feast-dev / feast-dev/feast

Deploying feature-server using feast-operator, some securityContext have no settings

Open
#6,750 0 comments 0 reactions 0 assignees View on GitHub
kind/feature
Dominant language
Python
Stars
7.3k
Forks
1.4k
Avg merge
1d 21h
Merged PRs (30d)
15

Description

**Is your feature request related to a problem? Please describe.**
When deploying the feature-server using the feast-operator, the generated UI, registry, and online pods do not have the securityContext settings 'AllowPrivilegeEscalation = false' and 'Capabilities.Drop=[ALL]'. The generated CronJob pods do not have the securityContext settings 'RunAsNonRoot=true' and 'SeccompRofile=RuntimeDefault'. In non-Openshift environments, the creation of RoleBinding cannot be skipped directly. Furthermore, the install.yaml cannot set these parameters at the container level. This prevents me from complying with stricter security policies in the Kubernetes cluster.

**Describe the solution you'd like**
If the above parameters cannot be added in the source code, can they be set in the template install.yaml of the featurestore?

**Describe alternatives you've considered**
modify the source code ,add the parameters and rebuild the operator image

**Additional context**
Our Kubernetes cluster security policy is more stringent, and containers without these settings cannot be deployed.

Contributor guide

Open the contributing guide

Research direction

Start by tracing how the feast-operator generates the UI, registry, online, and CronJob pods and how install.yaml configures the feature store. Check the generated pod security contexts and RoleBinding behavior in a non-OpenShift deployment; done means the requested settings can be configured or are applied consistently without requiring an image rebuild.

Written by the indexing model from the issue text.

Assessment

Tech stack
kubernetes, yaml
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.