Follow-up to #6682. PR #6683 adds two OIDC options to the Python SDK, jwks_cache_lifespan_seconds and jwks_request_timeout_seconds, which tune how long the server reuses a fetched JWK set and how long a JWKS fetch may block request serving. Requested in the #6683 review: expose them through the operator too.
Unlike audience and issuer (#6676/#6677), these are not IdP-coupled values and don't belong in the OIDC Secret. They're operational knobs in the same family as verifySSL and caCertConfigMap, which the operator already exposes as CR fields on OidcAuthz and copies into the generated feature_store.yaml. So the plan is to follow that pattern:
- Add two optional fields to
OidcAuthz in api/v1/featurestore_types.go, with the same defaults as the SDK (300 seconds and 10 seconds) and a positive-value constraint matching the SDK's validation.
- Copy them into
oidcParameters in repo_config.go when set, the way VerifySSL already is.
- Regenerate the CRD manifests, and add tests plus a note in the operator security guide.
Worth noting for reviewers that the cache lifespan is not purely a performance setting: it also bounds how long a key the IdP has revoked continues to validate tokens, so operators with aggressive rotation may want to lower it.
Best done after #6683 merges and ships, since the operator would otherwise generate config that older feature server images reject.
Follow-up to #6682. PR #6683 adds two OIDC options to the Python SDK,
jwks_cache_lifespan_secondsandjwks_request_timeout_seconds, which tune how long the server reuses a fetched JWK set and how long a JWKS fetch may block request serving. Requested in the #6683 review: expose them through the operator too.Unlike
audienceandissuer(#6676/#6677), these are not IdP-coupled values and don't belong in the OIDC Secret. They're operational knobs in the same family asverifySSLandcaCertConfigMap, which the operator already exposes as CR fields onOidcAuthzand copies into the generatedfeature_store.yaml. So the plan is to follow that pattern:OidcAuthzinapi/v1/featurestore_types.go, with the same defaults as the SDK (300 seconds and 10 seconds) and a positive-value constraint matching the SDK's validation.oidcParametersinrepo_config.gowhen set, the wayVerifySSLalready is.Worth noting for reviewers that the cache lifespan is not purely a performance setting: it also bounds how long a key the IdP has revoked continues to validate tokens, so operators with aggressive rotation may want to lower it.
Best done after #6683 merges and ships, since the operator would otherwise generate config that older feature server images reject.