feast 0.66.0.dev48__tar.gz → 0.66.0.dev50__tar.gz

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/.github/workflows/master_only.yml

@@ -102,8 +102,8 @@ jobs:
             push_mode: all_tags
           - component: feast-operator
             target: feast-operator
-            build_args: ""
-            push_mode: all_tags
+            build_args: DOCKER_PUSH=true DOCKER_PLATFORMS=linux/amd64,linux/arm64
+            push_mode: imagetools
     env:
       REGISTRY: quay.io/feastdev-ci
     steps:
@@ -135,7 +135,7 @@ jobs:
       - name: Push image
         run: |
           if [[ "${{ matrix.push_mode }}" == "imagetools" ]]; then
-            docker buildx imagetools create -t ${REGISTRY}/feature-server:develop ${REGISTRY}/feature-server:${GITHUB_SHA}
+            docker buildx imagetools create -t ${REGISTRY}/${{ matrix.target }}:develop ${REGISTRY}/${{ matrix.target }}:${GITHUB_SHA}
           else
             docker tag ${REGISTRY}/${{ matrix.target }}:${GITHUB_SHA} ${REGISTRY}/${{ matrix.target }}:develop && docker push ${REGISTRY}/${{ matrix.target }} --all-tags
           fi

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/.github/workflows/publish_images.yml

@@ -74,7 +74,7 @@ jobs:
         env:
           VERSION_WITHOUT_PREFIX: ${{ steps.get-version.outputs.version_without_prefix }}
         run: |
-          if [ "${{ matrix.component }}" = "feature-server" ]; then
+          if [[ "${{ matrix.component }}" == "feature-server" || "${{ matrix.component }}" == "feast-operator" ]]; then
             make build-${{ matrix.component }}-docker REGISTRY=${REGISTRY} VERSION=${VERSION_WITHOUT_PREFIX} DOCKER_PUSH=true DOCKER_PLATFORMS=linux/amd64,linux/arm64
           else
             make build-${{ matrix.component }}-docker REGISTRY=${REGISTRY} VERSION=${VERSION_WITHOUT_PREFIX}
@@ -84,8 +84,8 @@ jobs:
           VERSION_WITHOUT_PREFIX: ${{ steps.get-version.outputs.version_without_prefix }}
           HIGHEST_SEMVER_TAG: ${{ steps.get-version.outputs.highest_semver_tag }}
         run: |
-          if [ "${{ matrix.component }}" = "feature-server" ]; then
-            echo "feature-server image pushed via buildx during build step"
+          if [[ "${{ matrix.component }}" == "feature-server" || "${{ matrix.component }}" == "feast-operator" ]]; then
+            echo "${{ matrix.component }} image pushed via buildx during build step"
           else
             make push-${{ matrix.component }}-docker REGISTRY=${REGISTRY} VERSION=${VERSION_WITHOUT_PREFIX}
           fi
@@ -93,8 +93,8 @@ jobs:
           echo "Only push to latest tag if tag is the highest semver version $HIGHEST_SEMVER_TAG"
           if [ "${VERSION_WITHOUT_PREFIX}" = "${HIGHEST_SEMVER_TAG:1}" ]
           then
-            if [ "${{ matrix.component }}" = "feature-server" ]; then
-              docker buildx imagetools create -t ${REGISTRY}/feature-server:latest ${REGISTRY}/feature-server:${VERSION_WITHOUT_PREFIX}
+            if [[ "${{ matrix.component }}" == "feature-server" || "${{ matrix.component }}" == "feast-operator" ]]; then
+              docker buildx imagetools create -t ${REGISTRY}/${{ matrix.component }}:latest ${REGISTRY}/${{ matrix.component }}:${VERSION_WITHOUT_PREFIX}
             else
               docker tag ${REGISTRY}/${{ matrix.component }}:${VERSION_WITHOUT_PREFIX} ${REGISTRY}/${{ matrix.component }}:latest
               docker push ${REGISTRY}/${{ matrix.component }}:latest

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/.secrets.baseline

@@ -1564,5 +1564,5 @@
       }
     ]
   },
-  "generated_at": "2026-07-17T12:34:13Z"
+  "generated_at": "2026-07-23T08:52:32Z"
 }

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/Makefile

@@ -730,10 +730,16 @@ push-feast-operator-docker: ## Push Feast Operator Docker image
 	$(MAKE) docker-push
 
 build-feast-operator-docker: ## Build Feast Operator Docker image
-	cd infra/feast-operator && \
-	IMAGE_TAG_BASE=$(REGISTRY)/feast-operator \
-	VERSION=$(VERSION) \
-	$(MAKE) docker-build
+	@if [ -n "$(DOCKER_PLATFORMS)" ]; then \
+		cd infra/feast-operator && \
+		docker buildx build --push --platform=$(DOCKER_PLATFORMS) \
+			--tag $(REGISTRY)/feast-operator:$(VERSION) -f Dockerfile .; \
+	else \
+		cd infra/feast-operator && \
+		IMAGE_TAG_BASE=$(REGISTRY)/feast-operator \
+		VERSION=$(VERSION) \
+		$(MAKE) docker-build; \
+	fi
 
 build-feast-operator-docker-on-mac: ## Build Feast Operator Docker image on Mac
 	cd infra/feast-operator && \

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: feast
-Version: 0.66.0.dev48
+Version: 0.66.0.dev50
 Summary: Python SDK for Feast
 Author: Feast
 License-Expression: Apache-2.0

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast/api/registry/rest/rest_registry_server.py

@@ -327,6 +327,10 @@ class RestRegistryServer:
     ):
         import uvicorn
 
+        from feast.registry_server import _sync_protected_project_tag
+
+        _sync_protected_project_tag(self.store)
+
         if tls_key_path and tls_cert_path:
             logger.info("Starting REST registry server in TLS(SSL) mode")
             logger.info(f"REST registry server listening on https://localhost:{port}")

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast/constants.py

@@ -46,3 +46,12 @@ DEFAULT_OFFLINE_SERVER_PORT = 8815
 
 # Default feature server registry ttl (seconds)
 DEFAULT_FEATURE_SERVER_REGISTRY_TTL = 5
+
+# Tag key set on Feast projects that are protected.
+# Protected projects are excluded from project listings,
+# shielded from teardown, and hidden from delete operations.
+PROTECTED_PROJECT_TAG = "feast.dev/protected-project"
+
+# Environment variable set by the operator on protected project pods.
+# When "true", the Feast server tags its own project as protected.
+FEAST_PROTECTED_PROJECT_ENV = "FEAST_PROTECTED_PROJECT"

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast/feature_server.py

@@ -13,6 +13,7 @@
 # limitations under the License.
 
 import asyncio
+import functools
 import os
 import sys
 import threading
@@ -1004,6 +1005,7 @@ if sys.platform != "win32":
                 store=store,
                 registry_ttl_sec=options["registry_ttl_sec"],
             )
+            self._store = store
             self._options = options
             self._metrics_enabled = metrics_enabled
             super().__init__()
@@ -1015,15 +1017,19 @@ if sys.platform != "win32":
 
             self.cfg.set("worker_class", "uvicorn_worker.UvicornWorker")
             if self._metrics_enabled:
-                self.cfg.set("post_worker_init", _gunicorn_post_worker_init)
+                self.cfg.set(
+                    "post_worker_init",
+                    functools.partial(_gunicorn_post_worker_init, self._store),
+                )
                 self.cfg.set("child_exit", _gunicorn_child_exit)
 
         def load(self):
             return self._app
 
-    def _gunicorn_post_worker_init(worker):
-        """Start per-worker resource monitoring after Gunicorn forks."""
+    def _gunicorn_post_worker_init(store: "feast.FeatureStore", worker):
+        """Start per-worker resource and freshness monitoring after Gunicorn forks."""
         feast_metrics.init_worker_monitoring()
+        feast_metrics.init_worker_freshness_monitoring(store)
 
     def _gunicorn_child_exit(server, worker):
         """Clean up Prometheus metric files for a dead worker."""
@@ -1061,6 +1067,7 @@ def start_server(
             store,
             metrics_config=flags,
             start_resource_monitoring=not uses_gunicorn,
+            start_freshness_monitoring=not uses_gunicorn,
         )
 
     logger.debug("start_server called")

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast/feature_store.py

@@ -1884,6 +1884,21 @@ class FeatureStore:
 
     def teardown(self):
         """Tears down all local and cloud resources for the feature store."""
+        from feast.constants import PROTECTED_PROJECT_TAG
+
+        # Prevent teardown of protected projects
+        try:
+            current = self.registry.get_project(name=self.project, allow_cache=False)
+            if current and current.tags.get(PROTECTED_PROJECT_TAG) == "true":
+                raise ValueError(
+                    f'Teardown is not allowed on protected project "{self.project}". '
+                    "Protected projects are managed externally and cannot be torn down via Feast."
+                )
+        except ValueError:
+            raise
+        except Exception:
+            pass
+
         tables: List[BaseFeatureView] = []
         tables.extend(self.list_feature_views())
         tables.extend(self.list_label_views())
@@ -1891,7 +1906,10 @@ class FeatureStore:
         entities = self.list_entities()
 
         self._get_provider().teardown_infra(self.project, tables, entities)  # type: ignore[arg-type]
-        self.registry.teardown()
+
+        for project in self.list_projects():
+            self.registry.delete_project(project.name)
+
         self._teardown_openlineage()
 
     def _teardown_openlineage(self):
@@ -4732,6 +4750,9 @@ class FeatureStore:
         """
         Retrieves the list of projects from the registry.
 
+        Protected projects (feast.dev/protected-project=true) are automatically
+        excluded from the results.
+
         Args:
             allow_cache: Whether to allow returning projects from a cached registry.
             tags: Filter by tags.
@@ -4739,7 +4760,10 @@ class FeatureStore:
         Returns:
             A list of projects.
         """
-        return self.registry.list_projects(allow_cache=allow_cache, tags=tags)
+        from feast.constants import PROTECTED_PROJECT_TAG
+
+        projects = self.registry.list_projects(allow_cache=allow_cache, tags=tags)
+        return [p for p in projects if p.tags.get(PROTECTED_PROJECT_TAG) != "true"]
 
     def get_project(self, name: Optional[str]) -> Project:
         """
@@ -4766,7 +4790,21 @@ class FeatureStore:
 
         Raises:
             ProjectNotFoundException: The project could not be found.
+            ValueError: If the project is protected.
         """
+        from feast.constants import PROTECTED_PROJECT_TAG
+
+        try:
+            project = self.registry.get_project(name=name, allow_cache=False)
+            if project and project.tags.get(PROTECTED_PROJECT_TAG) == "true":
+                raise ValueError(
+                    f'Cannot delete protected project "{name}". '
+                    "Protected projects are managed externally."
+                )
+        except ValueError:
+            raise
+        except Exception:
+            pass
         return self.registry.delete_project(name, commit=commit)
 
     def list_saved_datasets(

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast/metrics.py

@@ -572,11 +572,23 @@ def init_worker_monitoring():
         t.start()
 
 
+def init_worker_freshness_monitoring(store: "FeatureStore"):
+    """Start feature-freshness monitoring inside a Gunicorn worker process.
+
+    Called from the ``post_worker_init`` hook so that each worker starts
+    its own freshness monitoring after the fork, not before.
+    """
+    if _config.freshness:
+        t = threading.Thread(target=monitor_freshness, args=(store, 30), daemon=True)
+        t.start()
+
+
 def start_metrics_server(
     store: "FeatureStore",
     port: int = 8000,
     metrics_config: Optional["_MetricsFlags"] = None,
     start_resource_monitoring: bool = True,
+    start_freshness_monitoring: bool = True,
 ):
     """
     Start the Prometheus metrics HTTP server and background monitoring threads.
@@ -593,6 +605,10 @@ def start_metrics_server(
             monitoring thread.  Set to ``False`` when Gunicorn will
             fork workers — the ``post_worker_init`` hook starts
             per-worker monitoring instead.
+        start_freshness_monitoring: Whether to start the feature-freshness
+            thread here.  Set to ``False`` when Gunicorn will fork
+            workers — the ``post_worker_init`` hook starts per-worker
+            freshness monitoring instead.
     """
     global _config
 
@@ -632,7 +648,7 @@ def start_metrics_server(
         )
         resource_thread.start()
 
-    if _config.freshness:
+    if _config.freshness and start_freshness_monitoring:
         freshness_thread = threading.Thread(
             target=monitor_freshness, args=(store, 30), daemon=True
         )

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast/registry_server.py

@@ -1487,17 +1487,26 @@ class RegistryServer(RegistryServer_pb2_grpc.RegistryServerServicer):
         ).to_proto()
 
     def ListProjects(self, request: RegistryServer_pb2.ListProjectsRequest, context):
-        paginated_projects, pagination_metadata = apply_pagination_and_sorting(
-            permitted_resources(
-                resources=cast(
-                    list[FeastObject],
-                    self.proxied_registry.list_projects(
-                        allow_cache=request.allow_cache,
-                        tags=dict(request.tags),
-                    ),
+        from feast.constants import PROTECTED_PROJECT_TAG
+
+        permitted_projects = permitted_resources(
+            resources=cast(
+                list[FeastObject],
+                self.proxied_registry.list_projects(
+                    allow_cache=request.allow_cache,
+                    tags=dict(request.tags),
                 ),
-                actions=AuthzedAction.DESCRIBE,
             ),
+            actions=AuthzedAction.DESCRIBE,
+        )
+
+        # Exclude protected projects after RBAC check
+        visible_projects = [
+            p for p in permitted_projects if p.tags.get(PROTECTED_PROJECT_TAG) != "true"
+        ]
+
+        paginated_projects, pagination_metadata = apply_pagination_and_sorting(
+            visible_projects,
             pagination=request.pagination,
             sorting=request.sorting,
         )
@@ -1724,6 +1733,57 @@ class RegistryServer(RegistryServer_pb2_grpc.RegistryServerServicer):
         )
 
 
+def _sync_protected_project_tag(store: FeatureStore):
+    """Sync the protected project tag based on FEAST_PROTECTED_PROJECT env var.
+
+    When FEAST_PROTECTED_PROJECT=true, tags the project as protected in the
+    shared registry. When the env var is absent or false, removes the tag
+    if it was previously set — allowing temporary protection that can be
+    reversed by removing the annotation from the FeatureStore CR.
+    """
+    import os
+
+    from feast.constants import FEAST_PROTECTED_PROJECT_ENV, PROTECTED_PROJECT_TAG
+
+    should_protect = os.environ.get(FEAST_PROTECTED_PROJECT_ENV, "").lower() == "true"
+
+    try:
+        existing = store.registry.get_project(name=store.project, allow_cache=False)
+    except Exception:
+        if should_protect:
+            from feast.project import Project
+
+            project = Project(
+                name=store.project,
+                tags={PROTECTED_PROJECT_TAG: "true"},
+            )
+            store.registry.apply_project(project, commit=True)
+            logger.info(
+                "Tagged project '%s' as protected (%s=true)",
+                store.project,
+                PROTECTED_PROJECT_TAG,
+            )
+        return
+
+    is_protected = existing.tags.get(PROTECTED_PROJECT_TAG) == "true"
+
+    if should_protect and not is_protected:
+        existing.tags[PROTECTED_PROJECT_TAG] = "true"
+        store.registry.apply_project(existing, commit=True)
+        logger.info(
+            "Tagged project '%s' as protected (%s=true)",
+            store.project,
+            PROTECTED_PROJECT_TAG,
+        )
+    elif not should_protect and is_protected:
+        del existing.tags[PROTECTED_PROJECT_TAG]
+        store.registry.apply_project(existing, commit=True)
+        logger.info(
+            "Removed protected tag from project '%s'",
+            store.project,
+        )
+
+
 def start_server(
     store: FeatureStore,
     port: int,
@@ -1731,6 +1791,8 @@ def start_server(
     tls_key_path: str = "",
     tls_cert_path: str = "",
 ):
+    _sync_protected_project_tag(store)
+
     auth_manager_type = str_to_auth_manager_type(store.config.auth_config.type)
     init_security_manager(auth_type=auth_manager_type, fs=store)
     init_auth_manager(

{feast-0.66.0.dev48 → feast-0.66.0.dev50}/sdk/python/feast.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: feast
-Version: 0.66.0.dev48
+Version: 0.66.0.dev50
 Summary: Python SDK for Feast
 Author: Feast
 License-Expression: Apache-2.0