Skip to content

fix: Make operator include full OIDC secret in repo config (#5676) #5809

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jfw-ppi wants to merge 3 commits into
base: master
Choose a base branch
from
+27 −27
Open

fix: Make operator include full OIDC secret in repo config (#5676) #5809

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
0d54116
fix: make operator include full OIDC secret in repo config (#5676)
jfw-ppi Dec 28, 2025
7ae7fb5
Merge branch 'master' into bug/5676-OIDC-secretRef
jfw-ppi Jan 3, 2026
31c7b06
Merge branch 'master' into bug/5676-OIDC-secretRef
jfw-ppi Jan 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 8 additions & 3 deletions infra/feast-operator/internal/controller/featurestore_controller_oidc_auth_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -487,16 +487,21 @@ func expectedServerOidcAuthorizConfig() services.AuthzConfig {
OidcParameters: map[string]interface{}{
string(services.OidcAuthDiscoveryUrl): "auth-discovery-url",
string(services.OidcClientId): "client-id",
string(services.OidcClientSecret): "client-secret",
string(services.OidcUsername): "username",
string(services.OidcPassword): "password",
},
}
}
func expectedClientOidcAuthorizConfig() services.AuthzConfig {
return services.AuthzConfig{
Type: services.OidcAuthType,
OidcParameters: map[string]interface{}{
string(services.OidcClientSecret): "client-secret",
string(services.OidcUsername): "username",
string(services.OidcPassword): "password"},
string(services.OidcClientId): "client-id",
string(services.OidcAuthDiscoveryUrl): "auth-discovery-url",
string(services.OidcClientSecret): "client-secret",
string(services.OidcUsername): "username",
string(services.OidcPassword): "password"},
}
}

Expand Down
20 changes: 10 additions & 10 deletions infra/feast-operator/internal/controller/services/repo_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -102,15 +102,15 @@ func getBaseServiceRepoConfig(
return repoConfig, authSecretErr
}

oidcServerProperties := map[string]interface{}{}
for _, oidcServerProperty := range OidcServerProperties {
if val, exists := propertiesMap[string(oidcServerProperty)]; exists {
oidcServerProperties[string(oidcServerProperty)] = val
oidcParameters := map[string]interface{}{}
for _, oidcProperty := range OidcProperties {
if val, exists := propertiesMap[string(oidcProperty)]; exists {
oidcParameters[string(oidcProperty)] = val
} else {
return repoConfig, missingOidcSecretProperty(oidcServerProperty)
return repoConfig, missingOidcSecretProperty(oidcProperty)
}
}
repoConfig.AuthzConfig.OidcParameters = oidcServerProperties
repoConfig.AuthzConfig.OidcParameters = oidcParameters
}

return repoConfig, nil
Expand Down Expand Up @@ -327,11 +327,11 @@ func getRepoConfig(
}

oidcClientProperties := map[string]interface{}{}
for _, oidcClientProperty := range OidcClientProperties {
Copy link
Member

@franciscojavierarceo franciscojavierarceo Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why rename it to oidcProperty?

if val, exists := propertiesMap[string(oidcClientProperty)]; exists {
oidcClientProperties[string(oidcClientProperty)] = val
for _, oidcProperty := range OidcProperties {
if val, exists := propertiesMap[string(oidcProperty)]; exists {
oidcClientProperties[string(oidcProperty)] = val
} else {
return repoConfig, missingOidcSecretProperty(oidcClientProperty)
return repoConfig, missingOidcSecretProperty(oidcProperty)
}
}
repoConfig.AuthzConfig.OidcParameters = oidcClientProperties
Expand Down
22 changes: 8 additions & 14 deletions infra/feast-operator/internal/controller/services/repo_config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,17 +214,22 @@ var _ = Describe("Repo Config", func() {
repoConfig, err = getServiceRepoConfig(featureStore, secretExtractionFunc)
Expect(err).NotTo(HaveOccurred())
Expect(repoConfig.AuthzConfig.Type).To(Equal(OidcAuthType))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveLen(2))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveLen(5))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcClientId)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcAuthDiscoveryUrl)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcClientSecret)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcUsername)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcPassword)))
Expect(repoConfig.OfflineStore).To(Equal(expectedOfflineConfig))
Expect(repoConfig.OnlineStore).To(Equal(defaultOnlineStoreConfig(featureStore)))
Expect(repoConfig.Registry).To(Equal(defaultRegistryConfig(featureStore)))

repoConfig, err = getClientRepoConfig(featureStore, secretExtractionFunc, nil)
Expect(err).NotTo(HaveOccurred())
Expect(repoConfig.AuthzConfig.Type).To(Equal(OidcAuthType))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveLen(3))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveLen(5))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcClientId)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcAuthDiscoveryUrl)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcClientSecret)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcUsername)))
Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKey(string(OidcPassword)))
Expand Down Expand Up @@ -314,14 +319,9 @@ var _ = Describe("Repo Config", func() {
_, err := getServiceRepoConfig(featureStore, secretExtractionFunc)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
_, err = getServiceRepoConfig(featureStore, secretExtractionFunc)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
_, err = getServiceRepoConfig(featureStore, secretExtractionFunc)
_, err = getClientRepoConfig(featureStore, secretExtractionFunc, nil)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
_, err = getClientRepoConfig(featureStore, secretExtractionFunc, nil)
Expect(err).ToNot(HaveOccurred())

By("Having invalid client oidc authorization")
featureStore.Spec.AuthzConfig = &feastdevv1.AuthzConfig{
Expand All @@ -341,12 +341,6 @@ var _ = Describe("Repo Config", func() {
_, err = getServiceRepoConfig(featureStore, secretExtractionFunc)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
_, err = getServiceRepoConfig(featureStore, secretExtractionFunc)
Copy link
Member

@franciscojavierarceo franciscojavierarceo Jan 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why remove these tests?

Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
_, err = getServiceRepoConfig(featureStore, secretExtractionFunc)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
_, err = getClientRepoConfig(featureStore, secretExtractionFunc, nil)
Expect(err).To(HaveOccurred())
Expect(err.Error()).To(ContainSubstring("missing OIDC secret"))
Expand Down
1 change: 1 addition & 0 deletions infra/feast-operator/internal/controller/services/services_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -210,6 +210,7 @@ var (

OidcServerProperties = []OidcPropertyType{OidcClientId, OidcAuthDiscoveryUrl}
OidcClientProperties = []OidcPropertyType{OidcClientSecret, OidcUsername, OidcPassword}
OidcProperties = []OidcPropertyType{OidcClientId, OidcAuthDiscoveryUrl, OidcClientSecret, OidcUsername, OidcPassword}
)

// Feast server types: Reserved only for server types like Online, Offline, and Registry servers. Should not be used for client types like the UI, etc.
Expand Down
Loading