René's URL Explorer Experiment

Title: feat: Add mTLS support to remote registry gRPC client by jacob-bush-shopify · Pull Request #6474 · feast-dev/feast · GitHub

Open Graph Title: feat: Add mTLS support to remote registry gRPC client by jacob-bush-shopify · Pull Request #6474 · feast-dev/feast

X Title: feat: Add mTLS support to remote registry gRPC client by jacob-bush-shopify · Pull Request #6474 · feast-dev/feast

Description: What this PR does / why we need it: Feast currently supports TLS, but does not support mTLS. For an example of why this is needed: our feature registry is hosted in GCP and sits behind an internal Application Load Balancer that requires mutual TLS for all connections. Additionally, since the feature registry is not exposed to the internet, we need to use an IAP tunnel to connect to the registry during development. The three new configuration options added in this PR solve both of these issues: client_cert, client_key, and authority. Which issue(s) this PR fixes: Checks I've made sure the tests are passing. My commits are signed off (git commit -s) My PR title follows conventional commits format Testing Strategy Unit tests Integration tests Manual tests Testing is not required for this change Manual 🎩 I've redacted some of this to remove specific names, and to keep logs shorter. # Creating ca.crt, tls.crt, tls.key files ❯ certloader [ ... ] # Creating the tunnel ❯ gcloud compute start-iap-tunnel 443 \ --local-host-port=localhost:8443 \ [ ... ] # feature-store.yml registry: registry_type: remote path: localhost:8443 authority: cert: ./ca.crt client_cert: ./tls.crt client_key: ./tls.key cache_ttl_seconds: 60 On feast 0.61.0 we get an auth failure as expected (the client certs aren't passed through) ❯ feast projects list [ ... ] grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAVAILABLE details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:8443: Custom verification check failed with error: UNAUTHENTICATED: Hostname Verification Check failed." debug_error_string = "UNKNOWN:Error received from peer {grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:8443: Custom verification check failed with error: UNAUTHENTICATED: Hostname Verification Check failed.", grpc_status:14}" > On this branch, we we can connect via the iap tunnel 🎉 ❯ uvx '~/tmp/feast[gcp]' projects list NAME DESCRIPTION TAGS OWNER {} Note that setting the authority is necessary in this case because the IAP tunnel causes a host name mismatch otherwise. If we remove it we can see the behaviour of that failure: ❯ uvx '/Users/jacobbush/tmp/feast[gcp]' projects list [...] grpc._channel._InactiveRpcError: <_InactiveRpcError of RPC that terminated with: status = StatusCode.UNAVAILABLE details = "failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:8443: Custom verification check failed with error: UNAUTHENTICATED: Hostname Verification Check failed." debug_error_string = "UNKNOWN:Error received from peer {grpc_message:"failed to connect to all addresses; last error: UNKNOWN: ipv4:127.0.0.1:8443: Custom verification check failed with error: UNAUTHENTICATED: Hostname Verification Check failed.", grpc_status:14}" Misc

Open Graph Description: What this PR does / why we need it: Feast currently supports TLS, but does not support mTLS. For an example of why this is needed: our feature registry is hosted in GCP and sits behind an internal...

X Description: What this PR does / why we need it: Feast currently supports TLS, but does not support mTLS. For an example of why this is needed: our feature registry is hosted in GCP and sits behind an internal...

Opengraph URL: https://github.com/feast-dev/feast/pull/6474

X: @github

direct link

Domain: github.com

Links:

Viewport: width=device-width