feat(operator): Split server/client OIDC config and add secretKeyName…

…, tokenEnvVar, verifySSL CRD fields Signed-off-by: Aniket Paluskar <apaluska@redhat.com>
feast-dev · ntkathole · Apr 7, 2026 · Mar 10, 2026 · Mar 10, 2026 · Mar 10, 2026
commit 593b95d894e4d083d434f1fdeeb6bcc5598dabb2
@@ -709,6 +709,21 @@ type KubernetesAuthz struct {
 // https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
 type OidcAuthz struct {
 	SecretRef corev1.LocalObjectReference `json:"secretRef"`
+	// The key within the Secret that contains the OIDC configuration as a YAML-encoded value.
+	// When set, only this key is read and its YAML value is expected to contain the OIDC properties
+	// (e.g. client_id, auth_discovery_url). This allows sharing a single Secret across services.
+	// When unset, each top-level key in the Secret is treated as a separate OIDC property.
+	// +optional
+	SecretKeyName string `json:"secretKeyName,omitempty"`
+	// The name of the environment variable that client pods will use to read a pre-existing OIDC token.
+	// When set, the client feature_store.yaml will include token_env_var with this value.
+	// When unset, the client config is bare `type: oidc` which falls back to FEAST_OIDC_TOKEN or the pod's SA token.
+	// +optional
+	TokenEnvVar *string `json:"tokenEnvVar,omitempty"`
+	// Whether to verify SSL certificates when communicating with the OIDC provider.
+	// Defaults to true. Set to false for self-signed certificates (common in internal OpenShift clusters).
+	// +optional
+	VerifySSL *bool `json:"verifySSL,omitempty"`
 }
 
 // TlsConfigs configures server TLS for a feast service. in an openshift cluster, this is configured by default using service serving certificates.

@@ -50,7 +50,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2026-03-10T20:00:10Z"
+    createdAt: "2026-03-24T07:09:46Z"
     operators.operatorframework.io/builder: operator-sdk-v1.38.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: feast-operator.v0.61.0

@@ -62,6 +62,10 @@ spec:
                       OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                       https://auth0.
                     properties:
+                      secretKeyName:
+                        description: The key within the Secret that contains the OIDC
+                          configuration as a YAML-encoded value.
+                        type: string
                       secretRef:
                         description: |-
                           LocalObjectReference contains enough information to let you locate the
@@ -76,6 +80,15 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
+                      tokenEnvVar:
+                        description: The name of the environment variable that client
+                          pods will use to read a pre-existing OIDC token.
+                        type: string
+                      verifySSL:
+                        description: |-
+                          Whether to verify SSL certificates when communicating with the OIDC provider.
+                          Defaults to true.
+                        type: boolean
                     required:
                     - secretRef
                     type: object
@@ -3129,6 +3142,10 @@ spec:
                     x-kubernetes-validations:
                     - message: One selection required.
                       rule: '[has(self.local), has(self.remote)].exists_one(c, c)'
+                  runFeastApplyOnInit:
+                    description: Runs feast apply on pod start to populate the registry.
+                      Defaults to true. Ignored when DisableInitContainers is true.
+                    type: boolean
                   scaling:
                     description: Scaling configures horizontal scaling for the FeatureStore
                       deployment (e.g. HPA autoscaling).
@@ -5695,7 +5712,6 @@ spec:
                 type: object
             required:
             - feastProject
-            - replicas
             type: object
             x-kubernetes-validations:
             - message: replicas > 1 and services.scaling.autoscaling are mutually
@@ -5754,6 +5770,10 @@ spec:
                           OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                           https://auth0.
                         properties:
+                          secretKeyName:
+                            description: The key within the Secret that contains the
+                              OIDC configuration as a YAML-encoded value.
+                            type: string
                           secretRef:
                             description: |-
                               LocalObjectReference contains enough information to let you locate the
@@ -5768,6 +5788,15 @@ spec:
                                 type: string
                             type: object
                             x-kubernetes-map-type: atomic
+                          tokenEnvVar:
+                            description: The name of the environment variable that
+                              client pods will use to read a pre-existing OIDC token.
+                            type: string
+                          verifySSL:
+                            description: |-
+                              Whether to verify SSL certificates when communicating with the OIDC provider.
+                              Defaults to true.
+                            type: boolean
                         required:
                         - secretRef
                         type: object
@@ -8871,6 +8900,11 @@ spec:
                         - message: One selection required.
                           rule: '[has(self.local), has(self.remote)].exists_one(c,
                             c)'
+                      runFeastApplyOnInit:
+                        description: Runs feast apply on pod start to populate the
+                          registry. Defaults to true. Ignored when DisableInitContainers
+                          is true.
+                        type: boolean
                       scaling:
                         description: Scaling configures horizontal scaling for the
                           FeatureStore deployment (e.g. HPA autoscaling).
@@ -11458,7 +11492,6 @@ spec:
                     type: object
                 required:
                 - feastProject
-                - replicas
                 type: object
                 x-kubernetes-validations:
                 - message: replicas > 1 and services.scaling.autoscaling are mutually
@@ -13920,6 +13953,10 @@ spec:
                     x-kubernetes-validations:
                     - message: One selection required.
                       rule: '[has(self.local), has(self.remote)].exists_one(c, c)'
+                  runFeastApplyOnInit:
+                    description: Runs feast apply on pod start to populate the registry.
+                      Defaults to true. Ignored when DisableInitContainers is true.
+                    type: boolean
                   securityContext:
                     description: PodSecurityContext holds pod-level security attributes
                       and common container settings.
@@ -18163,6 +18200,11 @@ spec:
                         - message: One selection required.
                           rule: '[has(self.local), has(self.remote)].exists_one(c,
                             c)'
+                      runFeastApplyOnInit:
+                        description: Runs feast apply on pod start to populate the
+                          registry. Defaults to true. Ignored when DisableInitContainers
+                          is true.
+                        type: boolean
                       securityContext:
                         description: PodSecurityContext holds pod-level security attributes
                           and common container settings.

@@ -62,6 +62,10 @@ spec:
                       OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                       https://auth0.
                     properties:
+                      secretKeyName:
+                        description: The key within the Secret that contains the OIDC
+                          configuration as a YAML-encoded value.
+                        type: string
                       secretRef:
                         description: |-
                           LocalObjectReference contains enough information to let you locate the
@@ -76,6 +80,15 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
+                      tokenEnvVar:
+                        description: The name of the environment variable that client
+                          pods will use to read a pre-existing OIDC token.
+                        type: string
+                      verifySSL:
+                        description: |-
+                          Whether to verify SSL certificates when communicating with the OIDC provider.
+                          Defaults to true.
+                        type: boolean
                     required:
                     - secretRef
                     type: object
@@ -5757,6 +5770,10 @@ spec:
                           OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                           https://auth0.
                         properties:
+                          secretKeyName:
+                            description: The key within the Secret that contains the
+                              OIDC configuration as a YAML-encoded value.
+                            type: string
                           secretRef:
                             description: |-
                               LocalObjectReference contains enough information to let you locate the
@@ -5771,6 +5788,15 @@ spec:
                                 type: string
                             type: object
                             x-kubernetes-map-type: atomic
+                          tokenEnvVar:
+                            description: The name of the environment variable that
+                              client pods will use to read a pre-existing OIDC token.
+                            type: string
+                          verifySSL:
+                            description: |-
+                              Whether to verify SSL certificates when communicating with the OIDC provider.
+                              Defaults to true.
+                            type: boolean
                         required:
                         - secretRef
                         type: object

diff --git a/infra/feast-operator/config/manager/kustomization.yaml b/infra/feast-operator/config/manager/kustomization.yaml
@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
-  newName: quay.io/feastdev/feast-operator
-  newTag: 0.61.0
+  newName: quay.io/aniket-redhat/feast-operator
+  newTag: oidc-op-0.1
@@ -70,6 +70,10 @@ spec:
                       OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                       https://auth0.
                     properties:
+                      secretKeyName:
+                        description: The key within the Secret that contains the OIDC
+                          configuration as a YAML-encoded value.
+                        type: string
                       secretRef:
                         description: |-
                           LocalObjectReference contains enough information to let you locate the
@@ -84,6 +88,15 @@ spec:
                             type: string
                         type: object
                         x-kubernetes-map-type: atomic
+                      tokenEnvVar:
+                        description: The name of the environment variable that client
+                          pods will use to read a pre-existing OIDC token.
+                        type: string
+                      verifySSL:
+                        description: |-
+                          Whether to verify SSL certificates when communicating with the OIDC provider.
+                          Defaults to true.
+                        type: boolean
                     required:
                     - secretRef
                     type: object
@@ -5765,6 +5778,10 @@ spec:
                           OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                           https://auth0.
                         properties:
+                          secretKeyName:
+                            description: The key within the Secret that contains the
+                              OIDC configuration as a YAML-encoded value.
+                            type: string
                           secretRef:
                             description: |-
                               LocalObjectReference contains enough information to let you locate the
@@ -5779,6 +5796,15 @@ spec:
                                 type: string
                             type: object
                             x-kubernetes-map-type: atomic
+                          tokenEnvVar:
+                            description: The name of the environment variable that
+                              client pods will use to read a pre-existing OIDC token.
+                            type: string
+                          verifySSL:
+                            description: |-
+                              Whether to verify SSL certificates when communicating with the OIDC provider.
+                              Defaults to true.
+                            type: boolean
                         required:
                         - secretRef
                         type: object

@@ -543,6 +543,15 @@ _Appears in:_
 | Field | Description |
 | --- | --- |
 | `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#localobjectreference-v1-core)_ |  |
+| `secretKeyName` _string_ | The key within the Secret that contains the OIDC configuration as a YAML-encoded value.
+When set, only this key is read and its YAML value is expected to contain the OIDC properties
+(e.g. client_id, auth_discovery_url). This allows sharing a single Secret across services.
+When unset, each top-level key in the Secret is treated as a separate OIDC property. |
+| `tokenEnvVar` _string_ | The name of the environment variable that client pods will use to read a pre-existing OIDC token.
+When set, the client feature_store.yaml will include token_env_var with this value.
+When unset, the client config is bare `type: oidc` which falls back to FEAST_OIDC_TOKEN or the pod's SA token. |
+| `verifySSL` _boolean_ | Whether to verify SSL certificates when communicating with the OIDC provider.
+Defaults to true. Set to false for self-signed certificates (common in internal OpenShift clusters). |
 
 
 #### OnlineStore

@@ -496,12 +496,6 @@ func expectedServerOidcAuthorizConfig() services.AuthzConfig {
 func expectedClientOidcAuthorizConfig() services.AuthzConfig {
 	return services.AuthzConfig{
 		Type: services.OidcAuthType,
-		OidcParameters: map[string]interface{}{
-			string(services.OidcClientId):         "client-id",
-			string(services.OidcAuthDiscoveryUrl): "auth-discovery-url",
-			string(services.OidcClientSecret):     "client-secret",
-			string(services.OidcUsername):         "username",
-			string(services.OidcPassword):         "password"},
 	}
 }
 

@@ -101,24 +101,34 @@ func getBaseServiceRepoConfig(
 	if isRemoteRegistry(featureStore) {
 		repoConfig.Registry = clientRepoConfig.Registry
 	}
-	repoConfig.AuthzConfig = clientRepoConfig.AuthzConfig
-
 	appliedSpec := featureStore.Status.Applied
 	if appliedSpec.AuthzConfig != nil && appliedSpec.AuthzConfig.OidcAuthz != nil {
-		propertiesMap, authSecretErr := secretExtractionFunc("", appliedSpec.AuthzConfig.OidcAuthz.SecretRef.Name, "")
+		repoConfig.AuthzConfig = AuthzConfig{Type: OidcAuthType}
+
+		propertiesMap, authSecretErr := secretExtractionFunc("", appliedSpec.AuthzConfig.OidcAuthz.SecretRef.Name, appliedSpec.AuthzConfig.OidcAuthz.SecretKeyName)
 		if authSecretErr != nil {
 			return repoConfig, authSecretErr
 		}
 
 		oidcParameters := map[string]interface{}{}
-		for _, oidcProperty := range OidcProperties {
+		for _, oidcProperty := range OidcServerProperties {
 			if val, exists := propertiesMap[string(oidcProperty)]; exists {
 				oidcParameters[string(oidcProperty)] = val
 			} else {
 				return repoConfig, missingOidcSecretProperty(oidcProperty)
 			}
 		}
+		for _, oidcProperty := range OidcOptionalSecretProperties {
+			if val, exists := propertiesMap[string(oidcProperty)]; exists {
+				oidcParameters[string(oidcProperty)] = val
+			}
+		}
+		if appliedSpec.AuthzConfig.OidcAuthz.VerifySSL != nil {
+			oidcParameters[string(OidcVerifySsl)] = *appliedSpec.AuthzConfig.OidcAuthz.VerifySSL
+		}
 		repoConfig.AuthzConfig.OidcParameters = oidcParameters
+	} else {
+		repoConfig.AuthzConfig = clientRepoConfig.AuthzConfig
 	}
 
 	return repoConfig, nil
@@ -356,21 +366,13 @@ func getRepoConfig(
 			repoConfig.AuthzConfig = AuthzConfig{
 				Type: OidcAuthType,
 			}
-
-			propertiesMap, err := secretExtractionFunc("", status.Applied.AuthzConfig.OidcAuthz.SecretRef.Name, "")
-			if err != nil {
-				return repoConfig, err
-			}
-
 			oidcClientProperties := map[string]interface{}{}
-			for _, oidcProperty := range OidcProperties {
-				if val, exists := propertiesMap[string(oidcProperty)]; exists {
-					oidcClientProperties[string(oidcProperty)] = val
-				} else {
-					return repoConfig, missingOidcSecretProperty(oidcProperty)
-				}
+			if status.Applied.AuthzConfig.OidcAuthz.TokenEnvVar != nil {
+				oidcClientProperties[string(OidcTokenEnvVar)] = *status.Applied.AuthzConfig.OidcAuthz.TokenEnvVar
+			}
+			if len(oidcClientProperties) > 0 {
+				repoConfig.AuthzConfig.OidcParameters = oidcClientProperties
 			}
-			repoConfig.AuthzConfig.OidcParameters = oidcClientProperties
 		}
 	}
 	return repoConfig, nil