding, controllerutil.MutateFn(func() error {
166+
return authz.setFeastClusterRoleBinding(clusterRoleBinding)
167+
})); err != nil {
168+
return err
169+
} else if op == controllerutil.OperationResultCreated || op == controllerutil.OperationResultUpdated {
170+
logger.Info("Successfully reconciled", "ClusterRoleBinding", clusterRoleBinding.Name, "operation", op)
171+
}
172+
173+
return nil
174+
}
175+
92176
func (authz *FeastAuthorization) initFeastRole() *rbacv1.Role {
93177
role := &rbacv1.Role{
94178
ObjectMeta: metav1.ObjectMeta{Name: authz.getFeastRoleName(), Namespace: authz.Handler.FeatureStore.Namespace},
@@ -230,3 +314,23 @@ func (authz *FeastAuthorization) getFeastRoleName() string {
230314
func GetFeastRoleName(featureStore *feastdevv1alpha1.FeatureStore) string {
231315
return services.GetFeastName(featureStore)
232316
}
317+
318+
func (authz *FeastAuthorization) getFeastClusterRoleName() string {
319+
return GetFeastClusterRoleName(authz.Handler.FeatureStore)
320+
}
321+
322+
func GetFeastClusterRoleName(featureStore *feastdevv1alpha1.FeatureStore) string {
323+
return services.GetFeastName(featureStore) + "-cluster"
324+
}
325+
326+
func (authz *FeastAuthorization) getFeastClusterRoleBindingName() string {
327+
return GetFeastClusterRoleBindingName(authz.Handler.FeatureStore)
328+
}
329+
330+
func GetFeastClusterRoleBindingName(featureStore *feastdevv1alpha1.FeatureStore) string {
331+
return services.GetFeastName(featureStore) + "-cluster-binding"
332+
}
333+
334+
func (authz *FeastAuthorization) getFeastServiceAccountName() string {
335+
return services.GetFeastName(authz.Handler.FeatureStore)
336+
}

‎infra/feast-operator/internal/controller/featurestore_controller.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -59,9 +59,10 @@ type FeatureStoreReconciler struct {
5959
// +kubebuilder:rbac:groups=feast.dev,resources=featurestores/finalizers,verbs=update
6060
// +kubebuilder:rbac:groups=apps,resources=deployments,verbs=get;list;create;update;watch;delete
6161
// +kubebuilder:rbac:groups=core,resources=services;configmaps;persistentvolumeclaims;serviceaccounts,verbs=get;list;create;update;watch;delete
62-
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;create;update;watch;delete
63-
// +kubebuilder:rbac:groups=core,resources=secrets;pods,verbs=get;list
62+
// +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings;clusterroles;clusterrolebindings;subjectaccessreviews,verbs=get;list;create;update;watch;delete
63+
// +kubebuilder:rbac:groups=core,resources=secrets;pods;namespaces,verbs=get;list;watch
6464
// +kubebuilder:rbac:groups=core,resources=pods/exec,verbs=create
65+
// +kubebuilder:rbac:groups=authentication.k8s.io,resources=tokenreviews,verbs=create
6566
// +kubebuilder:rbac:groups=route.openshift.io,resources=routes,verbs=get;list;create;update;watch;delete
6667
// +kubebuilder:rbac:groups=batch,resources=cronjobs,verbs=get;list;watch;create;update;patch;delete
6768

0 commit comments

Comments
 (0)