feat: RBAC Authorization in Feast Operator

[dmartinol]

What this PR does / why we need it:

Adding support to define the kubernetes authorization manager with the Feast Operator.

• All services are configured to adopt this authorization manager.
• Services runs with a ServiceAccount that is bound to a newly created Role allowing to get, list, watch the other Roles and RoleBindings in the same namespace.
• Admins are not requested to perform any manual configuration once the custom resource is installed.

Sample manifest to configure the deployments:

apiVersion: feast.dev/v1alpha1
kind: FeatureStore
metadata:
  name: sample-kubernetes-auth
spec:
  feastProject: my_project
  services:
    onlineStore: {}
    offlineStore: {}
    registry: {}
  authz:
    kubernetes:
      roles:
        - reader
        - writer

Which issue(s) this PR fixes:

Relates to #4765
Next PR will add support for the OIDC authorization.

[dmartinol]

@tchughesiv @redhatHameed @tmihalac

[tchughesiv]

thanks for this! only a few nits so far

[tchughesiv]

a few nits ... otherwise lgtm

[dmartinol]

@feast-dev/reviewers-and-approvers please TAL

[redhatHameed]

@dmartinol I am document this feature using operator, what is the usage of the roles here what if the client application deployed in different namespace ?

[dmartinol]

@dmartinol I am document this feature using operator, what is the usage of the roles here what if the client application deployed in different namespace ?

The RBAC policy checks that the role, in the Feast namespace, is bound to the SA in the client namespace. This is how it works

[redhatHameed]

@dmartinol I am document this feature using operator, what is the usage of the roles here what if the client application deployed in different namespace ?

The RBAC policy checks that the role, in the Feast namespace, is bound to the SA in the client namespace. This is how it works

but as per the example these role are created as namespace scope. How it will be bind the client namespace SA ?

let suppose I have installed feast using operator in namespace feast and I have client namespace
called feast-client how we will bind these role in this namespace with SA ?

[tchughesiv]

@redhatHameed here's how you'd create a roleBinding for an SA in another ns -

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: feast-authz-client
  namespace: feast
subjects:
  - kind: ServiceAccount
    name: feast-sample-client
    namespace: feast-client
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: feast-sample-kubernetes-auth

[tchughesiv]

@redhatHameed here's how you'd create the same binding via command-line -

$ kubectl create rolebinding feast-authz-client -n feast --role=feast-sample-kubernetes-auth --serviceaccount=feast-client:feast-sample-client

[redhatHameed]

@tchughesiv @dmartinol let me try with this. Thanks

[dmartinol]

@redhatHameed here's how you'd create a roleBinding for an SA in another ns -

kind: RoleBinding
apiVersion: rbac.authorization.k8s.io/v1
metadata:
  name: feast-authz-client
  namespace: feast
subjects:
  - kind: ServiceAccount
    name: feast-sample-client
    namespace: feast-client
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: feast-sample-kubernetes-auth

Thanks @tchughesiv i was replying the same 👏