GeezerVison

The World Wide Web, restored to 800 pixels of glory.

GeezerVison is showing github.com — feat: Pass optional OIDC audience and issuer through the operator by larrysingleton007 · Pull Request #6677 · feast-dev/feast

Conversation

larrysingleton007 commented Jul 30, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

Contributor

What this PR does / why we need it

Follow-up to #6670, requested in review there: expose the new optional OIDC audience and issuer verification fields through the feast-operator.

Adds audience and issuer to OidcOptionalSecretProperties, so operators can set them in the referenced OIDC Secret and they flow into the generated feature_store.yaml auth section the same way client_id, client_secret, username, and password already do. When the keys are absent, nothing changes.

Also documents the two optional Secret keys in the operator security guide, with a pointer to the main OIDC authorization page for the caveat about token claims versus discovery metadata.

Scope note: verify_ssl and ca_cert_path are deliberately not added to the whitelist. They're already exposed as first-class CR fields (verifySSL, caCertConfigMap) that feed the same generated auth section, so whitelisting them would create two sources for the same keys. The Secret bag carries IdP-coupled values (auth_discovery_url, client_id, ...), which is where audience and issuer belong; a first-class CR field for issuer was considered and rejected because the existing issuerUrl field already means the discovery base URL, not the token iss claim.

Testing: extended the repo config suite to include both keys in the mocked Secret and assert they arrive in OidcParameters with their values intact, plus the reconcile-level envtest fixtures so the keys go through real Secret extraction and YAML serialization. go build ./... and go test ./internal/controller/... pass.

A pre-submit review pass surfaced two things worth calling out:

Secret values are YAML-parsed on extraction, so an all-digits audience (a numeric IdP application ID) would arrive as an int, render unquoted, and fail the SDK's Optional[str] validation at server startup. The copy now coerces the two claim keys to strings, with a regression test.
If a referenced Secret already contains keys named audience or issuer (previously ignored), they take effect after this change. That and two other operational caveats (the IdP must mint matching claims for Feast's own client token flows, and Secret edits apply on the next reconcile rather than immediately) are documented in the security guide.

Deliberately left out: ui_client_id is similarly absent from the whitelist and consumed by the UI server; left for a separate change if wanted, to keep this one to the review request.

Which issue(s) this PR fixes

Fixes #6676

Related to #6669 (main change in #6670).

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

All reactions

larrysingleton007 requested a review from a team as a code owner

July 30, 2026 15:26

larrysingleton007 marked this pull request as draft

July 30, 2026 15:27

codecov-commenter commented Jul 30, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link

Copy Markdown

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.46%. Comparing base (4f6b821) to head (d8ef562).
⚠️ Report is 1 commits behind head on master.
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #6677   +/-   ##
=======================================
  Coverage   46.46%   46.46%           
=======================================
  Files         414      414           
  Lines       50138    50138           
  Branches     7173     7173           
=======================================
  Hits        23295    23295           
  Misses      25204    25204           
  Partials     1639     1639

Flag	Coverage Δ
go-feature-server	`30.58% <ø> (ø)`
python-unit	`47.76% <ø> (ø)`

Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 4f6b821...d8ef562. Read the comment docs.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

larrysingleton007 marked this pull request as ready for review

July 30, 2026 16:23

larrysingleton007 commented Jul 30, 2026

Copy link

Copy Markdown

Contributor Author

@ntkathole this is the operator follow-up you asked for on #6670, ready for review. audience and issuer flow from the referenced OIDC Secret into the generated feature_store.yaml like the existing keys. A pre-submit review caught one real bug worth knowing about: an all-digits audience would arrive as a YAML int and fail the SDK's string validation at server startup, so the copy now coerces the two claim keys to strings, with a regression test. Also documented the operational caveats (pre-existing Secret keys take effect on upgrade, the IdP has to mint matching claims for feast's own client flows, Secret edits apply on next reconcile). CI is green.

All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.

ntkathole added the ok-to-test label

Jul 31, 2026

ntkathole approved these changes

Jul 31, 2026

View reviewed changes

larrysingleton007 added 3 commits

July 31, 2026 10:22


          feat: Pass optional OIDC audience and issuer through the operator

28e3609

Follow-up to feast-dev#6670, requested in review: add audience and issuer to
OidcOptionalSecretProperties so operators can set them in the referenced
OIDC Secret and have them flow into the generated feature_store.yaml auth
section, enabling the new opt-in claim verification on the feature
server. Absent keys change nothing.

Documents the two optional Secret keys in the operator security guide
with a pointer to the OIDC authorization page for the token-claims vs
discovery-metadata caveat.

Signed-off-by: Larry Singleton <[email protected]>


          fix: Coerce numeric OIDC audience and issuer Secret values to strings

543f9d0

Secret values are YAML-parsed on extraction, so an all-digits audience
(e.g. a numeric IdP application ID) arrives as a Go int, renders unquoted
in the generated feature_store.yaml, and fails the SDK's Optional[str]
validation at server startup. Coerce the two claim keys back to strings
in the allowlist copy, with a regression test.

Also extend the reconcile-level envtest fixtures with both keys so they
exercise real Secret extraction and YAML serialization rather than only
the mocked property map.

Signed-off-by: Larry Singleton <[email protected]>


          docs: Sharpen operator OIDC audience/issuer docs and fix dead links

d8ef562

State precisely which claims are and are not checked, scope the checks
to the standard OIDC/JWKS path (ServiceAccount and intra-server tokens
follow separate paths), distinguish the Secret's issuer key from the
CR's issuerUrl, and document three operational caveats: pre-existing
Secret keys activate on operator upgrade, the IdP must mint matching
claims for Feast's own client token flows, and Secret edits apply on
the next reconcile.

Point the two dead ../reference/auth links at real pages and add the
new optional keys to the linked sample Secret as commented lines.

Signed-off-by: Larry Singleton <[email protected]>

ntkathole force-pushed the feat/operator-oidc-audience-issuer branch from 4f8d6db to d8ef562 Compare

July 31, 2026 04:53

ntkathole merged commit a13ed7b into feast-dev:master

Jul 31, 2026

22 of 23 checks passed

Uh oh!

There was an error while loading. Please reload this page.

larrysingleton007 deleted the feat/operator-oidc-audience-issuer branch

July 31, 2026 13:10

This was referenced Jul 31, 2026

fix: Reuse the OIDC JWKS client across requests #6683

Merged

Expose the OIDC JWKS cache lifespan and fetch timeout through the feast-operator #6686

Closed

jyejare pushed a commit to opendatahub-io/feast that referenced this pull request

Aug 5, 2026


          feat: Pass optional OIDC audience and issuer through the operator (fe…

11ebea4

…ast-dev#6677)

* feat: Pass optional OIDC audience and issuer through the operator

Follow-up to feast-dev#6670, requested in review: add audience and issuer to
OidcOptionalSecretProperties so operators can set them in the referenced
OIDC Secret and have them flow into the generated feature_store.yaml auth
section, enabling the new opt-in claim verification on the feature
server. Absent keys change nothing.

Documents the two optional Secret keys in the operator security guide
with a pointer to the OIDC authorization page for the token-claims vs
discovery-metadata caveat.

Signed-off-by: Larry Singleton <[email protected]>

* fix: Coerce numeric OIDC audience and issuer Secret values to strings

Secret values are YAML-parsed on extraction, so an all-digits audience
(e.g. a numeric IdP application ID) arrives as a Go int, renders unquoted
in the generated feature_store.yaml, and fails the SDK's Optional[str]
validation at server startup. Coerce the two claim keys back to strings
in the allowlist copy, with a regression test.

Also extend the reconcile-level envtest fixtures with both keys so they
exercise real Secret extraction and YAML serialization rather than only
the mocked property map.

Signed-off-by: Larry Singleton <[email protected]>

* docs: Sharpen operator OIDC audience/issuer docs and fix dead links

State precisely which claims are and are not checked, scope the checks
to the standard OIDC/JWKS path (ServiceAccount and intra-server tokens
follow separate paths), distinguish the Secret's issuer key from the
CR's issuerUrl, and document three operational caveats: pre-existing
Secret keys activate on operator upgrade, the IdP must mint matching
claims for Feast's own client token flows, and Secret edits apply on
the next reconcile.

Point the two dead ../reference/auth links at real pages and add the
new optional keys to the linked sample Secret as commented lines.

Signed-off-by: Larry Singleton <[email protected]>

---------

Signed-off-by: Larry Singleton <[email protected]>

franciscojavierarceo pushed a commit that referenced this pull request

Aug 21, 2026


          chore(release): release 0.66.0

1d5be95

# [0.66.0](v0.65.0...v0.66.0) (2026-08-21)

### Bug Fixes

* Add connection pre-warming for DynamoDB async client ([89240fa](89240fa)), closes [#6060](#6060)
* Add remote registry client extra ([#6697](#6697)) ([b8dfcb0](b8dfcb0))
* Address review feedback on FIPS cipher suite configuration ([4a35fba](4a35fba))
* Allow remote-registry first apply for new projects ([39d408d](39d408d))
* Avoid importing feast.feature_store at mcp_server import time ([ddb2e9a](ddb2e9a))
* Bump pymssql to >=2.3.6 for macOS arm64 wheel support ([181eb35](181eb35)), closes [#5636](#5636) [#5193](#5193) [#5636](#5636)
* Call ApplySavedDataset RPC instead of ApplyFeatureService in RemoteRegistry.apply_saved_dataset() ([934d341](934d341))
* Catch missing dbt parser dependency in dbt CLI commands ([#6534](#6534)) ([3c2ae3c](3c2ae3c))
* Default authentication to kubernetes auth ([6a4690a](6a4690a))
* Defer feature-freshness thread to post-fork to avoid Gunicorn deadlock ([#6648](#6648)) ([104ad10](104ad10)), closes [#6647](#6647)
* Do not pass undeclared feature view columns to ODFV UDFs ([#6527](#6527)) ([75b9463](75b9463))
* downgrade mcp pin to 1.29.0 and fix CI lockfiles and unit tests ([98e5bca](98e5bca)), closes [#6706](#6706)
* Feast apply silently ignoring ttl updates to None or timedelta(0) ([#6709](#6709)) ([97b0f25](97b0f25)), closes [#6703](#6703)
* Fix mypy TorchTensor type alias error ([#6712](#6712)) ([34de6fa](34de6fa)), closes [#5563](#5563)
* Fixed data source creation form gaps ([5d0f7d6](5d0f7d6))
* Handle parameterized and complex Trino types in type map ([326554d](326554d))
* Isolate default user permissions ([e37adbf](e37adbf))
* Isolate projection join key maps ([d1c709d](d1c709d))
* Map Postgres real to FLOAT instead of DOUBLE ([62db435](62db435))
* Merge shared ODFV source projections in feature resolution ([d269946](d269946)), closes [#6621](#6621)
* More exhaustive athena types ([a9aaefc](a9aaefc))
* Normalize SQL registry read_path to the psycopg3 driver like path ([#6644](#6644)) ([996c6ea](996c6ea)), closes [#6643](#6643)
* **operator:** add spec.services.onlineStore.disabled to opt out of the online store ([d81d4e3](d81d4e3)), closes [#6586](#6586)
* Preinstall DuckDB delta extension for tests ([fd4d49d](fd4d49d)), closes [#6743](#6743)
* Preserve event-time ordering within Redis online_write_batch ([40fb788](40fb788)), closes [#5163](#5163)
* Prevent mutation of cached feature resolution results ([ea17419](ea17419))
* Remote feastRef FeatureStore fails first apply for a new feastProject ([9affee5](9affee5))
* Remove inert subjectaccessreviews and reorganize RBAC rules ([f771ea4](f771ea4))
* Report single-feature-view spark_application materialization success ([a9219d9](a9219d9)), closes [#6673](#6673)
* Reset the global security manager after the permissions fixture ([7667215](7667215))
* Resolve kserve with pip --dry-run instead of installing it ([01da132](01da132)), closes [#6732](#6732)
* Resolve write_to_offline_store feature view with a single registry lookup ([a42dc85](a42dc85)), closes [#4235](#4235)
* Return False from __eq__ on cross-type comparison ([#6637](#6637)) ([0f149a9](0f149a9)), closes [#6636](#6636)
* Reuse IdP-issued client tokens until near expiry ([602d752](602d752))
* Reuse the OIDC JWKS client across requests ([#6683](#6683)) ([a1e6fc2](a1e6fc2))
* Separate CronJob and feature-server ServiceAccounts ([398f643](398f643))
* Serialize UnixTimestamp proto values as raw int64 in remote online store transport ([1e7134f](1e7134f))
* Set FIPS cipher suites before pyarrow.flight import to prevent crash on IBM Power ([979b82a](979b82a))
* Support Entra ID (Azure AD) token claims in OIDC auth ([#6631](#6631)) ([f843c63](f843c63))
* UDF/ODFV source rehydrate (+ Postgres / online cache) ([#6655](#6655)) ([5fd7af7](5fd7af7))
* Updated projects-list.json in order to display newly added projects ([#6657](#6657)) ([3a6a103](3a6a103))
* Use correct image name in multi-arch imagetools push step ([faf85e0](faf85e0))
* Use join keys instead of entity names in ODFV materialization ([#6645](#6645)) ([abffebc](abffebc)), closes [#5965](#5965)
* use matching proto class per feature view list in SqliteOnlineStore.plan() ([adb8c1c](adb8c1c)), closes [#6658](#6658)
* Widen Athena integer type mapping for unsigned ints ([3425783](3425783))

### Features

* Add ConnectionRef to DataSource for pluggable external credential resolution ([28bde01](28bde01))
* Add Feature Service Create in UI ([0399380](0399380))
* Add hybrid to ValidOfflineStoreDBStorePersistenceTypes for HybridOfflineStore support ([#6707](#6707)) ([310ab51](310ab51)), closes [#6701](#6701)
* Add MLflow integration support to Feast operator ([#6611](#6611)) ([52999f1](52999f1))
* Add opt-in filter_by_created_timestamp cutoff to get_historical_features ([#6617](#6617)) ([79b33ce](79b33ce)), closes [#6615](#6615)
* Add optional OIDC token audience and issuer verification ([#6670](#6670)) ([ef307c6](ef307c6))
* Add packaged feature repository support to Feast Operator ([8112b1e](8112b1e)), closes [#6598](#6598)
* add plan() support to DynamoDBOnlineStore ([51ce982](51ce982)), closes [#6658](#6658) [#6659](#6659)
* Added optional namespace/colleciton to datasets ([165fcf2](165fcf2))
* Added SQL registry schema_mode and registry create command ([#6704](#6704)) ([037c4cd](037c4cd))
* Allow users to have protected project on shared registry ([f9923bc](f9923bc))
* Apply Intermediate TLS defaults on API fallback and handle transient errors ([#6587](#6587)) ([43ae993](43ae993))
* **cli:** Updated feast init demo by adding rag template ([#5946](#5946)) ([c8628eb](c8628eb)), closes [#5264](#5264)
* Expose the OIDC JWKS tunables through the operator ([#6690](#6690)) ([fef4e78](fef4e78)), closes [#6683](#6683)
* Making feast vector store with open ai search api compatible ([#6121](#6121)) ([54da19a](54da19a))
* Multi-arch publish for feast operator image ([b221036](b221036))
* OpenLineage lineage enhancements - full object coverage, richer UI, and API-level sync ([#6719](#6719)) ([120a868](120a868))
* **operator:** Add spec.services.initImage for init container image override ([#6598](#6598)) ([ca355cb](ca355cb))
* Pass optional OIDC audience and issuer through the operator ([#6677](#6677)) ([a13ed7b](a13ed7b)), closes [#6670](#6670)
* **server:** Remote Materialization ([#6649](#6649)) ([b7ae488](b7ae488)), closes [#4526](#4526)
* Support Lineage configs via operator ([bf1e54a](bf1e54a))
* Updated datasets UI to support grouping ([7ae64ec](7ae64ec))

Michie-hub pushed a commit to Michie-hub/feast that referenced this pull request

Aug 31, 2026


          chore(release): release 0.66.0

a29c923

# [0.66.0](feast-dev/feast@v0.65.0...v0.66.0) (2026-08-21)

### Bug Fixes

* Add connection pre-warming for DynamoDB async client ([89240fa](feast-dev@89240fa)), closes [feast-dev#6060](feast-dev#6060)
* Add remote registry client extra ([feast-dev#6697](feast-dev#6697)) ([b8dfcb0](feast-dev@b8dfcb0))
* Address review feedback on FIPS cipher suite configuration ([4a35fba](feast-dev@4a35fba))
* Allow remote-registry first apply for new projects ([39d408d](feast-dev@39d408d))
* Avoid importing feast.feature_store at mcp_server import time ([ddb2e9a](feast-dev@ddb2e9a))
* Bump pymssql to >=2.3.6 for macOS arm64 wheel support ([181eb35](feast-dev@181eb35)), closes [feast-dev#5636](feast-dev#5636) [feast-dev#5193](feast-dev#5193) [feast-dev#5636](feast-dev#5636)
* Call ApplySavedDataset RPC instead of ApplyFeatureService in RemoteRegistry.apply_saved_dataset() ([934d341](feast-dev@934d341))
* Catch missing dbt parser dependency in dbt CLI commands ([feast-dev#6534](feast-dev#6534)) ([3c2ae3c](feast-dev@3c2ae3c))
* Default authentication to kubernetes auth ([6a4690a](feast-dev@6a4690a))
* Defer feature-freshness thread to post-fork to avoid Gunicorn deadlock ([feast-dev#6648](feast-dev#6648)) ([104ad10](feast-dev@104ad10)), closes [feast-dev#6647](feast-dev#6647)
* Do not pass undeclared feature view columns to ODFV UDFs ([feast-dev#6527](feast-dev#6527)) ([75b9463](feast-dev@75b9463))
* downgrade mcp pin to 1.29.0 and fix CI lockfiles and unit tests ([98e5bca](feast-dev@98e5bca)), closes [feast-dev#6706](feast-dev#6706)
* Feast apply silently ignoring ttl updates to None or timedelta(0) ([feast-dev#6709](feast-dev#6709)) ([97b0f25](feast-dev@97b0f25)), closes [feast-dev#6703](feast-dev#6703)
* Fix mypy TorchTensor type alias error ([feast-dev#6712](feast-dev#6712)) ([34de6fa](feast-dev@34de6fa)), closes [feast-dev#5563](feast-dev#5563)
* Fixed data source creation form gaps ([5d0f7d6](feast-dev@5d0f7d6))
* Handle parameterized and complex Trino types in type map ([326554d](feast-dev@326554d))
* Isolate default user permissions ([e37adbf](feast-dev@e37adbf))
* Isolate projection join key maps ([d1c709d](feast-dev@d1c709d))
* Map Postgres real to FLOAT instead of DOUBLE ([62db435](feast-dev@62db435))
* Merge shared ODFV source projections in feature resolution ([d269946](feast-dev@d269946)), closes [feast-dev#6621](feast-dev#6621)
* More exhaustive athena types ([a9aaefc](feast-dev@a9aaefc))
* Normalize SQL registry read_path to the psycopg3 driver like path ([feast-dev#6644](feast-dev#6644)) ([996c6ea](feast-dev@996c6ea)), closes [feast-dev#6643](feast-dev#6643)
* **operator:** add spec.services.onlineStore.disabled to opt out of the online store ([d81d4e3](feast-dev@d81d4e3)), closes [feast-dev#6586](feast-dev#6586)
* Preinstall DuckDB delta extension for tests ([fd4d49d](feast-dev@fd4d49d)), closes [feast-dev#6743](feast-dev#6743)
* Preserve event-time ordering within Redis online_write_batch ([40fb788](feast-dev@40fb788)), closes [feast-dev#5163](feast-dev#5163)
* Prevent mutation of cached feature resolution results ([ea17419](feast-dev@ea17419))
* Remote feastRef FeatureStore fails first apply for a new feastProject ([9affee5](feast-dev@9affee5))
* Remove inert subjectaccessreviews and reorganize RBAC rules ([f771ea4](feast-dev@f771ea4))
* Report single-feature-view spark_application materialization success ([a9219d9](feast-dev@a9219d9)), closes [feast-dev#6673](feast-dev#6673)
* Reset the global security manager after the permissions fixture ([7667215](feast-dev@7667215))
* Resolve kserve with pip --dry-run instead of installing it ([01da132](feast-dev@01da132)), closes [feast-dev#6732](feast-dev#6732)
* Resolve write_to_offline_store feature view with a single registry lookup ([a42dc85](feast-dev@a42dc85)), closes [feast-dev#4235](feast-dev#4235)
* Return False from __eq__ on cross-type comparison ([feast-dev#6637](feast-dev#6637)) ([0f149a9](feast-dev@0f149a9)), closes [feast-dev#6636](feast-dev#6636)
* Reuse IdP-issued client tokens until near expiry ([602d752](feast-dev@602d752))
* Reuse the OIDC JWKS client across requests ([feast-dev#6683](feast-dev#6683)) ([a1e6fc2](feast-dev@a1e6fc2))
* Separate CronJob and feature-server ServiceAccounts ([398f643](feast-dev@398f643))
* Serialize UnixTimestamp proto values as raw int64 in remote online store transport ([1e7134f](feast-dev@1e7134f))
* Set FIPS cipher suites before pyarrow.flight import to prevent crash on IBM Power ([979b82a](feast-dev@979b82a))
* Support Entra ID (Azure AD) token claims in OIDC auth ([feast-dev#6631](feast-dev#6631)) ([f843c63](feast-dev@f843c63))
* UDF/ODFV source rehydrate (+ Postgres / online cache) ([feast-dev#6655](feast-dev#6655)) ([5fd7af7](feast-dev@5fd7af7))
* Updated projects-list.json in order to display newly added projects ([feast-dev#6657](feast-dev#6657)) ([3a6a103](feast-dev@3a6a103))
* Use correct image name in multi-arch imagetools push step ([faf85e0](feast-dev@faf85e0))
* Use join keys instead of entity names in ODFV materialization ([feast-dev#6645](feast-dev#6645)) ([abffebc](feast-dev@abffebc)), closes [feast-dev#5965](feast-dev#5965)
* use matching proto class per feature view list in SqliteOnlineStore.plan() ([adb8c1c](feast-dev@adb8c1c)), closes [feast-dev#6658](feast-dev#6658)
* Widen Athena integer type mapping for unsigned ints ([3425783](feast-dev@3425783))

### Features

* Add ConnectionRef to DataSource for pluggable external credential resolution ([28bde01](feast-dev@28bde01))
* Add Feature Service Create in UI ([0399380](feast-dev@0399380))
* Add hybrid to ValidOfflineStoreDBStorePersistenceTypes for HybridOfflineStore support ([feast-dev#6707](feast-dev#6707)) ([310ab51](feast-dev@310ab51)), closes [feast-dev#6701](feast-dev#6701)
* Add MLflow integration support to Feast operator ([feast-dev#6611](feast-dev#6611)) ([52999f1](feast-dev@52999f1))
* Add opt-in filter_by_created_timestamp cutoff to get_historical_features ([feast-dev#6617](feast-dev#6617)) ([79b33ce](feast-dev@79b33ce)), closes [feast-dev#6615](feast-dev#6615)
* Add optional OIDC token audience and issuer verification ([feast-dev#6670](feast-dev#6670)) ([ef307c6](feast-dev@ef307c6))
* Add packaged feature repository support to Feast Operator ([8112b1e](feast-dev@8112b1e)), closes [feast-dev#6598](feast-dev#6598)
* add plan() support to DynamoDBOnlineStore ([51ce982](feast-dev@51ce982)), closes [feast-dev#6658](feast-dev#6658) [feast-dev#6659](feast-dev#6659)
* Added optional namespace/colleciton to datasets ([165fcf2](feast-dev@165fcf2))
* Added SQL registry schema_mode and registry create command ([feast-dev#6704](feast-dev#6704)) ([037c4cd](feast-dev@037c4cd))
* Allow users to have protected project on shared registry ([f9923bc](feast-dev@f9923bc))
* Apply Intermediate TLS defaults on API fallback and handle transient errors ([feast-dev#6587](feast-dev#6587)) ([43ae993](feast-dev@43ae993))
* **cli:** Updated feast init demo by adding rag template ([feast-dev#5946](feast-dev#5946)) ([c8628eb](feast-dev@c8628eb)), closes [feast-dev#5264](feast-dev#5264)
* Expose the OIDC JWKS tunables through the operator ([feast-dev#6690](feast-dev#6690)) ([fef4e78](feast-dev@fef4e78)), closes [feast-dev#6683](feast-dev#6683)
* Making feast vector store with open ai search api compatible ([feast-dev#6121](feast-dev#6121)) ([54da19a](feast-dev@54da19a))
* Multi-arch publish for feast operator image ([b221036](feast-dev@b221036))
* OpenLineage lineage enhancements - full object coverage, richer UI, and API-level sync ([feast-dev#6719](feast-dev#6719)) ([120a868](feast-dev@120a868))
* **operator:** Add spec.services.initImage for init container image override ([feast-dev#6598](feast-dev#6598)) ([ca355cb](feast-dev@ca355cb))
* Pass optional OIDC audience and issuer through the operator ([feast-dev#6677](feast-dev#6677)) ([a13ed7b](feast-dev@a13ed7b)), closes [feast-dev#6670](feast-dev#6670)
* **server:** Remote Materialization ([feast-dev#6649](feast-dev#6649)) ([b7ae488](feast-dev@b7ae488)), closes [feast-dev#4526](feast-dev#4526)
* Support Lineage configs via operator ([bf1e54a](feast-dev@bf1e54a))
* Updated datasets UI to support grouping ([7ae64ec](feast-dev@7ae64ec))

Signed-off-by: Michelle Nhengu <[email protected]>

Reviewers

ntkathole

ntkathole approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

ok-to-test

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Expose optional OIDC audience and issuer verification through the feast-operator

Uh oh!

There was an error while loading. Please reload this page.

3 participants

Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.

GeezerVison

Conversation

larrysingleton007 commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it

Which issue(s) this PR fixes

Uh oh!

codecov-commenter commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

larrysingleton007 commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

larrysingleton007 commented Jul 30, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.

codecov-commenter commented Jul 30, 2026 •

edited

Loading

Uh oh!

There was an error while loading. Please reload this page.