feast-dev
diff --git a/.secrets.baseline b/.secrets.baseline
@@ -957,7 +957,7 @@
         "filename": "infra/feast-operator/api/v1/featurestore_types.go",
         "hashed_secret": "44e17306b837162269a410204daaa5ecee4ec22c",
         "is_verified": false,
-        "line_number": 958
+        "line_number": 969
       }
     ],
     "infra/feast-operator/api/v1/zz_generated.deepcopy.go": [
@@ -980,7 +980,7 @@
         "filename": "infra/feast-operator/api/v1/zz_generated.deepcopy.go",
         "hashed_secret": "c2028031c154bbe86fd69bef740855c74b927dcf",
         "is_verified": false,
-        "line_number": 1595
+        "line_number": 1605
       }
     ],
     "infra/feast-operator/api/v1alpha1/featurestore_types.go": [
@@ -1172,7 +1172,7 @@
         "filename": "infra/feast-operator/internal/controller/services/repo_config.go",
         "hashed_secret": "e2fb052132fd6a07a56af2013e0b62a1f510572c",
         "is_verified": false,
-        "line_number": 235
+        "line_number": 241
       }
     ],
     "infra/feast-operator/internal/controller/services/services.go": [
@@ -1564,5 +1564,5 @@
       }
     ]
   },
-  "generated_at": "2026-07-31T05:29:18Z"
+  "generated_at": "2026-07-31T18:15:46Z"
 }
@@ -93,6 +93,15 @@ spec:
 
 ### Advanced OIDC options
 
+{% hint style="warning" %}
+Every option in this section requires `apiVersion: feast.dev/v1`. Under the deprecated
+`feast.dev/v1alpha1`, `authz.oidc` accepts only `secretRef`. The CRD has no conversion
+webhook, so a resource submitted as v1alpha1 is validated against the v1alpha1 schema and
+any other field is pruned without error rather than rejected. Applying the example below
+as v1alpha1 therefore leaves OIDC configured by Secret alone, with none of these settings
+taking effect and nothing in the output to say so. Use v1, which is the storage version.
+{% endhint %}
+
 ```yaml
 authz:
   oidc:
@@ -101,9 +110,18 @@ authz:
     secretKeyName: client_id          # override the default Secret key name
     tokenEnvVar: FEAST_TOKEN          # env var from which servers read the Bearer token
     verifySSL: false                  # disable SSL verification (dev only)
-    caCertConfigMap: oidc-ca-cert     # ConfigMap with CA cert for SSL verification
+    caCertConfigMap:                  # ConfigMap with CA cert for SSL verification
+      name: oidc-ca-cert
+    jwksCacheLifespanSeconds: 300     # how long servers reuse the fetched JWK set
+    jwksRequestTimeoutSeconds: 10     # network timeout for the JWKS fetch
 ```
 
+`jwksCacheLifespanSeconds` is not only a performance setting: it also bounds how long a key the provider has **revoked** continues to validate tokens. Lower it if your provider rotates or revokes aggressively, at the cost of proportionally more JWKS fetches. Key rotations that introduce a new key id are picked up immediately regardless, because an unknown key id forces a refetch. `jwksRequestTimeoutSeconds` bounds how long an unresponsive provider can block request serving. Both must be at least 1. When unset, neither key is written to the generated configuration and the feature server applies its own defaults (300 and 10 seconds respectively).
+
+{% hint style="warning" %}
+These two options require a feature server image that recognizes them. The operator deploys a matching image by default, so this only applies if you pin an older one explicitly, through a container `image` override or the operator's `RELATED_IMAGE_FEATURE_SERVER` setting. An image that predates these options rejects its configuration at startup, so leave them unset until the pinned image is updated.
+{% endhint %}
+
 **SDK docs**: [Feast OIDC Auth](../../getting-started/components/authz_manager.md#oidc-authorization)
 
 ---

@@ -929,6 +929,17 @@ type OidcAuthz struct {
 	// ConfigMap with the CA certificate for self-signed OIDC providers. Auto-detected on RHOAI/ODH.
 	// +optional
 	CACertConfigMap *OidcCACertConfigMap `json:"caCertConfigMap,omitempty"`
+	// Seconds the servers reuse the provider's fetched JWK set before refetching. Defaults to 300.
+	// Also bounds how long a key the provider revoked keeps validating tokens, so lower it if the
+	// provider rotates or revokes aggressively, at the cost of more JWKS fetches.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	JwksCacheLifespanSeconds *int32 `json:"jwksCacheLifespanSeconds,omitempty"`
+	// Seconds before a JWKS fetch times out. Defaults to 10. The fetch happens inline on the request
+	// path, so an unresponsive provider blocks serving for at most this long.
+	// +optional
+	// +kubebuilder:validation:Minimum=1
+	JwksRequestTimeoutSeconds *int32 `json:"jwksRequestTimeoutSeconds,omitempty"`
 }
 
 // OidcCACertConfigMap references a ConfigMap containing a CA certificate for OIDC provider TLS.

@@ -147,7 +147,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2026-07-20T13:27:58Z"
+    createdAt: "2026-07-31T18:28:04Z"
     operators.operatorframework.io/builder: operator-sdk-v1.41.0
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: feast-operator.v0.65.0

@@ -81,6 +81,18 @@ spec:
                           to derive the discovery endpoint.
                         pattern: ^https://\S+$
                         type: string
+                      jwksCacheLifespanSeconds:
+                        description: Seconds the servers reuse the provider's fetched
+                          JWK set before refetching. Defaults to 300.
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      jwksRequestTimeoutSeconds:
+                        description: Seconds before a JWKS fetch times out. Defaults
+                          to 10.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       secretKeyName:
                         description: Key in the Secret containing all OIDC properties
                           as a YAML value. If unset, each key is a property.
@@ -6390,6 +6402,18 @@ spec:
                               to derive the discovery endpoint.
                             pattern: ^https://\S+$
                             type: string
+                          jwksCacheLifespanSeconds:
+                            description: Seconds the servers reuse the provider's
+                              fetched JWK set before refetching. Defaults to 300.
+                            format: int32
+                            minimum: 1
+                            type: integer
+                          jwksRequestTimeoutSeconds:
+                            description: Seconds before a JWKS fetch times out. Defaults
+                              to 10.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           secretKeyName:
                             description: Key in the Secret containing all OIDC properties
                               as a YAML value. If unset, each key is a property.

@@ -81,6 +81,18 @@ spec:
                           to derive the discovery endpoint.
                         pattern: ^https://\S+$
                         type: string
+                      jwksCacheLifespanSeconds:
+                        description: Seconds the servers reuse the provider's fetched
+                          JWK set before refetching. Defaults to 300.
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      jwksRequestTimeoutSeconds:
+                        description: Seconds before a JWKS fetch times out. Defaults
+                          to 10.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       secretKeyName:
                         description: Key in the Secret containing all OIDC properties
                           as a YAML value. If unset, each key is a property.
@@ -6390,6 +6402,18 @@ spec:
                               to derive the discovery endpoint.
                             pattern: ^https://\S+$
                             type: string
+                          jwksCacheLifespanSeconds:
+                            description: Seconds the servers reuse the provider's
+                              fetched JWK set before refetching. Defaults to 300.
+                            format: int32
+                            minimum: 1
+                            type: integer
+                          jwksRequestTimeoutSeconds:
+                            description: Seconds before a JWKS fetch times out. Defaults
+                              to 10.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           secretKeyName:
                             description: Key in the Secret containing all OIDC properties
                               as a YAML value. If unset, each key is a property.

@@ -89,6 +89,18 @@ spec:
                           to derive the discovery endpoint.
                         pattern: ^https://\S+$
                         type: string
+                      jwksCacheLifespanSeconds:
+                        description: Seconds the servers reuse the provider's fetched
+                          JWK set before refetching. Defaults to 300.
+                        format: int32
+                        minimum: 1
+                        type: integer
+                      jwksRequestTimeoutSeconds:
+                        description: Seconds before a JWKS fetch times out. Defaults
+                          to 10.
+                        format: int32
+                        minimum: 1
+                        type: integer
                       secretKeyName:
                         description: Key in the Secret containing all OIDC properties
                           as a YAML value. If unset, each key is a property.
@@ -6398,6 +6410,18 @@ spec:
                               to derive the discovery endpoint.
                             pattern: ^https://\S+$
                             type: string
+                          jwksCacheLifespanSeconds:
+                            description: Seconds the servers reuse the provider's
+                              fetched JWK set before refetching. Defaults to 300.
+                            format: int32
+                            minimum: 1
+                            type: integer
+                          jwksRequestTimeoutSeconds:
+                            description: Seconds before a JWKS fetch times out. Defaults
+                              to 10.
+                            format: int32
+                            minimum: 1
+                            type: integer
                           secretKeyName:
                             description: Key in the Secret containing all OIDC properties
                               as a YAML value. If unset, each key is a property.

@@ -642,6 +642,11 @@ _Appears in:_
 | `tokenEnvVar` _string_ | Env var name for client pods to read an OIDC token from. Sets token_env_var in client config. |
 | `verifySSL` _boolean_ | Verify SSL certificates for the OIDC provider. Defaults to true. |
 | `caCertConfigMap` _[OidcCACertConfigMap](#oidccacertconfigmap)_ | ConfigMap with the CA certificate for self-signed OIDC providers. Auto-detected on RHOAI/ODH. |
+| `jwksCacheLifespanSeconds` _integer_ | Seconds the servers reuse the provider's fetched JWK set before refetching. Defaults to 300.
+Also bounds how long a key the provider revoked keeps validating tokens, so lower it if the
+provider rotates or revokes aggressively, at the cost of more JWKS fetches. |
+| `jwksRequestTimeoutSeconds` _integer_ | Seconds before a JWKS fetch times out. Defaults to 10. The fetch happens inline on the request
+path, so an unresponsive provider blocks serving for at most this long. |
 
 
 #### OidcCACertConfigMap

@@ -163,6 +163,12 @@ func getBaseServiceRepoConfig(
 		if oidcAuthz.VerifySSL != nil {
 			oidcParameters[string(OidcVerifySsl)] = *oidcAuthz.VerifySSL
 		}
+		if oidcAuthz.JwksCacheLifespanSeconds != nil {
+			oidcParameters[string(OidcJwksCacheLifespanSeconds)] = *oidcAuthz.JwksCacheLifespanSeconds
+		}
+		if oidcAuthz.JwksRequestTimeoutSeconds != nil {
+			oidcParameters[string(OidcJwksRequestTimeoutSeconds)] = *oidcAuthz.JwksRequestTimeoutSeconds
+		}
 		if caCertPath := resolveOidcCACertPath(oidcAuthz, odhCaBundleExists); caCertPath != "" {
 			oidcParameters[string(OidcCaCertPath)] = caCertPath
 		}

@@ -259,6 +259,32 @@ var _ = Describe("Repo Config", func() {
 			Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveLen(1))
 			Expect(repoConfig.AuthzConfig.OidcParameters[string(OidcAuthDiscoveryUrl)]).To(Equal("https://keycloak.example.com/realms/test/.well-known/openid-configuration"))
 
+			By("Omitting the JWKS tunables when unset, so the SDK defaults apply")
+			Expect(repoConfig.AuthzConfig.OidcParameters).NotTo(HaveKey(string(OidcJwksCacheLifespanSeconds)))
+			Expect(repoConfig.AuthzConfig.OidcParameters).NotTo(HaveKey(string(OidcJwksRequestTimeoutSeconds)))
+
+			By("Forwarding the JWKS tunables when set on the CR")
+			jwksLifespan := int32(60)
+			jwksTimeout := int32(5)
+			featureStore.Spec.AuthzConfig = &feastdevv1.AuthzConfig{
+				OidcAuthz: &feastdevv1.OidcAuthz{
+					IssuerUrl:                 "https://keycloak.example.com/realms/test",
+					JwksCacheLifespanSeconds:  &jwksLifespan,
+					JwksRequestTimeoutSeconds: &jwksTimeout,
+				},
+			}
+			ApplyDefaultsToStatus(featureStore)
+			repoConfig, err = getServiceRepoConfig(featureStore, emptyMockExtractConfigFromSecret, emptyMockExtractConfigFromConfigMap, false)
+			Expect(err).NotTo(HaveOccurred())
+			Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveLen(3))
+			Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKeyWithValue(string(OidcJwksCacheLifespanSeconds), int32(60)))
+			Expect(repoConfig.AuthzConfig.OidcParameters).To(HaveKeyWithValue(string(OidcJwksRequestTimeoutSeconds), int32(5)))
+
+			By("Keeping the JWKS tunables out of the client config, which does not accept them")
+			clientRepoConfig := getClientRepoConfig(featureStore, nil)
+			Expect(clientRepoConfig.AuthzConfig.OidcParameters).NotTo(HaveKey(string(OidcJwksCacheLifespanSeconds)))
+			Expect(clientRepoConfig.AuthzConfig.OidcParameters).NotTo(HaveKey(string(OidcJwksRequestTimeoutSeconds)))
+
 			By("Having oidc with issuerUrl on CR and auth_discovery_url in Secret — CR wins")
 			featureStore.Spec.AuthzConfig = &feastdevv1.AuthzConfig{
 				OidcAuthz: &feastdevv1.OidcAuthz{

@@ -116,6 +116,9 @@ const (
 	OidcAudience         OidcPropertyType = "audience"
 	OidcIssuer           OidcPropertyType = "issuer"
 
+	OidcJwksCacheLifespanSeconds  OidcPropertyType = "jwks_cache_lifespan_seconds"
+	OidcJwksRequestTimeoutSeconds OidcPropertyType = "jwks_request_timeout_seconds"
+
 	OidcMissingSecretError string = "missing OIDC secret: %s"
 
 	// Common string constants

@@ -296,6 +296,13 @@ func authzConfigWithOidc(featureStore *feastdevv1.FeatureStore) *feastdevv1.Feat
 	return fsCopy
 }
 
+func authzConfigWithOidcJwksTunables(jwksCacheLifespanSeconds *int32, jwksRequestTimeoutSeconds *int32, featureStore *feastdevv1.FeatureStore) *feastdevv1.FeatureStore {
+	fsCopy := authzConfigWithOidc(featureStore)
+	fsCopy.Spec.AuthzConfig.OidcAuthz.JwksCacheLifespanSeconds = jwksCacheLifespanSeconds
+	fsCopy.Spec.AuthzConfig.OidcAuthz.JwksRequestTimeoutSeconds = jwksRequestTimeoutSeconds
+	return fsCopy
+}
+
 func onlineStoreWithDBPersistenceType(dbPersistenceType string, featureStore *feastdevv1.FeatureStore) *feastdevv1.FeatureStore {
 	fsCopy := featureStore.DeepCopy()
 	fsCopy.Spec.Services = &feastdevv1.FeatureStoreServices{
@@ -610,6 +617,14 @@ var _ = Describe("FeatureStore API", func() {
 		It("should fail when both kubernetes and oidc settings are given", func() {
 			attemptInvalidCreationAndAsserts(ctx, authzConfigWithOidc(authzConfigWithKubernetes(featurestore)), "One selection required between kubernetes or oidc")
 		})
+		It("should fail when the oidc JWKS cache lifespan is below one second", func() {
+			zero := int32(0)
+			attemptInvalidCreationAndAsserts(ctx, authzConfigWithOidcJwksTunables(&zero, nil, featurestore), "should be greater than or equal to 1")
+		})
+		It("should fail when the oidc JWKS request timeout is below one second", func() {
+			zero := int32(0)
+			attemptInvalidCreationAndAsserts(ctx, authzConfigWithOidcJwksTunables(nil, &zero, featurestore), "should be greater than or equal to 1")
+		})
 	})
 
 	Context("When creating a Registry", func() {