Skip to content

feat: Add packaged feature repository support to Feast Operator - #6652

Merged
ntkathole merged 1 commit into
feast-dev:masterfrom
ShumzZzZz:feat/feast-operator-packaged-feature-repository
Jul 31, 2026
Merged

feat: Add packaged feature repository support to Feast Operator#6652
ntkathole merged 1 commit into
feast-dev:masterfrom
ShumzZzZz:feat/feast-operator-packaged-feature-repository

Conversation

@ShumzZzZz

@ShumzZzZz ShumzZzZz commented Jul 29, 2026

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

This PR adds spec.feastProjectDir.packaged, allowing the Feast Operator to use a feature repository packaged inside a container image.

The Operator currently supports creating a feature repository through git clone or feast init. In air-gapped and artifact-based deployment environments, feature definitions and their Python dependencies are commonly distributed as an immutable container image. The existing workflow requires disabling init containers, configuring images separately for each service, and coordinating feast apply through a separate CI/CD, CronJob, or manual workflow. It also does not provide a first-class way to declare where the packaged repository is located in the image. Therefore a failed feast apply is surfaced only after the rollout, allowing a service to start against stale or missing definitions

The new packaged repository mode accepts:

  • image: the image containing the feature repository.
  • featureRepoPath: the absolute path to the repository inside that image.

It supports two lifecycle modes:

  1. [packaged objects + CR-generated YAML]
    With init containers enabled, feast-init copies the packaged repository into the Operator-managed shared directory, replaces its feature_store.yaml with the configuration generated from the FeatureStore CR, and feast-apply registers the definitions before the Feast services start.
  2. [packaged image as is]
    With init containers disabled, services run directly from the packaged repository path and use its baked feature_store.yaml.

The packaged image is used by default for repository initialization, feast apply, and Feast services. Explicit per-service images continue to take precedence.

This enables:

  • Air-gapped deployments without runtime access to a Git repository.
  • An invalid path, missing repository, or failed feast apply is surfaced during pod initialization
  • Reproducible promotion of feature definitions and their Python dependencies as one immutable artifact.
  • Separation between teams publishing feature definitions and teams managing environment-specific FeatureStore CR configuration through GitOps.
  • Consistent dependencies across repository initialization, feast apply, and feature serving.
  • Reduced image configuration duplication across Feast services.

The existing git and init repository modes remain unchanged.

Which issue(s) this PR fixes:

N/A — no linked issue.

Checks

  • I've made sure the tests are passing.
  • My commits are signed off (git commit -s)
  • My PR title follows conventional commits format

Testing Strategy

  • Unit tests
  • Integration tests
  • Manual tests
  • Testing is not required for this change

Focused Feast Operator controller tests:

GOWORK=off KUBEBUILDER_ASSETS=<envtest-assets> go test ./internal/controller -count=1

The controller test suite covers:

  • Staging a packaged repository and applying it from the shared directory.
  • Direct use of the packaged repository when init containers are disabled.
  • Packaged-image precedence and explicit per-service image overrides.
  • Fallback behavior when the packaged image is omitted.
  • Validation of absolute, non-root repository paths.
  • Mutual exclusivity between packaged, git, and init.

@ShumzZzZz
ShumzZzZz requested a review from a team as a code owner July 29, 2026 03:47

@franciscojavierarceo franciscojavierarceo left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The packaged repository path validation can be bypassed by non-canonical absolute paths. For example, /opt/.. passes the CEL rules (startsWith('/') and not equal to /), but path.Clean() turns it into /; the init script then executes cp -a -- "${FEAST_PACKAGED_FEATURE_REPO_PATH}/." ..., potentially copying the entire image filesystem (including secrets) into the shared repository volume. Please validate the cleaned path, reject .. traversal segments/root, and add cases such as /opt/.., /../x, and repeated separators to both API-version test suites.

@ShumzZzZz

Copy link
Copy Markdown
Contributor Author

@franciscojavierarceo thanks for flagging out!
Fixed, and also added another validation rule: the packaged path also must not equal, contain, or be contained by the staged repository path (/feast-data). Please take another look when you are available.

@ShumzZzZz
ShumzZzZz force-pushed the feat/feast-operator-packaged-feature-repository branch from 5b3985b to 509f8d7 Compare July 29, 2026 17:35
@codecov-commenter

codecov-commenter commented Jul 30, 2026

Copy link
Copy Markdown

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.45%. Comparing base (a13ed7b) to head (d3b41e3).
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #6652      +/-   ##
==========================================
- Coverage   46.46%   46.45%   -0.01%     
==========================================
  Files         414      414              
  Lines       50138    50138              
  Branches     7173     7173              
==========================================
- Hits        23295    23292       -3     
- Misses      25204    25205       +1     
- Partials     1639     1641       +2     
Flag Coverage Δ
go-feature-server 30.53% <ø> (-0.06%) ⬇️
python-unit 47.76% <ø> (-0.01%) ⬇️
see 2 files with indirect coverage changes

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update a13ed7b...d3b41e3. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@ShumzZzZz

Copy link
Copy Markdown
Contributor Author

added a commit to fix init image precedence for a recent merged PR #6598

@ntkathole

Copy link
Copy Markdown
Member

@ShumzZzZz can you please rebase and squash, I am not able to rebase as still showing conflicts

@ShumzZzZz
ShumzZzZz force-pushed the feat/feast-operator-packaged-feature-repository branch from 8123bd7 to a16e787 Compare July 31, 2026 05:26
Add spec.feastProjectDir.packaged for repositories distributed in feature server images, including staged and direct-use lifecycle modes, canonical path validation, generated CRD artifacts, documentation, and tests.

Integrate the init image override introduced by feast-dev#6598 with this precedence: services.initImage, packaged.image, RELATED_IMAGE_FEATURE_SERVER, then DefaultImage.

Signed-off-by: Shumin <shumin.zheng@outlook.com>
@ShumzZzZz
ShumzZzZz force-pushed the feat/feast-operator-packaged-feature-repository branch from a16e787 to d3b41e3 Compare July 31, 2026 05:30
@ShumzZzZz

ShumzZzZz commented Jul 31, 2026

Copy link
Copy Markdown
Contributor Author

@ntkathole yeah I saw another PR got merged and every time new PR gets merged, the .secrets.baseline will need to be updated, even the actual source code changes do not conflict, as long as the Go files have been touched, this happens... please take a look when available, thanks!

Also the failed task does not seem to be related to this PR.

@ntkathole ntkathole left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

looks good

@ntkathole
ntkathole merged commit 8112b1e into feast-dev:master Jul 31, 2026
32 of 34 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants