feat: Provision minimal TokenReview RBAC for OIDC auth and add SSL error logging in token parser by aniketpalu · Pull Request #6240 · feast-dev/feast

aniketpalu · 2026-04-08T15:11:15Z

What this PR does / why we need it:

When `authz: oidc` is configured, the Feast server delegates Kubernetes service account (SA) tokens to a lightweight TokenReview for validation and namespace extraction. This requires the server SA to have `tokenreviews/create` permission. Previously, this RBAC was not provisioned automatically by the operator for OIDC deployments (only for `authz: kubernetes`), requiring manual ClusterRole creation.

Operator: OIDC TokenReview RBAC

The operator now provisions a dedicated feast-oidc-token-review ClusterRole and ClusterRoleBinding when authz: oidc is configured. The ClusterRole contains exactly one rule:

authentication.k8s.io/tokenreviews/create

This is the minimum permission needed for the SA token delegation path. No additional RBAC queries (rolebindings, clusterroles, namespaces) are granted, unlike the authz: kubernetes path which needs broader permissions for KubernetesTokenParser.

Cleanup is handled automatically when switching auth types:

OIDC to kubernetes: OIDC ClusterRole + ClusterRoleBinding deleted
OIDC to no_auth: OIDC ClusterRole + ClusterRoleBinding deleted
kubernetes/no_auth to OIDC: OIDC ClusterRole + ClusterRoleBinding created

SDK: SSL Error Logging

When verify_ssl: true is set but the OIDC provider uses self-signed certificates without a configured ca_cert_path, the server fails to reach the JWKS/discovery endpoints. Previously, this produced a generic "Invalid token" log with no indication of the root cause. The token parser now detects SSL errors in the exception chain and logs a clear, actionable message:

OIDC provider SSL certificate verification failed. If using a self-signed certificate,
set verify_ssl: false or provide a CA certificate via ca_cert_path.

This applies to both the discovery endpoint (_validate_token) and the JWKS endpoint (_decode_token) error paths.

Which issue(s) this PR fixes:

Follow up to #6089

Checks

I've made sure the tests are passing.
My commits are signed off (git commit -s)
My PR title follows conventional commits format

Testing Strategy

Unit tests
Integration tests
Manual tests
Testing is not required for this change

Misc

jyejare

The Kubernetes auth path sets a status condition (AuthorizationReadyType) to indicate RBAC provisioning success/failure. The OIDC path does not. This means operators have no visibility into whether the OIDC RBAC was actually created.
The existing OIDC test (featurestore_controller_oidc_auth_test.go) verifies that the Kubernetes-auth Role/RoleBinding are absent, but it does not verify that the new feast-oidc-token-review ClusterRole and per-instance ClusterRoleBinding are created with the correct rules. It also doesn't test the cleanup path (switching from OIDC to no-auth should delete the CRB).

jyejare · 2026-04-09T11:18:16Z

 func (authz *FeastAuthorization) getLabels() map[string]string {
 	return map[string]string{
 		services.NameLabelKey:        authz.Handler.FeatureStore.Name,


getLabels() stamps the FeatureStore-specific name. But the ClusterRole feast-oidc-token-review is shared across all OIDC FeatureStore instances. The last instance to reconcile overwrites the labels with its own name. This creates misleading audit trails — the ClusterRole appears to belong to one FeatureStore when it actually serves all of them.
Recommendation: Either use instance-independent labels for the shared ClusterRole, or use an aggregated label approach.

Addressed by using instance-independent labels for the shared ClusterRole

jyejare

LGTM, small comment.

ntkathole · 2026-04-30T13:11:31Z

 	apimeta.RemoveStatusCondition(&authz.Handler.FeatureStore.Status.Conditions, feastKubernetesAuthConditions[metav1.ConditionTrue].Type)

+	// Clean up cluster-scoped Kubernetes auth CRB (handles Kubernetes→OIDC or Kubernetes→no-auth transitions)
+	authz.cleanupKubernetesClusterRbac()


want to run this on every OIDC reconcile ?

Check how DeleteOwnedFeastObj in handler.go already does the same thing - get first, early-return on IsNotFound, then Delete.

When authz: oidc is configured, the operator now provisions a dedicated feast-oidc-token-review ClusterRole and per-instance ClusterRoleBinding with tokenreviews/create permission for SA token delegation. Changes: - Add OIDC status condition (AuthorizationReadyType) for feature parity with Kubernetes auth - Use instance-independent labels for shared ClusterRole to avoid misleading audit trails when multiple FeatureStores use OIDC - Clean up Kubernetes ClusterRoleBinding when switching auth types - Add test coverage for OIDC RBAC creation and cleanup Signed-off-by: Aniket Paluskar <[email protected]>

Signed-off-by: Aniket Paluskar <[email protected]>

ntkathole

lgtm

# [0.63.0](v0.62.0...v0.63.0) (2026-05-04) ### Bug Fixes * Add project filter to apply_data_source and delete_data_source (closes [#6206](#6206)) ([#6322](#6322)) ([96562c4](96562c4)) * Add project_id filter to SnowflakeRegistry UPDATE path ([#6243](#6243)) ([6658b71](6658b71)), closes [#6208](#6208) [#6208](#6208) * Add subprocess timeouts to prevent test_e2e_local hanging on Dask atexit handler ([3de6556](3de6556)) * Ambiguous truth value of array during materialization ([#6259](#6259)) ([d0c8984](d0c8984)) * Auto-detect GCS/S3 registry store when registry is passed as string ([#6260](#6260)) ([7ebcf03](7ebcf03)) * **bigquery:** Prefer query over table in get_table_query_string ([#6360](#6360)) ([77ed779](77ed779)), closes [#6200](#6200) * correct project_id scoping in get_user_metadata and delete_project ([0c469a7](0c469a7)) * disable Redis RDB persistence in test deployments ([44cd682](44cd682)) * Disable snowflake tests temporarily in CI ([#6356](#6356)) ([31d5a98](31d5a98)) * Filter empty SQL commands at execute_snowflake_statement call sites ([#6249](#6249)) ([92ffbb9](92ffbb9)) * Fix five bugs in milvus online store ([#6275](#6275)) ([212504b](212504b)) * Fix issue with apply feature view ([835cda8](835cda8)) * Fix streaming materialization for exotic sources with lazy UDF pipelines ([c07972d](c07972d)) * Handle missing features gracefully instead of panicking ([7d00b3a](7d00b3a)) * Harden informer cache with label selectors and memory optimizations ([#6242](#6242)) ([3f11356](3f11356)) * **helm:** Avoid nil pointer for metrics.enabled inside podAnnotations ([#6251](#6251)) ([c833f1a](c833f1a)) * Include git in feast server image ([fb03c46](fb03c46)) * Include StreamFeatureView in freshness metric ([#6269](#6269)) ([463f16c](463f16c)) * Pre-create S3A event log dir before SparkContext init ([#6317](#6317)) ([9feca77](9feca77)) * Remote Online Store Type Inference Error with All-NULL Columns ([#6063](#6063)) ([de67bdd](de67bdd)) * Remove selector with kustomize overlay using a JSON 6902 patch ([9107a43](9107a43)) * Resolve multiple bugs in SnowflakeRegistry and Snowflake connection handling ([#6315](#6315)) ([7e66a2e](7e66a2e)) * **spark:** BatchFeatureView with TransformationMode.PYTHON now reads all source columns ([a310eaf](a310eaf)) * **spark:** Use SELECT * when feature_name_columns is empty in pull_all_from_table_or_query ([e1b1d2d](e1b1d2d)) * Support pandas mode in feature builder and fix dask column extraction ([863315e](863315e)) * support SQL string as entity_df in RemoteOfflineStore.get_historical_features ([c559889](c559889)) * Wrap LocalOutputNode return value in ArrowTableValue for consist… ([#6286](#6286)) ([a16cd55](a16cd55)) ### Features * Add agent skills and Cursor/Claude rules for Feast development ([312eea3](312eea3)) * Add feature view versioning support to FAISS online store ([b36acb7](b36acb7)) * Add feature view versioning support to Redis and DynamoDB online stores ([#6257](#6257)) ([edf25af](edf25af)), closes [#6164](#6164) [#6163](#6163) * Add optional 'org' in feature view ([#6288](#6288)) ([#6301](#6301)) ([608b105](608b105)) * Add RaySource, to_ray_dataset first-class method, docs, and tests ([1c98157](1c98157)) * Add TLS support for Go Feature Server ([#6229](#6229)) ([28a58d0](28a58d0)) * Add Vector Search support to MongoDBOnlineStore ([#6344](#6344)) ([c102738](c102738)) * Add versioning support to Milvus online store ([#6330](#6330)) ([3268ced](3268ced)) * Addresses performance issues in the Redis online store ([2e50da0](2e50da0)) * Allow to set gpu for ray ([5580ab4](5580ab4)) * Bump redis-py version cap from <5 to <8 ([#6339](#6339)) ([9538180](9538180)) * Expose feature_server, materialization, and openlineage configuration via FeatureStore CRD ([ec6ecfd](ec6ecfd)) * Make online_write_batch_size configurable in MaterializationConfig ([#6268](#6268)) ([d41becf](d41becf)) * Make udf optional if agg defined ([#5689](#5689)) ([#6328](#6328)) ([f630056](f630056)) * MongoDB offline store ([#6138](#6138)) ([8eebad7](8eebad7)) * Optional input_schema for ODFV ([#6308](#6308)) ([#6312](#6312)) ([f08b4e8](f08b4e8)) * Provision minimal TokenReview RBAC for OIDC auth and add SSL error logging in token parser ([#6240](#6240)) ([dca57e8](dca57e8)) * **spark:** Add compute-on-read support for BatchFeatureView in get_… ([#6357](#6357)) ([630d9f8](630d9f8))

aniketpalu requested a review from a team as a code owner April 8, 2026 15:11

This comment was marked as resolved.

Sign in to view

jyejare reviewed Apr 9, 2026

View reviewed changes

This comment was marked as resolved.

Sign in to view

aniketpalu force-pushed the oidc-rbac-ssl-logging branch from 4da984f to 15c8ec5 Compare April 27, 2026 16:06

jyejare reviewed Apr 28, 2026

View reviewed changes

Comment thread infra/feast-operator/internal/controller/authz/authz.go

aniketpalu requested a review from jyejare April 30, 2026 08:58

jyejare approved these changes Apr 30, 2026

View reviewed changes

jyejare added the ok-to-test label Apr 30, 2026

ntkathole reviewed Apr 30, 2026

View reviewed changes

aniketpalu force-pushed the oidc-rbac-ssl-logging branch from 557427c to 57a1824 Compare April 30, 2026 20:49

This comment was marked as resolved.

Sign in to view

aniketpalu added 4 commits May 1, 2026 10:11

fix: Add ManagedByLabelKey to shared OIDC ClusterRole labels

3ed93f1

Signed-off-by: Aniket Paluskar <[email protected]>

fix: Add Get-first check to cleanupKubernetesClusterRbac

382e38b

Signed-off-by: Aniket Paluskar <[email protected]>

Updated .secret.baseline

efc6d87

Signed-off-by: Aniket Paluskar <[email protected]>

ntkathole force-pushed the oidc-rbac-ssl-logging branch from fa88079 to efc6d87 Compare May 1, 2026 04:41

ntkathole approved these changes May 1, 2026

View reviewed changes

ntkathole merged commit dca57e8 into feast-dev:master May 1, 2026
21 of 26 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Provision minimal TokenReview RBAC for OIDC auth and add SSL error logging in token parser#6240

feat: Provision minimal TokenReview RBAC for OIDC auth and add SSL error logging in token parser#6240
ntkathole merged 4 commits into
feast-dev:masterfrom
aniketpalu:oidc-rbac-ssl-logging

aniketpalu commented Apr 8, 2026 •

edited

Loading

Uh oh!

This comment was marked as resolved.

Uh oh!

jyejare left a comment

Uh oh!

jyejare Apr 9, 2026

Uh oh!

aniketpalu Apr 22, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

jyejare left a comment

Uh oh!

Uh oh!

ntkathole Apr 30, 2026

Uh oh!

ntkathole Apr 30, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

ntkathole left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

aniketpalu commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Operator: OIDC TokenReview RBAC

SDK: SSL Error Logging

Which issue(s) this PR fixes:

Checks

Testing Strategy

Misc

Uh oh!

This comment was marked as resolved.

Uh oh!

jyejare left a comment

Choose a reason for hiding this comment

Uh oh!

jyejare Apr 9, 2026

Choose a reason for hiding this comment

Uh oh!

aniketpalu Apr 22, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

jyejare left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

ntkathole Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

ntkathole Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

This comment was marked as resolved.

Uh oh!

ntkathole left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

aniketpalu commented Apr 8, 2026 •

edited

Loading