Add issuerUrl to OidcAuthz CRD and OIDC_ISSUER_URL env var support fo…

…r Secret-less OIDC configuration Signed-off-by: Aniket Paluskar <apaluska@redhat.com>
ntkathole · Apr 7, 2026 · Mar 10, 2026 · Mar 10, 2026 · Mar 10, 2026 · Mar 10, 2026
commit 3557a15af54b0892d39b9c876e64e373954df068
@@ -708,7 +708,16 @@ type KubernetesAuthz struct {
 // OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
 // https://auth0.com/docs/authenticate/protocols/openid-connect-protocol
 type OidcAuthz struct {
-	SecretRef corev1.LocalObjectReference `json:"secretRef"`
+	// The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+	// The operator derives the OIDC discovery endpoint by appending /.well-known/openid-configuration.
+	// When set, no Secret is required for basic OIDC authentication.
+	// +optional
+	// +kubebuilder:validation:Pattern=`^https://\S+$`
+	IssuerUrl string `json:"issuerUrl,omitempty"`
+	// Reference to a Secret containing OIDC properties (auth_discovery_url, client_id, client_secret, etc.).
+	// When both issuerUrl and a Secret with auth_discovery_url are provided, issuerUrl takes precedence.
+	// +optional
+	SecretRef *corev1.LocalObjectReference `json:"secretRef,omitempty"`
 	// The key within the Secret that contains the OIDC configuration as a YAML-encoded value.
 	// When set, only this key is read and its YAML value is expected to contain the OIDC properties
 	// (e.g. client_id, auth_discovery_url). This allows sharing a single Secret across services.

@@ -50,7 +50,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2026-03-24T07:09:46Z"
+    createdAt: "2026-04-06T12:13:16Z"
     operators.operatorframework.io/builder: operator-sdk-v1.38.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: feast-operator.v0.61.0
@@ -175,6 +175,17 @@ spec:
           - get
           - patch
           - update
+        - apiGroups:
+          - monitoring.coreos.com
+          resources:
+          - servicemonitors
+          verbs:
+          - create
+          - delete
+          - get
+          - list
+          - patch
+          - watch
         - apiGroups:
           - policy
           resources:
@@ -259,6 +270,7 @@ spec:
                   value: quay.io/feastdev/feature-server:0.61.0
                 - name: RELATED_IMAGE_CRON_JOB
                   value: quay.io/openshift/origin-cli:4.17
+                - name: OIDC_ISSUER_URL
                 image: quay.io/feastdev/feast-operator:0.61.0
                 livenessProbe:
                   httpGet:

@@ -62,14 +62,17 @@ spec:
                       OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                       https://auth0.
                     properties:
+                      issuerUrl:
+                        description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+                        pattern: ^https://\S+$
+                        type: string
                       secretKeyName:
                         description: The key within the Secret that contains the OIDC
                           configuration as a YAML-encoded value.
                         type: string
                       secretRef:
-                        description: |-
-                          LocalObjectReference contains enough information to let you locate the
-                          referenced object inside the same namespace.
+                        description: Reference to a Secret containing OIDC properties
+                          (auth_discovery_url, client_id, client_secret, etc.).
                         properties:
                           name:
                             default: ""
@@ -81,16 +84,14 @@ spec:
                         type: object
                         x-kubernetes-map-type: atomic
                       tokenEnvVar:
-                        description: The name of the environment variable that client
-                          pods will use to read a pre-existing OIDC token.
+                        description: The name of the environment variable that Feast
+                          SDK client pods (e.g.
                         type: string
                       verifySSL:
                         description: |-
                           Whether to verify SSL certificates when communicating with the OIDC provider.
                           Defaults to true.
                         type: boolean
-                    required:
-                    - secretRef
                     type: object
                 type: object
                 x-kubernetes-validations:
@@ -5770,14 +5771,17 @@ spec:
                           OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                           https://auth0.
                         properties:
+                          issuerUrl:
+                            description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+                            pattern: ^https://\S+$
+                            type: string
                           secretKeyName:
                             description: The key within the Secret that contains the
                               OIDC configuration as a YAML-encoded value.
                             type: string
                           secretRef:
-                            description: |-
-                              LocalObjectReference contains enough information to let you locate the
-                              referenced object inside the same namespace.
+                            description: Reference to a Secret containing OIDC properties
+                              (auth_discovery_url, client_id, client_secret, etc.).
                             properties:
                               name:
                                 default: ""
@@ -5790,15 +5794,13 @@ spec:
                             x-kubernetes-map-type: atomic
                           tokenEnvVar:
                             description: The name of the environment variable that
-                              client pods will use to read a pre-existing OIDC token.
+                              Feast SDK client pods (e.g.
                             type: string
                           verifySSL:
                             description: |-
                               Whether to verify SSL certificates when communicating with the OIDC provider.
                               Defaults to true.
                             type: boolean
-                        required:
-                        - secretRef
                         type: object
                     type: object
                     x-kubernetes-validations:

@@ -62,14 +62,17 @@ spec:
                       OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                       https://auth0.
                     properties:
+                      issuerUrl:
+                        description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+                        pattern: ^https://\S+$
+                        type: string
                       secretKeyName:
                         description: The key within the Secret that contains the OIDC
                           configuration as a YAML-encoded value.
                         type: string
                       secretRef:
-                        description: |-
-                          LocalObjectReference contains enough information to let you locate the
-                          referenced object inside the same namespace.
+                        description: Reference to a Secret containing OIDC properties
+                          (auth_discovery_url, client_id, client_secret, etc.).
                         properties:
                           name:
                             default: ""
@@ -81,16 +84,14 @@ spec:
                         type: object
                         x-kubernetes-map-type: atomic
                       tokenEnvVar:
-                        description: The name of the environment variable that client
-                          pods will use to read a pre-existing OIDC token.
+                        description: The name of the environment variable that Feast
+                          SDK client pods (e.g.
                         type: string
                       verifySSL:
                         description: |-
                           Whether to verify SSL certificates when communicating with the OIDC provider.
                           Defaults to true.
                         type: boolean
-                    required:
-                    - secretRef
                     type: object
                 type: object
                 x-kubernetes-validations:
@@ -5770,14 +5771,17 @@ spec:
                           OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                           https://auth0.
                         properties:
+                          issuerUrl:
+                            description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+                            pattern: ^https://\S+$
+                            type: string
                           secretKeyName:
                             description: The key within the Secret that contains the
                               OIDC configuration as a YAML-encoded value.
                             type: string
                           secretRef:
-                            description: |-
-                              LocalObjectReference contains enough information to let you locate the
-                              referenced object inside the same namespace.
+                            description: Reference to a Secret containing OIDC properties
+                              (auth_discovery_url, client_id, client_secret, etc.).
                             properties:
                               name:
                                 default: ""
@@ -5790,15 +5794,13 @@ spec:
                             x-kubernetes-map-type: atomic
                           tokenEnvVar:
                             description: The name of the environment variable that
-                              client pods will use to read a pre-existing OIDC token.
+                              Feast SDK client pods (e.g.
                             type: string
                           verifySSL:
                             description: |-
                               Whether to verify SSL certificates when communicating with the OIDC provider.
                               Defaults to true.
                             type: boolean
-                        required:
-                        - secretRef
                         type: object
                     type: object
                     x-kubernetes-validations:

diff --git a/infra/feast-operator/config/manager/kustomization.yaml b/infra/feast-operator/config/manager/kustomization.yaml
@@ -4,5 +4,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 images:
 - name: controller
-  newName: quay.io/feastdev/feast-operator
-  newTag: 0.61.0
+  newName: quay.io/aniket-redhat/feast-operator
+  newTag: oidc-op-0.4
@@ -70,14 +70,17 @@ spec:
                       OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                       https://auth0.
                     properties:
+                      issuerUrl:
+                        description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+                        pattern: ^https://\S+$
+                        type: string
                       secretKeyName:
                         description: The key within the Secret that contains the OIDC
                           configuration as a YAML-encoded value.
                         type: string
                       secretRef:
-                        description: |-
-                          LocalObjectReference contains enough information to let you locate the
-                          referenced object inside the same namespace.
+                        description: Reference to a Secret containing OIDC properties
+                          (auth_discovery_url, client_id, client_secret, etc.).
                         properties:
                           name:
                             default: ""
@@ -89,16 +92,14 @@ spec:
                         type: object
                         x-kubernetes-map-type: atomic
                       tokenEnvVar:
-                        description: The name of the environment variable that client
-                          pods will use to read a pre-existing OIDC token.
+                        description: The name of the environment variable that Feast
+                          SDK client pods (e.g.
                         type: string
                       verifySSL:
                         description: |-
                           Whether to verify SSL certificates when communicating with the OIDC provider.
                           Defaults to true.
                         type: boolean
-                    required:
-                    - secretRef
                     type: object
                 type: object
                 x-kubernetes-validations:
@@ -5778,14 +5779,17 @@ spec:
                           OidcAuthz defines the authorization settings for deployments using an Open ID Connect identity provider.
                           https://auth0.
                         properties:
+                          issuerUrl:
+                            description: The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+                            pattern: ^https://\S+$
+                            type: string
                           secretKeyName:
                             description: The key within the Secret that contains the
                               OIDC configuration as a YAML-encoded value.
                             type: string
                           secretRef:
-                            description: |-
-                              LocalObjectReference contains enough information to let you locate the
-                              referenced object inside the same namespace.
+                            description: Reference to a Secret containing OIDC properties
+                              (auth_discovery_url, client_id, client_secret, etc.).
                             properties:
                               name:
                                 default: ""
@@ -5798,15 +5802,13 @@ spec:
                             x-kubernetes-map-type: atomic
                           tokenEnvVar:
                             description: The name of the environment variable that
-                              client pods will use to read a pre-existing OIDC token.
+                              Feast SDK client pods (e.g.
                             type: string
                           verifySSL:
                             description: |-
                               Whether to verify SSL certificates when communicating with the OIDC provider.
                               Defaults to true.
                             type: boolean
-                        required:
-                        - secretRef
                         type: object
                     type: object
                     x-kubernetes-validations:
@@ -20609,6 +20611,8 @@ spec:
           value: quay.io/feastdev/feature-server:0.61.0
         - name: RELATED_IMAGE_CRON_JOB
           value: quay.io/openshift/origin-cli:4.17
+        - name: OIDC_ISSUER_URL
+          value: ""
         image: quay.io/feastdev/feast-operator:0.61.0
         livenessProbe:
           httpGet:

@@ -542,12 +542,17 @@ _Appears in:_
 
 | Field | Description |
 | --- | --- |
-| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#localobjectreference-v1-core)_ |  |
+| `issuerUrl` _string_ | The OIDC issuer URL (e.g. "https://keycloak.example.com/realms/myrealm").
+The operator derives the OIDC discovery endpoint by appending /.well-known/openid-configuration.
+When set, no Secret is required for basic OIDC authentication. |
+| `secretRef` _[LocalObjectReference](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#localobjectreference-v1-core)_ | Reference to a Secret containing OIDC properties (auth_discovery_url, client_id, client_secret, etc.).
+When both issuerUrl and a Secret with auth_discovery_url are provided, issuerUrl takes precedence. |
 | `secretKeyName` _string_ | The key within the Secret that contains the OIDC configuration as a YAML-encoded value.
 When set, only this key is read and its YAML value is expected to contain the OIDC properties
 (e.g. client_id, auth_discovery_url). This allows sharing a single Secret across services.
 When unset, each top-level key in the Secret is treated as a separate OIDC property. |
-| `tokenEnvVar` _string_ | The name of the environment variable that client pods will use to read a pre-existing OIDC token.
+| `tokenEnvVar` _string_ | The name of the environment variable that Feast SDK client pods (e.g. workbenches, application pods)
+will read a pre-existing OIDC token from.
 When set, the client feature_store.yaml will include token_env_var with this value.
 When unset, the client config is bare `type: oidc` which falls back to FEAST_OIDC_TOKEN or the pod's SA token. |
 | `verifySSL` _boolean_ | Whether to verify SSL certificates when communicating with the OIDC provider.

@@ -77,7 +77,7 @@ var _ = Describe("FeatureStore Controller-OIDC authorization", func() {
 			if err != nil && errors.IsNotFound(err) {
 				resource := createFeatureStoreResource(resourceName, image, pullPolicy, &[]corev1.EnvVar{}, withEnvFrom())
 				resource.Spec.AuthzConfig = &feastdevv1.AuthzConfig{OidcAuthz: &feastdevv1.OidcAuthz{
-					SecretRef: corev1.LocalObjectReference{
+					SecretRef: &corev1.LocalObjectReference{
 						Name: oidcSecretName,
 					},
 				}}
@@ -134,7 +134,7 @@ var _ = Describe("FeatureStore Controller-OIDC authorization", func() {
 			Expect(resource.Status.Applied.FeastProject).To(Equal(resource.Spec.FeastProject))
 			expectedAuthzConfig := &feastdevv1.AuthzConfig{
 				OidcAuthz: &feastdevv1.OidcAuthz{
-					SecretRef: corev1.LocalObjectReference{
+					SecretRef: &corev1.LocalObjectReference{
 						Name: oidcSecretName,
 					},
 				},
@@ -476,7 +476,7 @@ var _ = Describe("FeatureStore Controller-OIDC authorization", func() {
 			Expect(cond.Status).To(Equal(metav1.ConditionFalse))
 			Expect(cond.Reason).To(Equal(feastdevv1.FailedReason))
 			Expect(cond.Type).To(Equal(feastdevv1.ReadyType))
-			Expect(cond.Message).To(ContainSubstring("missing OIDC"))
+			Expect(cond.Message).To(ContainSubstring("OIDC discovery URL"))
 		})
 	})
 })