Skip to content

feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods #6089

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntkathole merged 41 commits into from
Apr 7, 2026
Merged

feat: Extended OIDC support to extract groups & namespaces and token injection with multiple methods #6089

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
41 commits
Select commit Hold shift + click to select a range
493a6b9
feat: Extract groups and namespaces claims from JWT in OidcTokenParser
aniketpalu Mar 10, 2026
3db6db3
Minor formatting
aniketpalu Mar 10, 2026
0d59eca
feat: Allow Feast SDK to accept a pre-existing OIDC token without con…
aniketpalu Mar 10, 2026
36a5b06
fix: Raise error when configured token_env_var is empty
aniketpalu Mar 10, 2026
a478a80
Minor formatting changes
aniketpalu Mar 10, 2026
1483c6c
Activate _check_mutually_exclusive groups only when all fields are se…
aniketpalu Mar 10, 2026
34474af
Narrow OIDC client routing to use set-based key detection and extract…
aniketpalu Mar 11, 2026
505d6de
Fix .sort() assertions in test_token_parser.py that always compared N…
aniketpalu Mar 11, 2026
5c79fcf
Guard against missing roles key in resource_access to prevent unhandl…
aniketpalu Mar 11, 2026
e0359db
Fixed lint errors
aniketpalu Mar 11, 2026
7453349
Fixed lint error
aniketpalu Mar 11, 2026
4b4c1dd
Fixed lint errors
aniketpalu Mar 11, 2026
1353482
Added support to read ServiceAccount token and Minor improvements
aniketpalu Mar 11, 2026
86c9d76
Improved code readibility
aniketpalu Mar 11, 2026
5621f07
Minor reformatting
aniketpalu Mar 11, 2026
b5db157
fix: Use exact dict-key lookup for kubernetes.io claim to satisfy Cod…
aniketpalu Mar 12, 2026
1331057
feat: Add verify_ssl support to OIDC auth flow for self-signed certif…
aniketpalu Mar 20, 2026
a875169
feat: Lightweight SA token validation for OIDC auth — TokenReview onl…
aniketpalu Mar 23, 2026
7e59a53
Minor reformatting & lint related changes
aniketpalu Mar 23, 2026
611607b
Update sdk/python/feast/permissions/auth/oidc_token_parser.py
aniketpalu Mar 23, 2026
3c1e36b
fix: Restore missing return in intra-comm check and add error handlin…
aniketpalu Mar 23, 2026
c2c4863
Minor reformatting
aniketpalu Mar 23, 2026
eed8b02
Checks preferred_username first (Keycloak default), then falls back t…
aniketpalu Mar 23, 2026
593b95d
feat(operator): Split server/client OIDC config and add secretKeyName…
aniketpalu Mar 24, 2026
a1c75de
Reverted kustomization.yaml
aniketpalu Mar 24, 2026
88a389b
fix: Harden OIDC token parsing and make client_id optional
aniketpalu Mar 25, 2026
f632686
cache K8s client, eliminate double JWT decode, improve error messages
aniketpalu Apr 1, 2026
45666da
Minor formatting
aniketpalu Apr 1, 2026
0a59ad2
feat(odh): wire OIDC_ISSUER_URL from params.env into operator pod
GowthamShanmugam Mar 31, 2026
3557a15
Add issuerUrl to OidcAuthz CRD and OIDC_ISSUER_URL env var support fo…
aniketpalu Apr 6, 2026
30a04c2
Add caCertConfigMap to OidcAuthz CRD and ca_cert_path to SDK for self…
aniketpalu Apr 6, 2026
a967bc6
Reverted kustomization.yaml to use upstream image
aniketpalu Apr 6, 2026
c1d7c11
Shorten CRD field descriptions to fit maxDescLen=120 and revert kusto…
aniketpalu Apr 6, 2026
8aae62a
fix: Remove unused param, nil deref in test, and update secrets baseline
aniketpalu Apr 7, 2026
cacd649
fix: Remove unused secretExtractionFunc from client config chain and …
aniketpalu Apr 7, 2026
9200dd3
Merge branch 'master' into oidc-support
aniketpalu Apr 7, 2026
141c871
Remove always-nil error from getClientRepoConfig and stop leaking ODH…
aniketpalu Apr 7, 2026
bd81904
Remove always-nil error from getClientRepoConfig, stop leaking ODH CA…
aniketpalu Apr 7, 2026
66c3677
Thread ODH CA bundle detection into resolveOidcCACertPath for proper …
aniketpalu Apr 7, 2026
bb6fb52
Provision TokenReview RBAC for OIDC auth and add SSL error logging in…
aniketpalu Apr 7, 2026
2f3e7b9
Merge upstream/master into oidc-support and regenerate secrets baseline
aniketpalu Apr 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Shorten CRD field descriptions to fit maxDescLen=120 and revert kusto… 
…mization.yaml to upstream default

Signed-off-by: Aniket Paluskar <apaluska@redhat.com>
  • Loading branch information
@aniketpalu
aniketpalu committed Apr 7, 2026
commit c1d7c1179e25021f4f3ddea868957976981ccec4
31 changes: 9 additions & 22 deletions infra/feast-operator/api/v1/featurestore_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -708,45 +708,32 @@ type KubernetesAuthz struct {
// OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
// https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
type OidcAuthz struct {
// The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
// The operator derives the OIDC discovery endpoint by appending /.well-known/openid-configuration.
// When set, no Secret is required for basic OIDC authentication.
// OIDC issuer URL. The operator appends /.well-known/openid-configuration to derive the discovery endpoint.
// +optional
// +kubebuilder:validation:Pattern=`^https://\S+$`
IssuerUrl string `json:"issuerUrl,omitempty"`
// Reference to a Secret containing OIDC properties (auth_discovery_url, client_id, client_secret, etc.).
// When both issuerUrl and a Secret with auth_discovery_url are provided, issuerUrl takes precedence.
// Secret with OIDC properties (auth_discovery_url, client_id, client_secret). issuerUrl takes precedence.
// +optional
SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`
// The key within the Secret that contains the OIDC configuration as a YAML-encoded value.
// When set, only this key is read and its YAML value is expected to contain the OIDC properties
// (e.g. client_id, auth_discovery_url). This allows sharing a single Secret across services.
// When unset, each top-level key in the Secret is treated as a separate OIDC property.
// Key in the Secret containing all OIDC properties as a YAML value. If unset, each key is a property.
// +optional
SecretKeyName string `json:"secretKeyName,omitempty"`
// The name of the environment variable that Feast SDK client pods (e.g. workbenches, application pods)
// will read a pre-existing OIDC token from.
// When set, the client feature_store.yaml will include token_env_var with this value.
// When unset, the client config is bare `type: oidc` which falls back to FEAST_OIDC_TOKEN or the pod's SA token.
// Env var name for client pods to read an OIDC token from. Sets token_env_var in client config.
// +optional
TokenEnvVar *string `json:"tokenEnvVar,omitempty"`
// Whether to verify SSL certificates when communicating with the OIDC provider.
// Defaults to true. Set to false for self-signed certificates (common in internal OpenShift clusters).
// Verify SSL certificates for the OIDC provider. Defaults to true.
// +optional
VerifySSL *bool `json:"verifySSL,omitempty"`
// Reference to a ConfigMap containing the CA certificate for the OIDC provider.
// Used when the OIDC provider uses self-signed or custom CA certificates and verifySSL is true.
// On RHOAI/ODH clusters, the operator auto-detects the platform CA bundle; this field is not required.
// ConfigMap with the CA certificate for self-signed OIDC providers. Auto-detected on RHOAI/ODH.
// +optional
CACertConfigMap *OidcCACertConfigMap `json:"caCertConfigMap,omitempty"`
}

// OidcCACertConfigMap references a ConfigMap containing a CA certificate for OIDC provider TLS verification.
// OidcCACertConfigMap references a ConfigMap containing a CA certificate for OIDC provider TLS.
type OidcCACertConfigMap struct {
// Name of the ConfigMap containing the CA certificate.
// ConfigMap name.
Name string `json:"name"`
// Key within the ConfigMap that holds the CA certificate in PEM format.
// Defaults to "ca-bundle.crt" if omitted.
// Key in the ConfigMap holding the PEM certificate. Defaults to "ca-bundle.crt".
// +optional
Key string `json:"key,omitempty"`
}
Expand Down
2 changes: 1 addition & 1 deletion infra/feast-operator/bundle/manifests/feast-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ metadata:
}
]
capabilities: Basic Install
createdAt: "2026-04-06T19:35:43Z"
createdAt: "2026-04-06T22:05:44Z"
operators.operatorframework.io/builder: operator-sdk-v1.38.0
operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
name: feast-operator.v0.61.0
Expand Down
59 changes: 28 additions & 31 deletions infra/feast-operator/bundle/manifests/feast.dev_featurestores.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,31 +63,31 @@ spec:
https://auth0.
properties:
caCertConfigMap:
description: Reference to a ConfigMap containing the CA certificate
for the OIDC provider.
description: ConfigMap with the CA certificate for self-signed
OIDC providers. Auto-detected on RHOAI/ODH.
properties:
key:
description: |-
Key within the ConfigMap that holds the CA certificate in PEM format.
Defaults to "ca-bundle.crt" if omitted.
description: Key in the ConfigMap holding the PEM certificate.
Defaults to "ca-bundle.crt".
type: string
name:
description: Name of the ConfigMap containing the CA certificate.
description: ConfigMap name.
type: string
required:
- name
type: object
issuerUrl:
description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
description: OIDC issuer URL. The operator appends /.well-known/openid-configuration
to derive the discovery endpoint.
pattern: ^https://\S+$
type: string
secretKeyName:
description: The key within the Secret that contains the OIDC
configuration as a YAML-encoded value.
description: Key in the Secret containing all OIDC properties
as a YAML value. If unset, each key is a property.
type: string
secretRef:
description: Reference to a Secret containing OIDC properties
(auth_discovery_url, client_id, client_secret, etc.).
description: Secret with OIDC properties (auth_discovery_url,
client_id, client_secret). issuerUrl takes precedence.
properties:
name:
default: ""
Expand All @@ -99,12 +99,11 @@ spec:
type: object
x-kubernetes-map-type: atomic
tokenEnvVar:
description: The name of the environment variable that Feast
SDK client pods (e.g.
description: Env var name for client pods to read an OIDC
token from. Sets token_env_var in client config.
type: string
verifySSL:
description: |-
Whether to verify SSL certificates when communicating with the OIDC provider.
description: Verify SSL certificates for the OIDC provider.
Defaults to true.
type: boolean
type: object
Expand Down Expand Up @@ -5787,32 +5786,31 @@ spec:
https://auth0.
properties:
caCertConfigMap:
description: Reference to a ConfigMap containing the CA
certificate for the OIDC provider.
description: ConfigMap with the CA certificate for self-signed
OIDC providers. Auto-detected on RHOAI/ODH.
properties:
key:
description: |-
Key within the ConfigMap that holds the CA certificate in PEM format.
Defaults to "ca-bundle.crt" if omitted.
description: Key in the ConfigMap holding the PEM
certificate. Defaults to "ca-bundle.crt".
type: string
name:
description: Name of the ConfigMap containing the
CA certificate.
description: ConfigMap name.
type: string
required:
- name
type: object
issuerUrl:
description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
description: OIDC issuer URL. The operator appends /.well-known/openid-configuration
to derive the discovery endpoint.
pattern: ^https://\S+$
type: string
secretKeyName:
description: The key within the Secret that contains the
OIDC configuration as a YAML-encoded value.
description: Key in the Secret containing all OIDC properties
as a YAML value. If unset, each key is a property.
type: string
secretRef:
description: Reference to a Secret containing OIDC properties
(auth_discovery_url, client_id, client_secret, etc.).
description: Secret with OIDC properties (auth_discovery_url,
client_id, client_secret). issuerUrl takes precedence.
properties:
name:
default: ""
Expand All @@ -5824,12 +5822,11 @@ spec:
type: object
x-kubernetes-map-type: atomic
tokenEnvVar:
description: The name of the environment variable that
Feast SDK client pods (e.g.
description: Env var name for client pods to read an OIDC
token from. Sets token_env_var in client config.
type: string
verifySSL:
description: |-
Whether to verify SSL certificates when communicating with the OIDC provider.
description: Verify SSL certificates for the OIDC provider.
Defaults to true.
type: boolean
type: object
Expand Down
59 changes: 28 additions & 31 deletions infra/feast-operator/config/crd/bases/feast.dev_featurestores.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,31 +63,31 @@ spec:
https://auth0.
properties:
caCertConfigMap:
description: Reference to a ConfigMap containing the CA certificate
for the OIDC provider.
description: ConfigMap with the CA certificate for self-signed
OIDC providers. Auto-detected on RHOAI/ODH.
properties:
key:
description: |-
Key within the ConfigMap that holds the CA certificate in PEM format.
Defaults to "ca-bundle.crt" if omitted.
description: Key in the ConfigMap holding the PEM certificate.
Defaults to "ca-bundle.crt".
type: string
name:
description: Name of the ConfigMap containing the CA certificate.
description: ConfigMap name.
type: string
required:
- name
type: object
issuerUrl:
description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
description: OIDC issuer URL. The operator appends /.well-known/openid-configuration
to derive the discovery endpoint.
pattern: ^https://\S+$
type: string
secretKeyName:
description: The key within the Secret that contains the OIDC
configuration as a YAML-encoded value.
description: Key in the Secret containing all OIDC properties
as a YAML value. If unset, each key is a property.
type: string
secretRef:
description: Reference to a Secret containing OIDC properties
(auth_discovery_url, client_id, client_secret, etc.).
description: Secret with OIDC properties (auth_discovery_url,
client_id, client_secret). issuerUrl takes precedence.
properties:
name:
default: ""
Expand All @@ -99,12 +99,11 @@ spec:
type: object
x-kubernetes-map-type: atomic
tokenEnvVar:
description: The name of the environment variable that Feast
SDK client pods (e.g.
description: Env var name for client pods to read an OIDC
token from. Sets token_env_var in client config.
type: string
verifySSL:
description: |-
Whether to verify SSL certificates when communicating with the OIDC provider.
description: Verify SSL certificates for the OIDC provider.
Defaults to true.
type: boolean
type: object
Expand Down Expand Up @@ -5787,32 +5786,31 @@ spec:
https://auth0.
properties:
caCertConfigMap:
description: Reference to a ConfigMap containing the CA
certificate for the OIDC provider.
description: ConfigMap with the CA certificate for self-signed
OIDC providers. Auto-detected on RHOAI/ODH.
properties:
key:
description: |-
Key within the ConfigMap that holds the CA certificate in PEM format.
Defaults to "ca-bundle.crt" if omitted.
description: Key in the ConfigMap holding the PEM
certificate. Defaults to "ca-bundle.crt".
type: string
name:
description: Name of the ConfigMap containing the
CA certificate.
description: ConfigMap name.
type: string
required:
- name
type: object
issuerUrl:
description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
description: OIDC issuer URL. The operator appends /.well-known/openid-configuration
to derive the discovery endpoint.
pattern: ^https://\S+$
type: string
secretKeyName:
description: The key within the Secret that contains the
OIDC configuration as a YAML-encoded value.
description: Key in the Secret containing all OIDC properties
as a YAML value. If unset, each key is a property.
type: string
secretRef:
description: Reference to a Secret containing OIDC properties
(auth_discovery_url, client_id, client_secret, etc.).
description: Secret with OIDC properties (auth_discovery_url,
client_id, client_secret). issuerUrl takes precedence.
properties:
name:
default: ""
Expand All @@ -5824,12 +5822,11 @@ spec:
type: object
x-kubernetes-map-type: atomic
tokenEnvVar:
description: The name of the environment variable that
Feast SDK client pods (e.g.
description: Env var name for client pods to read an OIDC
token from. Sets token_env_var in client config.
type: string
verifySSL:
description: |-
Whether to verify SSL certificates when communicating with the OIDC provider.
description: Verify SSL certificates for the OIDC provider.
Defaults to true.
type: boolean
type: object
Expand Down
Loading