fix(operator): Make default registry REST to IPv4 and dualStack opt-in

Make unset or false dualStack render an explicit 0.0.0.0 host flag. Only dualStack=true selects the bare IPv6 wildcard, aligning registry REST defaults with other host-flag servers. Signed-off-by: dbbvitor <vitor.diniz@gympass.com>
ntkathole · Oct 9, 2026 · Sep 25, 2026 · Sep 25, 2026 · Sep 30, 2026 · Sep 30, 2026
commit c2267df804f5b0d3dc0a345dcf75057e60a32a69
@@ -899,7 +899,7 @@ type ServerConfigs struct {
 	Metrics *bool `json:"metrics,omitempty"`
 	// DualStack binds the server to the IPv6 wildcard address instead of 0.0.0.0,
 	// which serves both IPv6 and IPv4 clients on Linux. Enable it on IPv6-only or dual-stack clusters.
-	// The registry's REST server binds dual-stack by default; set this to false to opt out to 0.0.0.0-only.
+	// Unset or false binds 0.0.0.0 (IPv4 only) for every server that takes a host flag, including the registry's REST server.
 	// +optional
 	DualStack *bool `json:"dualStack,omitempty"`
 	// VolumeMounts defines the list of volumes that should be mounted into the feast container.

@@ -1025,7 +1025,7 @@ Allowed values: "debug", "info", "warning", "error", "critical". |
 | `metrics` _boolean_ | Metrics exposes Prometheus-compatible metrics for the Feast server when enabled. |
 | `dualStack` _boolean_ | DualStack binds the server to the IPv6 wildcard address instead of 0.0.0.0,
 which serves both IPv6 and IPv4 clients on Linux. Enable it on IPv6-only or dual-stack clusters.
-The registry's REST server binds dual-stack by default; set this to false to opt out to 0.0.0.0-only. |
+Unset or false binds 0.0.0.0 (IPv4 only) for every server that takes a host flag, including the registry's REST server. |
 | `volumeMounts` _[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#volumemount-v1-core) array_ | VolumeMounts defines the list of volumes that should be mounted into the feast container.
 This allows attaching persistent storage, config files, secrets, or other resources
 required by the Feast components. Ensure that each volume mount has a corresponding
@@ -1127,7 +1127,7 @@ Allowed values: "debug", "info", "warning", "error", "critical". |
 | `metrics` _boolean_ | Metrics exposes Prometheus-compatible metrics for the Feast server when enabled. |
 | `dualStack` _boolean_ | DualStack binds the server to the IPv6 wildcard address instead of 0.0.0.0,
 which serves both IPv6 and IPv4 clients on Linux. Enable it on IPv6-only or dual-stack clusters.
-The registry's REST server binds dual-stack by default; set this to false to opt out to 0.0.0.0-only. |
+Unset or false binds 0.0.0.0 (IPv4 only) for every server that takes a host flag, including the registry's REST server. |
 | `volumeMounts` _[VolumeMount](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#volumemount-v1-core) array_ | VolumeMounts defines the list of volumes that should be mounted into the feast container.
 This allows attaching persistent storage, config files, secrets, or other resources
 required by the Feast components. Ensure that each volume mount has a corresponding

@@ -45,29 +45,26 @@ func TestRegistryContainerCommandHostFlag(t *testing.T) {
 		name        string
 		restEnabled bool
 		dualStack   *bool
-		wantHostArg bool
+		wantHost    string // empty: no -h expected
 	}{
-		{"unset defaults to dual-stack, no -h", true, nil, false},
-		{"explicit true stays dual-stack, no -h", true, ptr.To(true), false},
-		{"explicit false opts out to 0.0.0.0", true, ptr.To(false), true},
-		{"rest disabled never renders -h", false, ptr.To(false), false},
+		{"unset keeps ipv4", true, nil, hostAllIPv4},
+		{"explicit false keeps ipv4", true, ptr.To(false), hostAllIPv4},
+		{"explicit true binds bare ipv6 wildcard", true, ptr.To(true), hostAllIPv6},
+		{"rest disabled never renders -h", false, ptr.To(true), ""},
 	}
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			feast := registryFeastServices(tc.restEnabled, tc.dualStack)
 			args := feast.getContainerCommand(RegistryFeastType)
 
-			gotHostArg := false
+			gotHost := ""
 			for i, a := range args {
 				if a == "-h" && i+1 < len(args) {
-					gotHostArg = true
-					if args[i+1] != hostAllIPv4 {
-						t.Fatalf("got -h %s, want %s", args[i+1], hostAllIPv4)
-					}
+					gotHost = args[i+1]
 				}
 			}
-			if gotHostArg != tc.wantHostArg {
-				t.Fatalf("got args %v, want -h present=%v", args, tc.wantHostArg)
+			if gotHost != tc.wantHost {
+				t.Fatalf("got args %v, want -h %q", args, tc.wantHost)
 			}
 		})
 	}

@@ -731,7 +731,7 @@ func (feast *FeastServices) getContainerCommand(feastType FeastServiceType) []st
 	}
 
 	deploySettings := FeastServiceConstants[feastType]
-	deploySettings.Args = withBindHost(feastType, deploySettings.Args, feast.getServerConfigs(feastType))
+	deploySettings.Args = append([]string{}, deploySettings.Args...)
 	// Only inject --metrics CLI flag for the server.metrics bool path.
 	// When serving.metrics.enabled is used, Python reads it from feature_store.yaml
 	// and starts the metrics server itself — no CLI flag needed.
@@ -750,12 +750,10 @@ func (feast *FeastServices) getContainerCommand(feastType FeastServiceType) []st
 		if feast.isRegistryRestEnabled() {
 			deploySettings.Args = append(deploySettings.Args, "--rest-api")
 			deploySettings.Args = append(deploySettings.Args, "--rest-port", strconv.Itoa(int(getTargetRestPort(feastType, tls))))
-			// Registry REST defaults to dual-stack; only render -h to opt out.
-			if ds := feast.getServerConfigs(feastType).DualStack; ds != nil && !*ds {
-				deploySettings.Args = append(deploySettings.Args, "-h", hostAllIPv4)
-			}
+			deploySettings.Args = append(deploySettings.Args, "-h", hostAllIPv4)
 		}
 	}
+	deploySettings.Args = withBindHost(feastType, deploySettings.Args, feast.getServerConfigs(feastType))
 
 	// Add worker configuration options for online store (feast serve)
 	if feastType == OnlineFeastType {