Security
Secure Feast with SSL/TLS, Authentication and Authorization.
Last updated
Was this helpful?
Secure Feast with SSL/TLS, Authentication and Authorization.
Last updated
Was this helpful?
This page applies to Feast 0.7. The content may be out of date for Feast 0.8+
Feast supports the following security methods:
Feast supports SSL/TLS encrypted inter-service communication among Feast Core, Feast Online Serving, and Feast SDKs.
The following properties configure SSL/TLS. These properties are located in their corresponding application.yml
files:
Configuration Property
Description
grpc.server.security.enabled
Enables SSL/TLS functionality if true
grpc.server.security.certificateChain
Provide the path to certificate chain.
grpc.server.security.privateKey
Provide the to private key.
Configuration Option
Description
core_enable_ssl
Enables SSL/TLS functionality on connections to Feast core if true
serving_enable_ssl
Enables SSL/TLS functionality on connections to Feast Online Serving if true
core_server_ssl_cert
Optional. Specifies the path of the root certificate used to verify Core Service's identity. If omitted, uses system certificates.
serving_server_ssl_cert
Optional. Specifies the path of the root certificate used to verify Serving Service's identity. If omitted, uses system certificates.
Config Option
Description
EnableTLS
Enables SSL/TLS functionality when connecting to Feast if true
TLSCertPath
Optional. Provides the path of the root certificate used to verify Feast Service's identity. If omitted, uses system certificates.
Config Option
Description
setTLSEnabled()
Enables SSL/TLS functionality when connecting to Feast if true
setCertificatesPath()
Optional. Set the path of the root certificate used to verify Feast Service's identity. If omitted, uses system certificates.
To prevent man in the middle attacks, we recommend that SSL/TLS be implemented prior to authentication.
Authentication can be configured for Feast Core and Feast Online Serving via properties in their corresponding application.yml
files:
Configuration Property
Description
feast.security.authentication.enabled
Enables Authentication functionality if true
feast.security.authentication.provider
Authentication Provider type. Currently only supports jwt
feast.security.authentication.option.jwkEndpointURI
Behind the scenes, Feast Core and Feast Online Serving authenticate by:
Extracting the OIDC ID token TOKEN
from gRPC metadata submitted with request:
Validates token's authenticity using the JWK retrieved from the jwkEndpointURI
Feast Online Serving communicates with Feast Core during normal operation. When both authentication and authorization are enabled on Feast Core, Feast Online Serving is forced to authenticate its requests to Feast Core. Otherwise, Feast Online Serving produces an Authentication failure error when connecting to Feast Core.
Properties used to configure Serving authentication via application.yml
:
Configuration Property
Description
feast.core-authentication.enabled
Requires Feast Online Serving to authenticate when communicating with Feast Core.
feast.core-authentication.provider
Selects provider Feast Online Serving uses to retrieve credentials then used to authenticate requests to Feast Core. Valid providers are google
and oauth
.
Google Provider automatically extracts the credential from the credential JSON file.
Configuration Option
Description
enable_auth
Enables authentication functionality if set to true
.
auth_provider
Use an authentication provider to obtain a credential for authentication. Currently supports google
and oauth
.
auth_token
Manually specify a static token for use in authentication. Overrules auth_provider
if both are set.
Google Provider automatically finds and uses Google Credentials to authenticate requests:
Google Provider automatically uses established credentials for authenticating requests if you are already authenticated with the gcloud
CLI via:
Exporting GOOGLE_APPLICATION_CREDENTIALS
Create a Google Credential with target audience.
Target audience of the credential should be set to host URL of target Service. (ie
https://localhost
if Service listens onlocalhost
):
Exporting GOOGLE_APPLICATION_CREDENTIALS
Create a Google Credential with target audience.
Target audience of the credentials should be set to host URL of target Service. (ie
https://localhost
if Service listens onlocalhost
):
Authorization provides access control to FeatureTables and/or Features based on project membership. Users who are members of a project are authorized to:
Create and/or Update a Feature Table in the Project.
Retrieve Feature Values for Features in that Project.
Feast checks whether a user is authorized to make a request by making a checkAccessRequest
to the Authorization Server.
The Authorization Server should return a AuthorizationResult
with whether the user is allowed to make the request.
Authorization can be configured for Feast Core and Feast Online Serving via properties in their corresponding application.yml
Configuration Property
Description
feast.security.authorization.enabled
Enables authorization functionality if true
.
feast.security.authorization.provider
Authentication Provider type. Currently only supports http
feast.security.authorization.option.authorizationUrl
URL endpoint of Authorization Server to make check access requests to.
feast.security.authorization.option.subjectClaim
Optional. Name of the claim of the to extract from the ID Token to include in the check access request as Subject.
When using Authentication & Authorization, consider:
Enabling Authentication without Authorization makes authentication optional. You can still send unauthenticated requests.
Enabling Authorization forces all requests to be authenticated. Requests that are not authenticated are dropped.
.
Read more on enabling SSL/TLS in the
To enable SSL/TLS in the or , set the config options via feast config
:
Configure SSL/TLS on the by passing configuration via SecurityConfig
:
Configure SSL/TLS on the by passing configuration via SecurityConfig
:
Authentication can be implemented to identify and validate client requests to Feast Core and Feast Online Serving. Currently, Feast uses ID tokens (i.e. ) to authenticate client requests.
HTTPS URL used by Feast to retrieved the used to verify OIDC ID tokens.
Set to the path of the credential in the JSON file.
OAuth Provider makes an OAuth request to obtain the credential. OAuth requires the following options to be set at feast.security.core-authentication.options.
:
Configure the and to use authentication via feast config
:
Alternatively Google Provider can be configured to use the credentials in the JSON file viaGOOGLE_APPLICATION_CREDENTIALS
environmental variable ():
OAuth Provider makes an OAuth request to obtain the credential/token used to authenticate Feast requests. The OAuth provider requires the following config options to be set via feast config
:
Configure the to use authentication by specifying the credential via SecurityConfig
:
Google Credential uses Service Account credentials JSON file set viaGOOGLE_APPLICATION_CREDENTIALS
environmental variable () to obtain tokens for Authenticating Feast requests:
OAuth Credential makes an OAuth request to obtain the credential/token used to authenticate Feast requests:
Configure the to use authentication by setting credentials via SecurityConfig
:
GoogleAuthCredentials uses Service Account credentials JSON file set viaGOOGLE_APPLICATION_CREDENTIALS
environmental variable () to obtain tokens for Authenticating Feast requests:
OAuthCredentials makes an OAuth request to obtain the credential/token used to authenticate Feast requests:
Feast delegates Authorization grants to an external Authorization Server that implements the .
This example of the can be used as a reference implementation for implementing an Authorization Server that Feast supports.