Skip to content

fix: Default authentication to kubernetes auth - #6735

Open
ntkathole wants to merge 1 commit into
feast-dev:masterfrom
ntkathole:fix/default-auth-kubernetes
Open

fix: Default authentication to kubernetes auth#6735
ntkathole wants to merge 1 commit into
feast-dev:masterfrom
ntkathole:fix/default-auth-kubernetes

Conversation

@ntkathole

@ntkathole ntkathole commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Summary

Default Feast operator authentication to Kubernetes auth instead of no_auth, and add an explicit noAuth opt-out option for development/testing environments.

Changes

Default Kubernetes Authentication

  • Change operator default from no_auth to kubernetes authentication
  • Update util.go to apply default AuthzConfig with KubernetesAuthz
  • Add warning log when running with no_auth
  • Update enforcer.py to allow all authenticated users full access when no permissions are defined

noAuth CRD Option

  • Add NoAuth field to AuthzConfig in both v1 and v1alpha1 API types
  • Update CRD validation rules to allow noAuth as a third option alongside kubernetes and oidc
  • Update repo_config.go to handle noAuth selection
  • Update deepcopy generated code, CRD manifests, bundle, install.yaml, and docs

Test Updates

  • Update operator unit tests for default auth behavior
  • Update REST API integration test CRs with noAuth: true (these tests dont test auth)
  • Update RBAC integration test expectations to match new enforcer behavior
  • Add noAuth-specific tests

Test Plan

  • Operator unit tests updated and passing
  • CRD validation tests updated
  • REST API test fixtures updated with explicit noAuth
  • RBAC integration test expectations updated

@ntkathole
ntkathole requested a review from a team as a code owner August 13, 2026 15:09
@codecov-commenter

codecov-commenter commented Aug 13, 2026 •
edited
Loading

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 20.00000% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 46.80%. Comparing base (a9219d9) to head (c64c0a8).
⚠️ Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
sdk/python/feast/permissions/enforcer.py 0.00% 4 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.
Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #6735      +/-   ##
==========================================
- Coverage   46.80%   46.80%   -0.01%     
==========================================
  Files         415      415              
  Lines       50395    50398       +3     
  Branches     7214     7215       +1     
==========================================
+ Hits        23588    23589       +1     
- Misses      25155    25157       +2     
  Partials     1652     1652
Flag Coverage Δ
go-feature-server 30.58% <ø> (ø)
python-unit 48.13% <20.00%> (-0.01%) ⬇️
Files with missing lines Coverage Δ
sdk/python/feast/permissions/server/utils.py 62.74% <100.00%> (+0.74%) ⬆️
sdk/python/feast/permissions/enforcer.py 72.91% <0.00%> (-3.18%) ⬇️

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a9219d9...c64c0a8. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ntkathole
ntkathole force-pushed the fix/default-auth-kubernetes branch 3 times, most recently from 8e2fab9 to 4965988 Compare August 13, 2026 16:13
@ntkathole
ntkathole force-pushed the fix/default-auth-kubernetes branch from 4965988 to 025f1f7 Compare August 13, 2026 17:23
@ntkathole ntkathole mentioned this pull request Aug 13, 2026
Closed
2 tasks
@ntkathole
ntkathole force-pushed the fix/default-auth-kubernetes branch from 025f1f7 to d9be997 Compare August 14, 2026 03:03
@ntkathole @cursoragent
fix: Default authentication to kubernetes auth
c64c0a8 
Signed-off-by: ntkathole <nikhilkathole2683@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Signed-off-by: ntkathole <nikhilkathole2683@gmail.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
@ntkathole
ntkathole force-pushed the fix/default-auth-kubernetes branch from d9be997 to c64c0a8 Compare August 14, 2026 04:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ntkathole @codecov-commenter