Skip to content

Commit 79fa247

Browse files
tchughesivtchughesiv
authored
fix: Remove verifyClient TLS offlineStore option from the Operator (feast-dev#4847)
remove verifyClient TLS option Signed-off-by: Tommy Hughes <tohughes@redhat.com>
1 parent 8320e23 commit 79fa247

File tree

9 files changed

+29
-99
lines changed

9 files changed

+29
-99
lines changed

‎infra/feast-operator/api/v1alpha1/featurestore_types.go

+1-8
Original file line numberDiff line numberDiff line change
@@ -76,20 +76,13 @@ type FeatureStoreServices struct {
7676
type OfflineStore struct {
7777
StoreServiceConfigs `json:",inline"`
7878
Persistence *OfflineStorePersistence `json:"persistence,omitempty"`
79-
TLS *OfflineTlsConfigs `json:"tls,omitempty"`
79+
TLS *TlsConfigs `json:"tls,omitempty"`
8080
// LogLevel sets the logging level for the offline store service
8181
// Allowed values: "debug", "info", "warning", "error", "critical".
8282
// +kubebuilder:validation:Enum=debug;info;warning;error;critical
8383
LogLevel string `json:"logLevel,omitempty"`
8484
}
8585

86-
// OfflineTlsConfigs configures server TLS for the offline feast service. in an openshift cluster, this is configured by default using service serving certificates.
87-
type OfflineTlsConfigs struct {
88-
TlsConfigs `json:",inline"`
89-
// verify the client TLS certificate.
90-
VerifyClient *bool `json:"verifyClient,omitempty"`
91-
}
92-
9386
// OfflineStorePersistence configures the persistence settings for the offline store service
9487
// +kubebuilder:validation:XValidation:rule="[has(self.file), has(self.store)].exists_one(c, c)",message="One selection required between file or store."
9588
type OfflineStorePersistence struct {

‎infra/feast-operator/api/v1alpha1/zz_generated.deepcopy.go

+1-22
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎infra/feast-operator/config/crd/bases/feast.dev_featurestores.yaml

+6-13
Original file line numberDiff line numberDiff line change
@@ -432,9 +432,9 @@ spec:
432432
type: object
433433
type: object
434434
tls:
435-
description: OfflineTlsConfigs configures server TLS for the
436-
offline feast service. in an openshift cluster, this is
437-
configured by default using service serving certificates.
435+
description: TlsConfigs configures server TLS for a feast
436+
service. in an openshift cluster, this is configured by
437+
default using service serving certificates.
438438
properties:
439439
disable:
440440
description: will disable TLS for the feast service. useful
@@ -464,9 +464,6 @@ spec:
464464
type: string
465465
type: object
466466
x-kubernetes-map-type: atomic
467-
verifyClient:
468-
description: verify the client TLS certificate.
469-
type: boolean
470467
type: object
471468
x-kubernetes-validations:
472469
- message: '`secretRef` required if `disable` is false.'
@@ -1690,10 +1687,9 @@ spec:
16901687
type: object
16911688
type: object
16921689
tls:
1693-
description: OfflineTlsConfigs configures server TLS for
1694-
the offline feast service. in an openshift cluster,
1695-
this is configured by default using service serving
1696-
certificates.
1690+
description: TlsConfigs configures server TLS for a feast
1691+
service. in an openshift cluster, this is configured
1692+
by default using service serving certificates.
16971693
properties:
16981694
disable:
16991695
description: will disable TLS for the feast service.
@@ -1723,9 +1719,6 @@ spec:
17231719
type: string
17241720
type: object
17251721
x-kubernetes-map-type: atomic
1726-
verifyClient:
1727-
description: verify the client TLS certificate.
1728-
type: boolean
17291722
type: object
17301723
x-kubernetes-validations:
17311724
- message: '`secretRef` required if `disable` is false.'

‎infra/feast-operator/dist/install.yaml

+6-13
Original file line numberDiff line numberDiff line change
@@ -440,9 +440,9 @@ spec:
440440
type: object
441441
type: object
442442
tls:
443-
description: OfflineTlsConfigs configures server TLS for the
444-
offline feast service. in an openshift cluster, this is
445-
configured by default using service serving certificates.
443+
description: TlsConfigs configures server TLS for a feast
444+
service. in an openshift cluster, this is configured by
445+
default using service serving certificates.
446446
properties:
447447
disable:
448448
description: will disable TLS for the feast service. useful
@@ -472,9 +472,6 @@ spec:
472472
type: string
473473
type: object
474474
x-kubernetes-map-type: atomic
475-
verifyClient:
476-
description: verify the client TLS certificate.
477-
type: boolean
478475
type: object
479476
x-kubernetes-validations:
480477
- message: '`secretRef` required if `disable` is false.'
@@ -1698,10 +1695,9 @@ spec:
16981695
type: object
16991696
type: object
17001697
tls:
1701-
description: OfflineTlsConfigs configures server TLS for
1702-
the offline feast service. in an openshift cluster,
1703-
this is configured by default using service serving
1704-
certificates.
1698+
description: TlsConfigs configures server TLS for a feast
1699+
service. in an openshift cluster, this is configured
1700+
by default using service serving certificates.
17051701
properties:
17061702
disable:
17071703
description: will disable TLS for the feast service.
@@ -1731,9 +1727,6 @@ spec:
17311727
type: string
17321728
type: object
17331729
x-kubernetes-map-type: atomic
1734-
verifyClient:
1735-
description: verify the client TLS certificate.
1736-
type: boolean
17371730
type: object
17381731
x-kubernetes-validations:
17391732
- message: '`secretRef` required if `disable` is false.'

‎infra/feast-operator/internal/controller/featurestore_controller_tls_test.go

+5-9
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
5656
}
5757
featurestore := &feastdevv1alpha1.FeatureStore{}
5858
localRef := corev1.LocalObjectReference{Name: "test"}
59-
tlsConfigs := feastdevv1alpha1.TlsConfigs{
59+
tlsConfigs := &feastdevv1alpha1.TlsConfigs{
6060
SecretRef: &localRef,
6161
}
6262
BeforeEach(func() {
@@ -72,16 +72,14 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
7272
FeastProject: feastProject,
7373
Services: &feastdevv1alpha1.FeatureStoreServices{
7474
OnlineStore: &feastdevv1alpha1.OnlineStore{
75-
TLS: &tlsConfigs,
75+
TLS: tlsConfigs,
7676
},
7777
OfflineStore: &feastdevv1alpha1.OfflineStore{
78-
TLS: &feastdevv1alpha1.OfflineTlsConfigs{
79-
TlsConfigs: tlsConfigs,
80-
},
78+
TLS: tlsConfigs,
8179
},
8280
Registry: &feastdevv1alpha1.Registry{
8381
Local: &feastdevv1alpha1.LocalRegistryConfig{
84-
TLS: &tlsConfigs,
82+
TLS: tlsConfigs,
8583
},
8684
},
8785
},
@@ -396,9 +394,7 @@ var _ = Describe("FeatureStore Controller - Feast service TLS", func() {
396394
},
397395
},
398396
OfflineStore: &feastdevv1alpha1.OfflineStore{
399-
TLS: &feastdevv1alpha1.OfflineTlsConfigs{
400-
TlsConfigs: tlsConfigs,
401-
},
397+
TLS: tlsConfigs,
402398
},
403399
Registry: &feastdevv1alpha1.Registry{
404400
Remote: &feastdevv1alpha1.RemoteRegistryConfig{

‎infra/feast-operator/internal/controller/services/repo_config.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -248,9 +248,8 @@ func getClientRepoConfig(
248248
Host: strings.Split(status.ServiceHostnames.OfflineStore, ":")[0],
249249
Port: HttpPort,
250250
}
251-
if appliedServices.OfflineStore != nil && appliedServices.OfflineStore.TLS != nil &&
252-
(&appliedServices.OfflineStore.TLS.TlsConfigs).IsTLS() {
253-
clientRepoConfig.OfflineStore.Cert = GetTlsPath(OfflineFeastType) + appliedServices.OfflineStore.TLS.TlsConfigs.SecretKeyNames.TlsCrt
251+
if appliedServices.OfflineStore != nil && appliedServices.OfflineStore.TLS.IsTLS() {
252+
clientRepoConfig.OfflineStore.Cert = GetTlsPath(OfflineFeastType) + appliedServices.OfflineStore.TLS.SecretKeyNames.TlsCrt
254253
clientRepoConfig.OfflineStore.Port = HttpsPort
255254
clientRepoConfig.OfflineStore.Scheme = HttpsScheme
256255
}

‎infra/feast-operator/internal/controller/services/services.go

+2-12
Original file line numberDiff line numberDiff line change
@@ -373,13 +373,6 @@ func (feast *FeastServices) getContainerCommand(feastType FeastServiceType) []st
373373
}
374374
deploySettings.Args = append(deploySettings.Args, []string{"-p", strconv.Itoa(int(targetPort))}...)
375375

376-
if feastType == OfflineFeastType {
377-
if tls.IsTLS() && feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS.VerifyClient != nil {
378-
deploySettings.Args = append(deploySettings.Args,
379-
[]string{"--verify_client", strconv.FormatBool(*feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS.VerifyClient)}...)
380-
}
381-
}
382-
383376
// Combine base command, options, and arguments
384377
feastCommand := append([]string{baseCommand}, options...)
385378
feastCommand = append(feastCommand, deploySettings.Args...)
@@ -549,11 +542,8 @@ func (feast *FeastServices) setServiceHostnames() error {
549542
domain := svcDomain + ":"
550543
if feast.isOfflinStore() {
551544
objMeta := feast.GetObjectMeta(OfflineFeastType)
552-
port := strconv.Itoa(HttpPort)
553-
if feast.offlineTls() {
554-
port = strconv.Itoa(HttpsPort)
555-
}
556-
feast.Handler.FeatureStore.Status.ServiceHostnames.OfflineStore = objMeta.Name + "." + objMeta.Namespace + domain + port
545+
feast.Handler.FeatureStore.Status.ServiceHostnames.OfflineStore = objMeta.Name + "." + objMeta.Namespace + domain +
546+
getPortStr(feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS)
557547
}
558548
if feast.isOnlinStore() {
559549
objMeta := feast.GetObjectMeta(OnlineFeastType)

‎infra/feast-operator/internal/controller/services/tls.go

+6-14
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ func (feast *FeastServices) setTlsDefaults() error {
2929
}
3030
appliedServices := feast.Handler.FeatureStore.Status.Applied.Services
3131
if feast.isOfflinStore() && appliedServices.OfflineStore.TLS != nil {
32-
tlsDefaults(&appliedServices.OfflineStore.TLS.TlsConfigs)
32+
tlsDefaults(appliedServices.OfflineStore.TLS)
3333
}
3434
if feast.isOnlinStore() {
3535
tlsDefaults(appliedServices.OnlineStore.TLS)
@@ -43,11 +43,9 @@ func (feast *FeastServices) setTlsDefaults() error {
4343
func (feast *FeastServices) setOpenshiftTls() error {
4444
appliedServices := feast.Handler.FeatureStore.Status.Applied.Services
4545
if feast.offlineOpenshiftTls() {
46-
appliedServices.OfflineStore.TLS = &feastdevv1alpha1.OfflineTlsConfigs{
47-
TlsConfigs: feastdevv1alpha1.TlsConfigs{
48-
SecretRef: &corev1.LocalObjectReference{
49-
Name: feast.initFeastSvc(OfflineFeastType).Name + tlsNameSuffix,
50-
},
46+
appliedServices.OfflineStore.TLS = &feastdevv1alpha1.TlsConfigs{
47+
SecretRef: &corev1.LocalObjectReference{
48+
Name: feast.initFeastSvc(OfflineFeastType).Name + tlsNameSuffix,
5149
},
5250
}
5351
}
@@ -103,8 +101,8 @@ func (feast *FeastServices) getTlsConfigs(feastType FeastServiceType) (tls *feas
103101
appliedServices := feast.Handler.FeatureStore.Status.Applied.Services
104102
switch feastType {
105103
case OfflineFeastType:
106-
if feast.isOfflinStore() && appliedServices.OfflineStore.TLS != nil {
107-
tls = &appliedServices.OfflineStore.TLS.TlsConfigs
104+
if feast.isOfflinStore() {
105+
tls = appliedServices.OfflineStore.TLS
108106
}
109107
case OnlineFeastType:
110108
if feast.isOnlinStore() {
@@ -154,12 +152,6 @@ func (feast *FeastServices) remoteRegistryOpenshiftTls() (bool, error) {
154152
return false, nil
155153
}
156154

157-
func (feast *FeastServices) offlineTls() bool {
158-
return feast.isOfflinStore() &&
159-
feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS != nil &&
160-
(&feast.Handler.FeatureStore.Status.Applied.Services.OfflineStore.TLS.TlsConfigs).IsTLS()
161-
}
162-
163155
func (feast *FeastServices) localRegistryTls() bool {
164156
return localRegistryTls(feast.Handler.FeatureStore)
165157
}

‎infra/feast-operator/internal/controller/services/tls_test.go

-5
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,6 @@ var _ = Describe("TLS Config", func() {
5858
Expect(tls.IsTLS()).To(BeFalse())
5959
Expect(getPortStr(tls)).To(Equal("80"))
6060

61-
Expect(feast.offlineTls()).To(BeFalse())
6261
Expect(feast.remoteRegistryTls()).To(BeFalse())
6362
Expect(feast.localRegistryTls()).To(BeFalse())
6463
Expect(feast.isOpenShiftTls(OfflineFeastType)).To(BeFalse())
@@ -87,7 +86,6 @@ var _ = Describe("TLS Config", func() {
8786
Expect(getPortStr(tls)).To(Equal("443"))
8887
Expect(GetTlsPath(RegistryFeastType)).To(Equal("/tls/registry/"))
8988

90-
Expect(feast.offlineTls()).To(BeFalse())
9189
Expect(feast.remoteRegistryTls()).To(BeFalse())
9290
Expect(feast.localRegistryTls()).To(BeTrue())
9391
Expect(feast.isOpenShiftTls(OfflineFeastType)).To(BeFalse())
@@ -127,7 +125,6 @@ var _ = Describe("TLS Config", func() {
127125
Expect(tls.SecretKeyNames).To(Equal(secretKeyNames))
128126
Expect(tls.IsTLS()).To(BeTrue())
129127

130-
Expect(feast.offlineTls()).To(BeTrue())
131128
Expect(feast.remoteRegistryTls()).To(BeFalse())
132129
Expect(feast.localRegistryTls()).To(BeTrue())
133130
Expect(feast.isOpenShiftTls(OfflineFeastType)).To(BeTrue())
@@ -189,7 +186,6 @@ var _ = Describe("TLS Config", func() {
189186
Expect(getPortStr(tls)).To(Equal("443"))
190187
Expect(GetTlsPath(RegistryFeastType)).To(Equal("/tls/registry/"))
191188

192-
Expect(feast.offlineTls()).To(BeFalse())
193189
Expect(feast.remoteRegistryTls()).To(BeFalse())
194190
Expect(feast.localRegistryTls()).To(BeTrue())
195191
Expect(feast.isOpenShiftTls(OfflineFeastType)).To(BeFalse())
@@ -238,7 +234,6 @@ var _ = Describe("TLS Config", func() {
238234
Expect(getPortStr(tls)).To(Equal("80"))
239235
Expect(GetTlsPath(RegistryFeastType)).To(Equal("/tls/registry/"))
240236

241-
Expect(feast.offlineTls()).To(BeTrue())
242237
Expect(feast.remoteRegistryTls()).To(BeFalse())
243238
Expect(feast.localRegistryTls()).To(BeFalse())
244239
Expect(feast.isOpenShiftTls(OfflineFeastType)).To(BeTrue())

0 commit comments

Comments
 (0)