GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — feat: Add mTLS support to remote registry gRPC client by jacob-bush-shopify · Pull Request #6474 · feast-dev/feast

feat: Add mTLS support to remote registry gRPC client #6474

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ntkathole merged 2 commits into feast-dev:master from jacob-bush-shopify:feat/remote-registry-mtls
Jun 9, 2026

Uh oh!

There was an error while loading. Please reload this page.
Merged

feat: Add mTLS support to remote registry gRPC client #6474

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e2e0b91
feat: Add mTLS support to remote registry gRPC client
jacob-bush-shopify Jun 4, 2026
b03e870
Merge branch 'master' into feat/remote-registry-mtls
franciscojavierarceo Jun 9, 2026
File filter
Filter by extension
Clear filters
Conversations
Failed to load comments.
Loading

Uh oh!

There was an error while loading. Please reload this page.
Jump to
Jump to file
Failed to load files.
Loading

Uh oh!

There was an error while loading. Please reload this page.
Diff view
Diff view

There are no files selected for viewing

46 changes: 46 additions & 0 deletions 46 docs/how-to-guides/starting-feast-servers-tls-mode.md
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,52 @@ auth:

`cert` is an optional configuration to the public certificate path when the registry server starts in TLS(SSL) mode. Typically, this file ends with `*.crt`, `*.cer`, or `*.pem`.

### Feast client connecting to remote registry server with mTLS

If the Registry Server requires mutual TLS (mTLS), the client must present a certificate and private key in addition to trusting the server's CA certificate. Add `client_cert` and `client_key` to the registry configuration:

```yaml
project: feast-project
registry:
registry_type: remote
path: feature-registry.example.com:443
cert: /path/to/ca.crt
client_cert: /path/to/tls.crt
client_key: /path/to/tls.key
provider: local
online_store:
path: http://localhost:6566
type: remote
entity_key_serialization_version: 3
auth:
type: no_auth
```

* `cert` — CA certificate used to verify the server (or use the `SSL_CERT_FILE` / `REQUESTS_CA_BUNDLE` environment variable).
* `client_cert` — Client certificate presented to the server. Must be paired with `client_key`.
* `client_key` — Private key for the client certificate.

#### Connecting through a tunnel or proxy

When connecting through a tunnel (e.g. `gcloud compute start-iap-tunnel`) the client connects to `localhost`, but the server certificate is issued for the real service hostname. Set the `authority` field so that gRPC's TLS hostname verification passes:

```shell
# In one terminal — start the tunnel:
gcloud compute start-iap-tunnel feature-registry.example.com 443 --local-host-port=localhost:8443
```

```yaml
registry:
registry_type: remote
path: localhost:8443
cert: /path/to/ca.crt
client_cert: /path/to/tls.crt
client_key: /path/to/tls.key
authority: feature-registry.example.com
```

Without `authority`, the gRPC client would check the server certificate against `localhost`, which would fail because the certificate's Subject Alternative Name (SAN) is `feature-registry.example.com`.

## Starting feast offline server in TLS mode

To start the offline server in TLS mode, you need to provide the private and public keys using the `--key` and `--cert` arguments with the `feast serve_offline` command.
Expand Down
22 changes: 21 additions & 1 deletion 22 docs/reference/registries/remote.md
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,27 @@ registry:
{% endcode %}

The optional `cert` parameter can be configured as well, it should point to the public certificate path when the Registry Server starts in SSL mode. This may be needed if the Registry Server is started with a self-signed certificate, typically this file ends with *.crt, *.cer, or *.pem.
More info about the `cert` parameter can be found in [feast-client-connecting-to-remote-registry-sever-started-in-tls-mode](../../how-to-guides/starting-feast-servers-tls-mode.md#feast-client-connecting-to-remote-registry-sever-started-in-tls-mode)

For **mutual TLS (mTLS)**, you can also configure:
* `client_cert` — Path to the client certificate presented to the server. Must be paired with `client_key`. Typically ends with `*.crt` or `*.pem`.
* `client_key` — Path to the client private key. Must be paired with `client_cert`. Typically ends with `*.key` or `*.pem`.

When connecting through a tunnel or proxy where the connection address differs from the server hostname, set:
* `authority` — Overrides the gRPC `:authority` header so the server certificate is validated against the correct hostname.

{% code title="feature_store.yaml" %}
```yaml
registry:
registry_type: remote
path: localhost:8443
cert: /path/to/ca.crt
client_cert: /path/to/tls.crt
client_key: /path/to/tls.key
authority: feature-registry.example.com
```
{% endcode %}

More info about TLS configuration can be found in [feast-client-connecting-to-remote-registry-sever-started-in-tls-mode](../../how-to-guides/starting-feast-servers-tls-mode.md#feast-client-connecting-to-remote-registry-sever-started-in-tls-mode)

## How to configure the server

Expand Down
59 changes: 50 additions & 9 deletions 59 sdk/python/feast/infra/registry/remote.py
Show comments
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,10 +74,25 @@ class RemoteRegistryConfig(RegistryConfig):

is_tls: bool = False
""" bool: Set to `True` if you plan to connect to a registry server running in TLS (SSL) mode.
If you intend to add the public certificate to the trust store instead of passing it via the `cert` parameter, this field must be set to `True`.
Comment thread
shuchu marked this conversation as resolved.
Resolved

Uh oh!

There was an error while loading. Please reload this page.
If you are planning to add the public certificate as part of the trust store instead of passing it as a `cert` parameters then setting this field to `true` is mandatory.
If you are planning to add the public certificate as part of the trust store instead of passing it as a `cert` parameters then setting this field to `True` is mandatory.
"""
Comment thread
jacob-bush-shopify marked this conversation as resolved.
Resolved

Uh oh!

There was an error while loading. Please reload this page.

client_cert: StrictStr = ""
""" str: Path to the client certificate for mTLS (mutual TLS) authentication.
Required when connecting to a server that enforces mutual TLS.
Must be provided together with `client_key`.
Typically this file ends with `*.crt` or `*.pem`. """

client_key: StrictStr = ""
""" str: Path to the client private key for mTLS (mutual TLS) authentication.
Must be provided together with `client_cert`.
Typically this file ends with `*.key` or `*.pem`. """

authority: StrictStr = ""
""" str: Override the gRPC :authority header for TLS connections.
Required when the connection address differs from the service hostname,
e.g. when connecting through a tunnel or proxy for local development. """


class RemoteRegistry(BaseRegistry):
def __init__(
Expand All @@ -99,19 +114,45 @@ def __init__(
def _create_grpc_channel(self, registry_config):
assert isinstance(registry_config, RemoteRegistryConfig)
if registry_config.cert or registry_config.is_tls:
cafile = os.getenv("SSL_CERT_FILE") or os.getenv("REQUESTS_CA_BUNDLE")
if not cafile and not registry_config.cert:
cafile = (
registry_config.cert
or os.getenv("SSL_CERT_FILE")
or os.getenv("REQUESTS_CA_BUNDLE")
)
if not cafile:
raise EnvironmentError(
"SSL_CERT_FILE or REQUESTS_CA_BUNDLE environment variable must be set to use secure TLS or set the cert parameter in feature_Store.yaml file under remote registry configuration."
)
with open(
registry_config.cert if registry_config.cert else cafile, "rb"
) as cert_file:
if (registry_config.client_cert and not registry_config.client_key) or (
not registry_config.client_cert and registry_config.client_key
):
raise ValueError(
"Both client_cert and client_key must be provided for mTLS. "
"Only one was set in the remote registry configuration."
)

with open(cafile, "rb") as cert_file:
trusted_certs = cert_file.read()
private_key: Optional[bytes] = None
certificate_chain: Optional[bytes] = None
if registry_config.client_cert and registry_config.client_key:
with open(registry_config.client_key, "rb") as key_file:
private_key = key_file.read()
with open(registry_config.client_cert, "rb") as cert_file:
certificate_chain = cert_file.read()
tls_credentials = grpc.ssl_channel_credentials(
root_certificates=trusted_certs
root_certificates=trusted_certs,
private_key=private_key,
certificate_chain=certificate_chain,
)

options = []
if registry_config.authority:
options.append(("grpc.default_authority", registry_config.authority))

return grpc.secure_channel(
registry_config.path, tls_credentials, options=options
)
return grpc.secure_channel(registry_config.path, tls_credentials)
else:
# Create an insecure gRPC channel
return grpc.insecure_channel(registry_config.path)
Expand Down
Loading
Oops, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

Loading
Oops, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
Add this suggestion to a batch that can be applied as a single commit. This suggestion is invalid because no changes were made to the code. Suggestions cannot be applied while the pull request is closed. Suggestions cannot be applied while viewing a subset of changes. Only one suggestion per line can be applied in a batch. Add this suggestion to a batch that can be applied as a single commit. Applying suggestions on deleted lines is not supported. You must change the existing code in this line in order to create a valid suggestion. Outdated suggestions cannot be applied. This suggestion has been applied or marked resolved. Suggestions cannot be applied from pending reviews. Suggestions cannot be applied on multi-line comments. Suggestions cannot be applied while the pull request is queued to merge. Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.