Deploying feature-server using feast-operator, some securityContext have no settings
- Dominant language
- Python
- Stars
- 7.3k
- Forks
- 1.4k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 15
Description
**Is your feature request related to a problem? Please describe.**
When deploying the feature-server using the feast-operator, the generated UI, registry, and online pods do not have the securityContext settings 'AllowPrivilegeEscalation = false' and 'Capabilities.Drop=[ALL]'. The generated CronJob pods do not have the securityContext settings 'RunAsNonRoot=true' and 'SeccompRofile=RuntimeDefault'. In non-Openshift environments, the creation of RoleBinding cannot be skipped directly. Furthermore, the install.yaml cannot set these parameters at the container level. This prevents me from complying with stricter security policies in the Kubernetes cluster.
**Describe the solution you'd like**
If the above parameters cannot be added in the source code, can they be set in the template install.yaml of the featurestore?
**Describe alternatives you've considered**
modify the source code ,add the parameters and rebuild the operator image
**Additional context**
Our Kubernetes cluster security policy is more stringent, and containers without these settings cannot be deployed.
Contributor guide
Research direction
Start by tracing how the feast-operator generates the UI, registry, online, and CronJob pods and how install.yaml configures the feature store. Check the generated pod security contexts and RoleBinding behavior in a non-OpenShift deployment; done means the requested settings can be configured or are applied consistently without requiring an image rebuild.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kubernetes, yaml
- Domain
- devops, infrastructure, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100