feat: Pass optional OIDC audience and issuer through the operator by larrysingleton007 · Pull Request #6677 · feast-dev/feast

larrysingleton007 · 2026-07-30T15:26:53Z

What this PR does / why we need it

Follow-up to #6670, requested in review there: expose the new optional OIDC audience and issuer verification fields through the feast-operator.

Adds audience and issuer to OidcOptionalSecretProperties, so operators can set them in the referenced OIDC Secret and they flow into the generated feature_store.yaml auth section the same way client_id, client_secret, username, and password already do. When the keys are absent, nothing changes.

Also documents the two optional Secret keys in the operator security guide, with a pointer to the main OIDC authorization page for the caveat about token claims versus discovery metadata.

Scope note: verify_ssl and ca_cert_path are deliberately not added to the whitelist. They're already exposed as first-class CR fields (verifySSL, caCertConfigMap) that feed the same generated auth section, so whitelisting them would create two sources for the same keys. The Secret bag carries IdP-coupled values (auth_discovery_url, client_id, ...), which is where audience and issuer belong; a first-class CR field for issuer was considered and rejected because the existing issuerUrl field already means the discovery base URL, not the token iss claim.

Testing: extended the repo config suite to include both keys in the mocked Secret and assert they arrive in OidcParameters with their values intact, plus the reconcile-level envtest fixtures so the keys go through real Secret extraction and YAML serialization. go build ./... and go test ./internal/controller/... pass.

A pre-submit review pass surfaced two things worth calling out:

Secret values are YAML-parsed on extraction, so an all-digits audience (a numeric IdP application ID) would arrive as an int, render unquoted, and fail the SDK's Optional[str] validation at server startup. The copy now coerces the two claim keys to strings, with a regression test.
If a referenced Secret already contains keys named audience or issuer (previously ignored), they take effect after this change. That and two other operational caveats (the IdP must mint matching claims for Feast's own client token flows, and Secret edits apply on the next reconcile rather than immediately) are documented in the security guide.

Deliberately left out: ui_client_id is similarly absent from the whitelist and consumed by the UI server; left for a separate change if wanted, to keep this one to the review request.

Which issue(s) this PR fixes

Fixes #6676

Related to #6669 (main change in #6670).

codecov-commenter · 2026-07-30T15:35:48Z

⚠️ Please install the $'codecov app svg image'$ to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.46%. Comparing base (4f6b821) to head (d8ef562).
⚠️ Report is 1 commits behind head on master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

$Impacted file tree graph$

@@           Coverage Diff           @@
##           master    #6677   +/-   ##
=======================================
  Coverage   46.46%   46.46%           
=======================================
  Files         414      414           
  Lines       50138    50138           
  Branches     7173     7173           
=======================================
  Hits        23295    23295           
  Misses      25204    25204           
  Partials     1639     1639

Flag	Coverage Δ
go-feature-server	`30.58% <ø> (ø)`
python-unit	`47.76% <ø> (ø)`

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4f6b821...d8ef562. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

larrysingleton007 · 2026-07-30T17:14:11Z

@ntkathole this is the operator follow-up you asked for on #6670, ready for review. audience and issuer flow from the referenced OIDC Secret into the generated feature_store.yaml like the existing keys. A pre-submit review caught one real bug worth knowing about: an all-digits audience would arrive as a YAML int and fail the SDK's string validation at server startup, so the copy now coerces the two claim keys to strings, with a regression test. Also documented the operational caveats (pre-existing Secret keys take effect on upgrade, the IdP has to mint matching claims for feast's own client flows, Secret edits apply on next reconcile). CI is green.

Follow-up to feast-dev#6670, requested in review: add audience and issuer to OidcOptionalSecretProperties so operators can set them in the referenced OIDC Secret and have them flow into the generated feature_store.yaml auth section, enabling the new opt-in claim verification on the feature server. Absent keys change nothing. Documents the two optional Secret keys in the operator security guide with a pointer to the OIDC authorization page for the token-claims vs discovery-metadata caveat. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

Secret values are YAML-parsed on extraction, so an all-digits audience (e.g. a numeric IdP application ID) arrives as a Go int, renders unquoted in the generated feature_store.yaml, and fails the SDK's Optional[str] validation at server startup. Coerce the two claim keys back to strings in the allowlist copy, with a regression test. Also extend the reconcile-level envtest fixtures with both keys so they exercise real Secret extraction and YAML serialization rather than only the mocked property map. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

State precisely which claims are and are not checked, scope the checks to the standard OIDC/JWKS path (ServiceAccount and intra-server tokens follow separate paths), distinguish the Secret's issuer key from the CR's issuerUrl, and document three operational caveats: pre-existing Secret keys activate on operator upgrade, the IdP must mint matching claims for Feast's own client token flows, and Secret edits apply on the next reconcile. Point the two dead ../reference/auth links at real pages and add the new optional keys to the linked sample Secret as commented lines. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

…ast-dev#6677) * feat: Pass optional OIDC audience and issuer through the operator Follow-up to feast-dev#6670, requested in review: add audience and issuer to OidcOptionalSecretProperties so operators can set them in the referenced OIDC Secret and have them flow into the generated feature_store.yaml auth section, enabling the new opt-in claim verification on the feature server. Absent keys change nothing. Documents the two optional Secret keys in the operator security guide with a pointer to the OIDC authorization page for the token-claims vs discovery-metadata caveat. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * fix: Coerce numeric OIDC audience and issuer Secret values to strings Secret values are YAML-parsed on extraction, so an all-digits audience (e.g. a numeric IdP application ID) arrives as a Go int, renders unquoted in the generated feature_store.yaml, and fails the SDK's Optional[str] validation at server startup. Coerce the two claim keys back to strings in the allowlist copy, with a regression test. Also extend the reconcile-level envtest fixtures with both keys so they exercise real Secret extraction and YAML serialization rather than only the mocked property map. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> * docs: Sharpen operator OIDC audience/issuer docs and fix dead links State precisely which claims are and are not checked, scope the checks to the standard OIDC/JWKS path (ServiceAccount and intra-server tokens follow separate paths), distinguish the Secret's issuer key from the CR's issuerUrl, and document three operational caveats: pre-existing Secret keys activate on operator upgrade, the IdP must mint matching claims for Feast's own client token flows, and Secret edits apply on the next reconcile. Point the two dead ../reference/auth links at real pages and add the new optional keys to the linked sample Secret as commented lines. Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com> --------- Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>

# [0.66.0](v0.65.0...v0.66.0) (2026-08-21) ### Bug Fixes * Add connection pre-warming for DynamoDB async client ([89240fa](89240fa)), closes [#6060](#6060) * Add remote registry client extra ([#6697](#6697)) ([b8dfcb0](b8dfcb0)) * Address review feedback on FIPS cipher suite configuration ([4a35fba](4a35fba)) * Allow remote-registry first apply for new projects ([39d408d](39d408d)) * Avoid importing feast.feature_store at mcp_server import time ([ddb2e9a](ddb2e9a)) * Bump pymssql to >=2.3.6 for macOS arm64 wheel support ([181eb35](181eb35)), closes [#5636](#5636) [#5193](#5193) [#5636](#5636) * Call ApplySavedDataset RPC instead of ApplyFeatureService in RemoteRegistry.apply_saved_dataset() ([934d341](934d341)) * Catch missing dbt parser dependency in dbt CLI commands ([#6534](#6534)) ([3c2ae3c](3c2ae3c)) * Default authentication to kubernetes auth ([6a4690a](6a4690a)) * Defer feature-freshness thread to post-fork to avoid Gunicorn deadlock ([#6648](#6648)) ([104ad10](104ad10)), closes [#6647](#6647) * Do not pass undeclared feature view columns to ODFV UDFs ([#6527](#6527)) ([75b9463](75b9463)) * downgrade mcp pin to 1.29.0 and fix CI lockfiles and unit tests ([98e5bca](98e5bca)), closes [#6706](#6706) * Feast apply silently ignoring ttl updates to None or timedelta(0) ([#6709](#6709)) ([97b0f25](97b0f25)), closes [#6703](#6703) * Fix mypy TorchTensor type alias error ([#6712](#6712)) ([34de6fa](34de6fa)), closes [#5563](#5563) * Fixed data source creation form gaps ([5d0f7d6](5d0f7d6)) * Handle parameterized and complex Trino types in type map ([326554d](326554d)) * Isolate default user permissions ([e37adbf](e37adbf)) * Isolate projection join key maps ([d1c709d](d1c709d)) * Map Postgres real to FLOAT instead of DOUBLE ([62db435](62db435)) * Merge shared ODFV source projections in feature resolution ([d269946](d269946)), closes [#6621](#6621) * More exhaustive athena types ([a9aaefc](a9aaefc)) * Normalize SQL registry read_path to the psycopg3 driver like path ([#6644](#6644)) ([996c6ea](996c6ea)), closes [#6643](#6643) * **operator:** add spec.services.onlineStore.disabled to opt out of the online store ([d81d4e3](d81d4e3)), closes [#6586](#6586) * Preinstall DuckDB delta extension for tests ([fd4d49d](fd4d49d)), closes [#6743](#6743) * Preserve event-time ordering within Redis online_write_batch ([40fb788](40fb788)), closes [#5163](#5163) * Prevent mutation of cached feature resolution results ([ea17419](ea17419)) * Remote feastRef FeatureStore fails first apply for a new feastProject ([9affee5](9affee5)) * Remove inert subjectaccessreviews and reorganize RBAC rules ([f771ea4](f771ea4)) * Report single-feature-view spark_application materialization success ([a9219d9](a9219d9)), closes [#6673](#6673) * Reset the global security manager after the permissions fixture ([7667215](7667215)) * Resolve kserve with pip --dry-run instead of installing it ([01da132](01da132)), closes [#6732](#6732) * Resolve write_to_offline_store feature view with a single registry lookup ([a42dc85](a42dc85)), closes [#4235](#4235) * Return False from __eq__ on cross-type comparison ([#6637](#6637)) ([0f149a9](0f149a9)), closes [#6636](#6636) * Reuse IdP-issued client tokens until near expiry ([602d752](602d752)) * Reuse the OIDC JWKS client across requests ([#6683](#6683)) ([a1e6fc2](a1e6fc2)) * Separate CronJob and feature-server ServiceAccounts ([398f643](398f643)) * Serialize UnixTimestamp proto values as raw int64 in remote online store transport ([1e7134f](1e7134f)) * Set FIPS cipher suites before pyarrow.flight import to prevent crash on IBM Power ([979b82a](979b82a)) * Support Entra ID (Azure AD) token claims in OIDC auth ([#6631](#6631)) ([f843c63](f843c63)) * UDF/ODFV source rehydrate (+ Postgres / online cache) ([#6655](#6655)) ([5fd7af7](5fd7af7)) * Updated projects-list.json in order to display newly added projects ([#6657](#6657)) ([3a6a103](3a6a103)) * Use correct image name in multi-arch imagetools push step ([faf85e0](faf85e0)) * Use join keys instead of entity names in ODFV materialization ([#6645](#6645)) ([abffebc](abffebc)), closes [#5965](#5965) * use matching proto class per feature view list in SqliteOnlineStore.plan() ([adb8c1c](adb8c1c)), closes [#6658](#6658) * Widen Athena integer type mapping for unsigned ints ([3425783](3425783)) ### Features * Add ConnectionRef to DataSource for pluggable external credential resolution ([28bde01](28bde01)) * Add Feature Service Create in UI ([0399380](0399380)) * Add hybrid to ValidOfflineStoreDBStorePersistenceTypes for HybridOfflineStore support ([#6707](#6707)) ([310ab51](310ab51)), closes [#6701](#6701) * Add MLflow integration support to Feast operator ([#6611](#6611)) ([52999f1](52999f1)) * Add opt-in filter_by_created_timestamp cutoff to get_historical_features ([#6617](#6617)) ([79b33ce](79b33ce)), closes [#6615](#6615) * Add optional OIDC token audience and issuer verification ([#6670](#6670)) ([ef307c6](ef307c6)) * Add packaged feature repository support to Feast Operator ([8112b1e](8112b1e)), closes [#6598](#6598) * add plan() support to DynamoDBOnlineStore ([51ce982](51ce982)), closes [#6658](#6658) [#6659](#6659) * Added optional namespace/colleciton to datasets ([165fcf2](165fcf2)) * Added SQL registry schema_mode and registry create command ([#6704](#6704)) ([037c4cd](037c4cd)) * Allow users to have protected project on shared registry ([f9923bc](f9923bc)) * Apply Intermediate TLS defaults on API fallback and handle transient errors ([#6587](#6587)) ([43ae993](43ae993)) * **cli:** Updated feast init demo by adding rag template ([#5946](#5946)) ([c8628eb](c8628eb)), closes [#5264](#5264) * Expose the OIDC JWKS tunables through the operator ([#6690](#6690)) ([fef4e78](fef4e78)), closes [#6683](#6683) * Making feast vector store with open ai search api compatible ([#6121](#6121)) ([54da19a](54da19a)) * Multi-arch publish for feast operator image ([b221036](b221036)) * OpenLineage lineage enhancements - full object coverage, richer UI, and API-level sync ([#6719](#6719)) ([120a868](120a868)) * **operator:** Add spec.services.initImage for init container image override ([#6598](#6598)) ([ca355cb](ca355cb)) * Pass optional OIDC audience and issuer through the operator ([#6677](#6677)) ([a13ed7b](a13ed7b)), closes [#6670](#6670) * **server:** Remote Materialization ([#6649](#6649)) ([b7ae488](b7ae488)), closes [#4526](#4526) * Support Lineage configs via operator ([bf1e54a](bf1e54a)) * Updated datasets UI to support grouping ([7ae64ec](7ae64ec))

$@larrysingleton007$

larrysingleton007 requested a review from a team as a code owner July 30, 2026 15:26

$@larrysingleton007$

larrysingleton007 marked this pull request as draft July 30, 2026 15:27

$@larrysingleton007$

larrysingleton007 marked this pull request as ready for review July 30, 2026 16:23

$@ntkathole$ ntkathole added the ok-to-test label Jul 31, 2026

$ntkathole$

ntkathole approved these changes Jul 31, 2026

View reviewed changes

larrysingleton007 added 3 commits July 31, 2026 10:22

$@ntkathole$

ntkathole force-pushed the feat/operator-oidc-audience-issuer branch from 4f8d6db to d8ef562 Compare July 31, 2026 04:53

$@ntkathole$

ntkathole merged commit a13ed7b into feast-dev:master Jul 31, 2026
22 of 23 checks passed

$@larrysingleton007$

larrysingleton007 deleted the feat/operator-oidc-audience-issuer branch July 31, 2026 13:10

This was referenced Jul 31, 2026

fix: Reuse the OIDC JWKS client across requests #6683

Merged

Expose the OIDC JWKS cache lifespan and fetch timeout through the feast-operator #6686

Closed

Navigation Menu

Uh oh!

feat: Pass optional OIDC audience and issuer through the operator - #6677

feat: Pass optional OIDC audience and issuer through the operator#6677
ntkathole merged 3 commits into
feast-dev:masterfrom
larrysingleton007:feat/operator-oidc-audience-issuer

$@larrysingleton007$ larrysingleton007 commented Jul 30, 2026 •

edited

Loading

Uh oh!

codecov-commenter commented Jul 30, 2026 •

edited

Loading

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

larrysingleton007 commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Which issue(s) this PR fixes

Uh oh!

codecov-commenter commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

$@larrysingleton007$ larrysingleton007 commented Jul 30, 2026 •

edited

Loading

codecov-commenter commented Jul 30, 2026 •

edited

Loading