Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add TLS support to the Operator #4770

Closed
tchughesiv opened this issue Nov 19, 2024 · 0 comments · Fixed by #4796
Closed

Add TLS support to the Operator #4770

tchughesiv opened this issue Nov 19, 2024 · 0 comments · Fixed by #4796
Labels
kind/feature New feature or request

Comments

@tchughesiv
Copy link
Contributor

tchughesiv commented Nov 19, 2024

Is your feature request related to a problem? Please describe.
An Operator user should be able to configure feast with TLS.

Describe the solution you'd like
When configured, TLS will be enabled for that feast service. If the operator detects it's running in an OpenShift cluster, we enable TLS by default because we can leverage the built-in service serving certificate feature.

apiVersion: feast.dev/v1alpha1
kind: FeatureStore
metadata:
  name: example
  namespace: <namespace>
spec:
  feastProject: test
  services:
    <feast_service_type>: // e.g. offlineStore, onlineStore, registry 
      // add CRD validation that requires `secretRef` to be set if `disable` is false.
      tls: // optional ... enabled by default when deployed to an OpenShift cluster. if user leaves tls undefined, the operator assumes tls should be enabled and uses built-in service serving certificate feature.
        secretRef: // required if tls.disable is false
          name: <string> // required
        secretKeyNames: // optional
          tlsCrt: <string> // optional (defaults to tls.crt)
          tlsKey: <string> // optional (defaults to tls.key)
        verifyClient: <bool> // optional (defaults to false) currently only used with offline server
        disable: <bool> // optional (defaults to false) allows the user to disable tls without removing the TLS settings. one scenario in which this is beneficial would be in openshift, where we default to tls being enabled

Additional context
References for implementation -

https://github.com/feast-dev/feast/blob/master/docs/how-to-guides/starting-feast-servers-tls-mode.md

https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/

https://docs.openshift.com/container-platform/4.17/security/certificates/service-serving-certificate.html

#4677

#4744

#4718

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature New feature or request
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant