Visitar URL original
feat: Expose the OIDC JWKS tunables through the operator by larrysingleton007 · Pull Request #6690 · feast-dev/feast · GitHub
Skip to content

feat: Expose the OIDC JWKS tunables through the operator #6690

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntkathole merged 3 commits into from
Aug 14, 2026
Merged

feat: Expose the OIDC JWKS tunables through the operator #6690

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
183472e
feat: Expose the OIDC JWKS tunables through the operator
larrysingleton007 Jul 31, 2026
c8fdd65
fix: Regenerate the OLM bundle and close review gaps
larrysingleton007 Jul 31, 2026
b2609bb
docs: State that the OIDC authz options require apiVersion v1
larrysingleton007 Aug 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
docs: State that the OIDC authz options require apiVersion v1 
The CRD serves v1alpha1 alongside v1 with no conversion webhook, so a
resource submitted as v1alpha1 is validated against the v1alpha1 schema and
any field outside it is pruned without error. Under v1alpha1, authz.oidc
accepts only secretRef, so every other option is silently dropped.

This predates the JWKS settings: v1alpha1 has never carried issuerUrl,
secretKeyName, tokenEnvVar, verifySSL or caCertConfigMap either, all of
which landed v1-only in 7c04026. Documenting the whole section rather
than the two new fields keeps the guidance consistent with that.

The v1alpha1 schema already enforces this - the fields cannot be expressed
there - so no validation change is needed, only the missing warning.

Signed-off-by: Larry Singleton <166439969+larrysingleton007@users.noreply.github.com>
  • Loading branch information
@larrysingleton007 @ntkathole
larrysingleton007 authored and ntkathole committed Aug 14, 2026
commit b2609bb0c71c6437a4a2ca43956c2f22ee7ae585
9 changes: 9 additions & 0 deletions docs/how-to-guides/feast-operator/05-security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,15 @@ spec:

### Advanced OIDC options

{% hint style="warning" %}
Every option in this section requires `apiVersion: feast.dev/v1`. Under the deprecated
`feast.dev/v1alpha1`, `authz.oidc` accepts only `secretRef`. The CRD has no conversion
webhook, so a resource submitted as v1alpha1 is validated against the v1alpha1 schema and
any other field is pruned without error rather than rejected. Applying the example below
as v1alpha1 therefore leaves OIDC configured by Secret alone, with none of these settings
taking effect and nothing in the output to say so. Use v1, which is the storage version.
{% endhint %}

```yaml
authz:
oidc:
Expand Down
Loading