Skip to content

Commit 6a2995e

Browse files
jyejarejyejare
committed
fix: Harden informer cache with label selectors and memory optimizations
Signed-off-by: Jitendra Yejare <[email protected]>
1 parent beaa9a6 commit 6a2995e

9 files changed

Lines changed: 83 additions & 14 deletions

File tree

‎infra/feast-operator/cmd/main.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,18 @@ import (
2525
// to ensure that exec-entrypoint and run can make use of them.
2626
_ "k8s.io/client-go/plugin/pkg/client/auth"
2727

28+
appsv1 "k8s.io/api/apps/v1"
29+
autoscalingv2 "k8s.io/api/autoscaling/v2"
30+
batchv1 "k8s.io/api/batch/v1"
2831
corev1 "k8s.io/api/core/v1"
32+
policyv1 "k8s.io/api/policy/v1"
33+
rbacv1 "k8s.io/api/rbac/v1"
34+
"k8s.io/apimachinery/pkg/labels"
2935
"k8s.io/apimachinery/pkg/runtime"
3036
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
3137
clientgoscheme "k8s.io/client-go/kubernetes/scheme"
3238
ctrl "sigs.k8s.io/controller-runtime"
39+
"sigs.k8s.io/controller-runtime/pkg/cache"
3340
"sigs.k8s.io/controller-runtime/pkg/client"
3441
"sigs.k8s.io/controller-runtime/pkg/healthz"
3542
"sigs.k8s.io/controller-runtime/pkg/log/zap"
@@ -59,6 +66,29 @@ func init() {
5966
// +kubebuilder:scaffold:scheme
6067
}
6168

69+
func newCacheOptions() cache.Options {
70+
managedBySelector := labels.SelectorFromSet(labels.Set{
71+
services.ManagedByLabelKey: services.ManagedByLabelValue,
72+
})
73+
managedByFilter := cache.ByObject{Label: managedBySelector}
74+
75+
return cache.Options{
76+
DefaultTransform: cache.TransformStripManagedFields(),
77+
ByObject: map[client.Object]cache.ByObject{
78+
&corev1.ConfigMap{}: managedByFilter,
79+
&appsv1.Deployment{}: managedByFilter,
80+
&corev1.Service{}: managedByFilter,
81+
&corev1.ServiceAccount{}: managedByFilter,
82+
&corev1.PersistentVolumeClaim{}: managedByFilter,
83+
&rbacv1.RoleBinding{}: managedByFilter,
84+
&rbacv1.Role{}: managedByFilter,
85+
&batchv1.CronJob{}: managedByFilter,
86+
&autoscalingv2.HorizontalPodAutoscaler{}: managedByFilter,
87+
&policyv1.PodDisruptionBudget{}: managedByFilter,
88+
},
89+
}
90+
}
91+
6292
func main() {
6393
var metricsAddr string
6494
var enableLeaderElection bool
@@ -145,6 +175,7 @@ func main() {
145175
// if you are doing or is intended to do any operation such as perform cleanups
146176
// after the manager stops then its usage might be unsafe.
147177
// LeaderElectionReleaseOnCancel: true,
178+
Cache: newCacheOptions(),
148179
Client: client.Options{
149180
Cache: &client.CacheOptions{
150181
DisableFor: []client.Object{

‎infra/feast-operator/config/default/related_image_fs_patch.tmpl‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
1+
- op: test
2+
path: "/spec/template/spec/containers/0/env/1/name"
3+
value: RELATED_IMAGE_FEATURE_SERVER
14
- op: replace
2-
path: "/spec/template/spec/containers/0/env/0"
5+
path: "/spec/template/spec/containers/0/env/1"
36
value:
47
name: RELATED_IMAGE_FEATURE_SERVER
58
value: ${FS_IMG}
9+
- op: test
10+
path: "/spec/template/spec/containers/0/env/2/name"
11+
value: RELATED_IMAGE_CRON_JOB
612
- op: replace
7-
path: "/spec/template/spec/containers/0/env/1"
13+
path: "/spec/template/spec/containers/0/env/2"
814
value:
915
name: RELATED_IMAGE_CRON_JOB
1016
value: ${CJ_IMG}

‎infra/feast-operator/config/default/related_image_fs_patch.yaml‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,16 @@
1+
- op: test
2+
path: "/spec/template/spec/containers/0/env/1/name"
3+
value: RELATED_IMAGE_FEATURE_SERVER
14
- op: replace
2-
path: "/spec/template/spec/containers/0/env/0"
5+
path: "/spec/template/spec/containers/0/env/1"
36
value:
47
name: RELATED_IMAGE_FEATURE_SERVER
58
value: quay.io/feastdev/feature-server:0.62.0
9+
- op: test
10+
path: "/spec/template/spec/containers/0/env/2/name"
11+
value: RELATED_IMAGE_CRON_JOB
612
- op: replace
7-
path: "/spec/template/spec/containers/0/env/1"
13+
path: "/spec/template/spec/containers/0/env/2"
814
value:
915
name: RELATED_IMAGE_CRON_JOB
1016
value: quay.io/openshift/origin-cli:4.17

‎infra/feast-operator/config/manager/manager.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -73,6 +73,8 @@ spec:
7373
drop:
7474
- "ALL"
7575
env:
76+
- name: GOMEMLIMIT
77+
value: "230MiB"
7678
- name: RELATED_IMAGE_FEATURE_SERVER
7779
value: feast:latest
7880
- name: RELATED_IMAGE_CRON_JOB

‎infra/feast-operator/dist/install.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20650,6 +20650,8 @@ spec:
2065020650
command:
2065120651
- /manager
2065220652
env:
20653+
- name: GOMEMLIMIT
20654+
value: 230MiB
2065320655
- name: RELATED_IMAGE_FEATURE_SERVER
2065420656
value: quay.io/feastdev/feature-server:0.62.0
2065520657
- name: RELATED_IMAGE_CRON_JOB

‎infra/feast-operator/internal/controller/authz/authz.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -331,6 +331,7 @@ func (authz *FeastAuthorization) getLabels() map[string]string {
331331
return map[string]string{
332332
services.NameLabelKey: authz.Handler.FeatureStore.Name,
333333
services.ServiceTypeLabelKey: string(services.AuthzFeastType),
334+
services.ManagedByLabelKey: services.ManagedByLabelValue,
334335
}
335336
}
336337

‎infra/feast-operator/internal/controller/services/namespace_registry.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -179,6 +179,7 @@ func (feast *FeastServices) setNamespaceRegistryRoleBinding(rb *rbacv1.RoleBindi
179179
ObjectMeta: metav1.ObjectMeta{
180180
Name: roleName,
181181
Namespace: rb.Namespace,
182+
Labels: feast.getLabels(),
182183
},
183184
}
184185
role.Rules = desiredRules
@@ -205,6 +206,7 @@ func (feast *FeastServices) setNamespaceRegistryRoleBinding(rb *rbacv1.RoleBindi
205206
}
206207
}
207208

209+
rb.Labels = feast.getLabels()
208210
rb.RoleRef = rbacv1.RoleRef{
209211
APIGroup: "rbac.authorization.k8s.io",
210212
Kind: "Role",

‎infra/feast-operator/internal/controller/services/services.go‎

Lines changed: 24 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -408,9 +408,10 @@ func (feast *FeastServices) setDeployment(deploy *appsv1.Deployment) error {
408408
}
409409

410410
deploy.Labels = feast.getLabels()
411+
selectorLabels := feast.getSelectorLabels()
411412
deploy.Spec = appsv1.DeploymentSpec{
412413
Replicas: replicas,
413-
Selector: metav1.SetAsLabelSelector(deploy.GetLabels()),
414+
Selector: metav1.SetAsLabelSelector(selectorLabels),
414415
Strategy: feast.getDeploymentStrategy(),
415416
Template: corev1.PodTemplateSpec{
416417
ObjectMeta: metav1.ObjectMeta{
@@ -818,7 +819,7 @@ func (feast *FeastServices) setService(svc *corev1.Service, feastType FeastServi
818819
}
819820

820821
svc.Spec = corev1.ServiceSpec{
821-
Selector: feast.getLabels(),
822+
Selector: feast.getSelectorLabels(),
822823
Type: corev1.ServiceTypeClusterIP,
823824
Ports: []corev1.ServicePort{
824825
{
@@ -868,6 +869,7 @@ func (feast *FeastServices) setServiceAccount(sa *corev1.ServiceAccount) error {
868869

869870
func (feast *FeastServices) createNewPVC(pvcCreate *feastdevv1.PvcCreate, feastType FeastServiceType) (*corev1.PersistentVolumeClaim, error) {
870871
pvc := feast.initPVC(feastType)
872+
pvc.Labels = feast.getFeastTypeLabels(feastType)
871873

872874
pvc.Spec = corev1.PersistentVolumeClaimSpec{
873875
AccessModes: pvcCreate.AccessModes,
@@ -976,7 +978,7 @@ func (feast *FeastServices) applyTopologySpread(podSpec *corev1.PodSpec) {
976978
MaxSkew: 1,
977979
TopologyKey: "topology.kubernetes.io/zone",
978980
WhenUnsatisfiable: corev1.ScheduleAnyway,
979-
LabelSelector: metav1.SetAsLabelSelector(feast.getLabels()),
981+
LabelSelector: metav1.SetAsLabelSelector(feast.getSelectorLabels()),
980982
}}
981983
}
982984

@@ -999,10 +1001,10 @@ func (feast *FeastServices) applyAffinity(podSpec *corev1.PodSpec) {
9991001
Weight: 100,
10001002
PodAffinityTerm: corev1.PodAffinityTerm{
10011003
TopologyKey: "kubernetes.io/hostname",
1002-
LabelSelector: metav1.SetAsLabelSelector(feast.getLabels()),
1003-
},
1004-
}},
1005-
},
1004+
LabelSelector: metav1.SetAsLabelSelector(feast.getSelectorLabels()),
1005+
},
1006+
}},
1007+
},
10061008
}
10071009
}
10081010

@@ -1060,12 +1062,24 @@ func (feast *FeastServices) getFeastTypeLabels(feastType FeastServiceType) map[s
10601062
return labels
10611063
}
10621064

1063-
func (feast *FeastServices) getLabels() map[string]string {
1065+
// getSelectorLabels returns the minimal label set used for immutable selectors
1066+
// (Deployment spec.selector, Service spec.selector, TopologySpreadConstraints, PodAffinity).
1067+
// This must NOT change after initial resource creation.
1068+
func (feast *FeastServices) getSelectorLabels() map[string]string {
10641069
return map[string]string{
10651070
NameLabelKey: feast.Handler.FeatureStore.Name,
10661071
}
10671072
}
10681073

1074+
// getLabels returns the full label set for mutable metadata (ObjectMeta.Labels).
1075+
// Includes the managed-by label used by the informer cache filter.
1076+
func (feast *FeastServices) getLabels() map[string]string {
1077+
return map[string]string{
1078+
NameLabelKey: feast.Handler.FeatureStore.Name,
1079+
ManagedByLabelKey: ManagedByLabelValue,
1080+
}
1081+
}
1082+
10691083
func (feast *FeastServices) setServiceHostnames() error {
10701084
feast.Handler.FeatureStore.Status.ServiceHostnames = feastdevv1.ServiceHostnames{}
10711085
domain := svcDomain + ":"
@@ -1438,10 +1452,10 @@ func IsDeploymentAvailable(conditions []appsv1.DeploymentCondition) bool {
14381452
// container that is in a failing state. Returns empty string if no failure found.
14391453
func (feast *FeastServices) GetPodContainerFailureMessage(deploy appsv1.Deployment) string {
14401454
podList := corev1.PodList{}
1441-
labels := feast.getLabels()
1455+
selectorLabels := feast.getSelectorLabels()
14421456
if err := feast.Handler.Client.List(feast.Handler.Context, &podList,
14431457
client.InNamespace(deploy.Namespace),
1444-
client.MatchingLabels(labels),
1458+
client.MatchingLabels(selectorLabels),
14451459
); err != nil {
14461460
return ""
14471461
}

‎infra/feast-operator/internal/controller/services/services_types.go‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,11 @@ const (
103103
OidcMissingSecretError string = "missing OIDC secret: %s"
104104
)
105105

106+
const (
107+
ManagedByLabelKey = "app.kubernetes.io/managed-by"
108+
ManagedByLabelValue = "feast-operator"
109+
)
110+
106111
var (
107112
DefaultImage = "quay.io/feastdev/feature-server:" + feastversion.FeastVersion
108113
DefaultCronJobImage = "quay.io/openshift/origin-cli:4.17"

0 commit comments

Comments
 (0)