feat(operator): Auto-create RBAC for spark_application batch engine#6597
Merged
ntkathole merged 8 commits intoJul 18, 2026
Merged
Conversation
Reconcile server/driver Roles from an embedded YAML template so FeatureStore materialization works without manual SA/Role setup. Widen the operator ClusterRole only as needed to grant those permissions (including deletecollection for Spark driver cleanup). Signed-off-by: Aniket Paluskar <[email protected]>
aniketpalu
added a commit
to aniketpalu/feast
that referenced
this pull request
Jul 14, 2026
aniketpalu
added a commit
to aniketpalu/feast
that referenced
this pull request
Jul 14, 2026
When batch_engine.service_account is omitted, inject feast-<cr>-batch-driver so the SparkApplication matches the SA/RBAC the operator already creates (R2-2). Co-authored-by: Cursor <[email protected]> Signed-off-by: Aniket Paluskar <[email protected]>
Limit service_account baking to spark_application so other batch engines are not given an unexpected parameter. Signed-off-by: Aniket Paluskar <[email protected]>
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #6597 +/- ##
=======================================
Coverage 45.64% 45.64%
=======================================
Files 412 412
Lines 48761 48761
Branches 6913 6913
=======================================
Hits 22257 22257
Misses 24957 24957
Partials 1547 1547
Continue to review full report in Codecov by Harness.
🚀 New features to boost your workflow:
|
aniketpalu
added a commit
to aniketpalu/feast
that referenced
this pull request
Jul 16, 2026
… merged-spark-e2e Includes spark_application-only SA bake-in.
gofmt repo_config_test map literals and refresh .secrets.baseline line numbers after batch-engine RBAC wiring in services.go. Signed-off-by: Aniket Paluskar <[email protected]>
ntkathole
reviewed
Jul 17, 2026
| } | ||
|
|
||
| if tmpl.Driver != nil { | ||
| driverSAName := feast.getBatchDriverSAName() |
Member
There was a problem hiding this comment.
getBatchEngineType() and getBatchDriverSAName() independently fetch and parse the same ConfigMap during a single reconcile. Should parse once and pass the result.
Share getBatchEngineConfig() for engine type and driver SA resolution instead of fetching/parsing the same ConfigMap twice. Signed-off-by: Aniket Paluskar <[email protected]>
ntkathole
approved these changes
Jul 18, 2026
aniketpalu
added a commit
to aniketpalu/feast
that referenced
this pull request
Jul 18, 2026
Pick up feast-dev#6597 (operator batch-engine RBAC) and Iceberg REST catalog.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this PR does / why we need it:
When
batch_engine: spark_applicationis configured, the Feast Operator creates a bare ServiceAccount with no Roles/RoleBindings. Materialization then fails with403 Forbiddenuntil users manually create server + driver RBAC.This PR makes the operator auto-reconcile that RBAC from an embedded YAML template, and ensures the Spark driver uses the same ServiceAccount the operator creates.
Changes
Auto-create batch-engine RBAC (
batch_engine_rbac.go+rbac_templates/spark_application.yaml)feast-<name>: ConfigMaps, SparkApplications, pods list, pods/logfeast-<name>-batch-driverby default): pods/services/configmaps/PVCs (incl.deletecollection) for Spark driver executor lifecycleMinimal operator ClusterRole widening (kubebuilder markers →
role.yaml/ CSV / install)sparkoperator.k8s.io/sparkapplications: create/get/deletepods/log: getdeletecollection)secretswideningBake default driver
service_accountintofeature_store.yamlservice_account, injectfeast-<FeatureStoreName>-batch-driverservice_accountoverrides are preservedtype: spark_applicationso other engines are unchangedDesign notes
ray,k8s) can add a YAML file without new Go reconcile logicWhich issue(s) this PR fixes:
Related to the same class of gap as #6408 (KubeRay RBAC). Enables zero-manual-RBAC materialization for
spark_application.Checks
git commit -s)Testing Strategy
Manual (OpenShift E2E)
batch_engine: spark_application(ConfigMap omittingservice_account)feast-<name>-batch-engine+feast-<name>-batch-driverRole/RoleBinding/SAservice_account: feast-<name>-batch-driverMisc