feast-dev · jyejare · Jun 24, 2025 · Jun 25, 2025 · Jun 26, 2025 · Jun 27, 2025
diff --git a/.secrets.baseline b/.secrets.baseline
@@ -1156,7 +1156,7 @@
         "filename": "infra/feast-operator/internal/controller/services/services.go",
         "hashed_secret": "36dc326eb15c7bdd8d91a6b87905bcea20b637d1",
         "is_verified": false,
-        "line_number": 179
+        "line_number": 184
       }
     ],
     "infra/feast-operator/internal/controller/services/tls_test.go": [
@@ -1539,5 +1539,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-18T13:51:43Z"
+  "generated_at": "2026-03-26T14:12:54Z"
 }
@@ -17,22 +17,39 @@ limitations under the License.
 package main
 
 import (
+	"context"
 	"crypto/tls"
 	"flag"
+	"fmt"
 	"os"
+	"strings"
+	"time"
 
 	// Import all Kubernetes client auth plugins (e.g. Azure, GCP, OIDC, etc.)
 	// to ensure that exec-entrypoint and run can make use of them.
 	_ "k8s.io/client-go/plugin/pkg/client/auth"
 
+	appsv1 "k8s.io/api/apps/v1"
+	autoscalingv2 "k8s.io/api/autoscaling/v2"
+	batchv1 "k8s.io/api/batch/v1"
 	corev1 "k8s.io/api/core/v1"
+	policyv1 "k8s.io/api/policy/v1"
+	rbacv1 "k8s.io/api/rbac/v1"
+	apiextensionsclient "k8s.io/apiextensions-apiserver/pkg/client/clientset/clientset"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
 	utilruntime "k8s.io/apimachinery/pkg/util/runtime"
 	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
+	"k8s.io/client-go/rest"
 	ctrl "sigs.k8s.io/controller-runtime"
+	"sigs.k8s.io/controller-runtime/pkg/cache"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 	"sigs.k8s.io/controller-runtime/pkg/healthz"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
+	"sigs.k8s.io/controller-runtime/pkg/manager"
 	"sigs.k8s.io/controller-runtime/pkg/metrics/filters"
 	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 	"sigs.k8s.io/controller-runtime/pkg/webhook"
@@ -59,6 +76,29 @@ func init() {
 	// +kubebuilder:scaffold:scheme
 }
 
+func newCacheOptions() cache.Options {
+	managedBySelector := labels.SelectorFromSet(labels.Set{
+		services.ManagedByLabelKey: services.ManagedByLabelValue,
+	})
+	managedByFilter := cache.ByObject{Label: managedBySelector}
+
+	return cache.Options{
+		DefaultTransform: cache.TransformStripManagedFields(),
+		ByObject: map[client.Object]cache.ByObject{
+			&corev1.ConfigMap{}:                      managedByFilter,
+			&appsv1.Deployment{}:                     managedByFilter,
+			&corev1.Service{}:                        managedByFilter,
+			&corev1.ServiceAccount{}:                 managedByFilter,
+			&corev1.PersistentVolumeClaim{}:          managedByFilter,
+			&rbacv1.RoleBinding{}:                    managedByFilter,
+			&rbacv1.Role{}:                           managedByFilter,
+			&batchv1.CronJob{}:                       managedByFilter,
+			&autoscalingv2.HorizontalPodAutoscaler{}: managedByFilter,
+			&policyv1.PodDisruptionBudget{}:          managedByFilter,
+		},
+	}
+}
+
 func main() {
 	var metricsAddr string
 	var enableLeaderElection bool
@@ -145,6 +185,7 @@ func main() {
 		// if you are doing or is intended to do any operation such as perform cleanups
 		// after the manager stops then its usage might be unsafe.
 		// LeaderElectionReleaseOnCancel: true,
+		Cache: newCacheOptions(),
 		Client: client.Options{
 			Cache: &client.CacheOptions{
 				DisableFor: []client.Object{
@@ -168,6 +209,43 @@ func main() {
 		setupLog.Error(err, "unable to create controller", "controller", "FeatureStore")
 		os.Exit(1)
 	}
+
+	// Setup Notebook ConfigMap controller for OpenDataHub integration
+	// Default to kubeflow.org/v1 Notebook CRD (used by OpenDataHub)
+	notebookGVK := schema.GroupVersionKind{
+		Group:   "kubeflow.org",
+		Version: "v1",
+		Kind:    "Notebook",
+	}
+	// Validate Notebook CRD availability and skip controller setup if CRD is missing
+	crdExists, err := validateNotebookCRD(context.Background(), mgr.GetConfig(), notebookGVK)
+	if err != nil {
+		setupLog.Error(err, "Notebook CRD validation failed for feast specific configmap", "GVK", notebookGVK)
+		if !crdExists {
+			setupLog.Info("Skipping Notebook ConfigMap controller setup - Notebook CRD not found")
+		} else {
+			setupLog.Info("Notebook ConfigMap controller will be set up anyway (could not verify CRD)")
+		}
+	}
+	if crdExists {
+		if err = setupNotebookController(mgr, notebookGVK); err != nil {
+			setupLog.Error(err, "unable to create controller", "controller", "NotebookConfigMap")
+			os.Exit(1)
+		}
+	} else {
+		// CRD not found at startup (not an error, just not installed yet).
+		// During DSC deployment the Notebook CRD may be installed after the Feast
+		// operator starts. Poll in the background and trigger a process restart
+		// when the CRD appears so the controller can register during normal startup.
+		// Dynamic controller registration on a running manager is not supported by
+		// controller-runtime v0.18 (cache sync fails for late-added informers).
+		setupLog.Info("Notebook CRD not found at startup, will poll for CRD availability", "GVK", notebookGVK)
+		if addErr := mgr.Add(manager.RunnableFunc(func(ctx context.Context) error {
+			return waitForCRDAndRestart(ctx, mgr.GetConfig(), notebookGVK)
+		})); addErr != nil {
+			setupLog.Error(addErr, "Failed to add CRD watcher runnable")
+		}
+	}
 	// +kubebuilder:scaffold:builder
 
 	if err := mgr.AddHealthzCheck("healthz", healthz.Ping); err != nil {
@@ -185,3 +263,92 @@ func main() {
 		os.Exit(1)
 	}
 }
+
+// validateNotebookCRD checks if the Notebook CRD exists in the cluster
+// Returns (crdExists bool, error) where crdExists is true if CRD exists, false if not found or unknown
+func validateNotebookCRD(ctx context.Context, config *rest.Config, gvk schema.GroupVersionKind) (bool, error) {
+	apiextensionsClientset, err := apiextensionsclient.NewForConfig(config)
+	if err != nil {
+		return false, fmt.Errorf("failed to create apiextensions client: %w", err)
+	}
+
+	// Construct CRD name from GVK (format: plural.group)
+	// For kubeflow.org/v1 Notebook, the CRD name is "notebooks.kubeflow.org"
+	// Simple heuristic: convert Kind to lowercase and add 's' for plural
+	plural := strings.ToLower(gvk.Kind) + "s"
+	crdName := plural + "." + gvk.Group
+
+	_, err = apiextensionsClientset.ApiextensionsV1().CustomResourceDefinitions().Get(
+		ctx,
+		crdName,
+		metav1.GetOptions{},
+	)
+	if err != nil {
+		if apierrors.IsNotFound(err) {
+			// Not an error: integration is optional and controller setup will be skipped.
+			setupLog.Info(
+				"Notebook CRD not found; skipping Notebook ConfigMap controller setup",
+				"GVK", gvk,
+				"expectedCRD", crdName,
+			)
+			return false, nil
+		}
+		if apierrors.IsForbidden(err) {
+			// Can't verify - assume it might exist and let controller try
+			setupLog.Info(
+				"Unable to validate Notebook CRD (insufficient permissions), will attempt setup",
+				"CRD", crdName,
+				"GVK", gvk,
+			)
+			return true, nil // Return true to allow controller setup
+		}
+		return false, fmt.Errorf("failed to check Notebook CRD availability: %w", err)
+	}
+
+	setupLog.Info("Notebook CRD validated successfully", "CRD", crdName, "GVK", gvk)
+	return true, nil
+}
+
+const crdPollInterval = 5 * time.Second
+
+func setupNotebookController(mgr ctrl.Manager, notebookGVK schema.GroupVersionKind) error {
+	if err := (&controller.NotebookConfigMapReconciler{
+		Client:      mgr.GetClient(),
+		Scheme:      mgr.GetScheme(),
+		NotebookGVK: notebookGVK,
+	}).SetupWithManager(mgr); err != nil {
+		return err
+	}
+	setupLog.Info("Notebook ConfigMap controller setup completed successfully")
+	return nil
+}
+
+// waitForCRDAndRestart polls for the Notebook CRD and exits the process when
+// it becomes available. Kubernetes will restart the pod, and on the next startup
+// the controller registers normally via the standard code path. This avoids
+// dynamically adding controllers to a running manager, which causes cache sync
+// failures in controller-runtime v0.18.
+func waitForCRDAndRestart(ctx context.Context, config *rest.Config, gvk schema.GroupVersionKind) error {
+	ticker := time.NewTicker(crdPollInterval)
+	defer ticker.Stop()
+
+	setupLog.Info("Waiting for Notebook CRD to become available...", "GVK", gvk)
+
+	for {
+		select {
+		case <-ctx.Done():
+			setupLog.Info("Context cancelled, stopping CRD watch", "GVK", gvk)
+			return nil
+		case <-ticker.C:
+			crdExists, err := validateNotebookCRD(ctx, config, gvk)
+			if err != nil {
+				setupLog.Error(err, "Failed to check Notebook CRD availability, will retry")
+				continue
+			}
+			if crdExists {
+				setupLog.Info("Notebook CRD detected, restarting operator to initialize Notebook ConfigMap controller", "GVK", gvk)
+				os.Exit(0)
+			}
+		}
+	}
+}
@@ -1,10 +1,16 @@
+- op: test
+  path: "/spec/template/spec/containers/0/env/1/name"
+  value: RELATED_IMAGE_FEATURE_SERVER
 - op: replace
-  path: "/spec/template/spec/containers/0/env/0"
+  path: "/spec/template/spec/containers/0/env/1"
   value:
     name: RELATED_IMAGE_FEATURE_SERVER
     value: ${FS_IMG}
+- op: test
+  path: "/spec/template/spec/containers/0/env/2/name"
+  value: RELATED_IMAGE_CRON_JOB
 - op: replace
-  path: "/spec/template/spec/containers/0/env/1"
+  path: "/spec/template/spec/containers/0/env/2"
   value:
     name: RELATED_IMAGE_CRON_JOB
     value: ${CJ_IMG}
@@ -1,10 +1,16 @@
+- op: test
+  path: "/spec/template/spec/containers/0/env/1/name"
+  value: RELATED_IMAGE_FEATURE_SERVER
 - op: replace
-  path: "/spec/template/spec/containers/0/env/0"
+  path: "/spec/template/spec/containers/0/env/1"
   value:
     name: RELATED_IMAGE_FEATURE_SERVER
     value: quay.io/feastdev/feature-server:0.61.0
+- op: test
+  path: "/spec/template/spec/containers/0/env/2/name"
+  value: RELATED_IMAGE_CRON_JOB
 - op: replace
-  path: "/spec/template/spec/containers/0/env/1"
+  path: "/spec/template/spec/containers/0/env/2"
   value:
     name: RELATED_IMAGE_CRON_JOB
     value: quay.io/openshift/origin-cli:4.17
@@ -73,6 +73,8 @@ spec:
             drop:
             - "ALL"
         env:
+        - name: GOMEMLIMIT
+          value: "230MiB"
         - name: RELATED_IMAGE_FEATURE_SERVER
           value: feast:latest
         - name: RELATED_IMAGE_CRON_JOB

@@ -4,6 +4,13 @@ kind: ClusterRole
 metadata:
   name: manager-role
 rules:
+- apiGroups:
+  - apiextensions.k8s.io
+  resources:
+  - customresourcedefinitions
+  verbs:
+  - get
+  - list
 - apiGroups:
   - apps
   resources:
@@ -45,6 +52,18 @@ rules:
   - patch
   - update
   - watch
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+  - delete
+  - get
+  - list
+  - patch
+  - update
+  - watch
 - apiGroups:
   - ""
   resources:
@@ -63,6 +82,15 @@ rules:
   - ""
   resources:
   - namespaces
+  verbs:
+  - get
+  - list
+  - patch
+  - update
+  - watch
+- apiGroups:
+  - ""
+  resources:
   - pods
   - secrets
   verbs:
@@ -101,6 +129,14 @@ rules:
   - get
   - patch
   - update
+- apiGroups:
+  - kubeflow.org
+  resources:
+  - notebooks
+  verbs:
+  - get
+  - list
+  - watch
 - apiGroups:
   - monitoring.coreos.com
   resources: