flagd Provider for OpenFeature

This provider is designed to use flagd's evaluation protocol, or locally evaluate flags defined in a flagd flag definition via the OpenFeature Python SDK.

Installation

pip install openfeature-provider-flagd

Configuration and Usage

The flagd provider can operate in two modes: RPC (evaluation takes place in flagd, via gRPC calls) or in-process (evaluation takes place in-process, with the provider getting a ruleset from a compliant sync-source).

Remote resolver (RPC)

This is the default mode of operation of the provider. In this mode, FlagdProvider communicates with flagd via the gRPC protocol. Flag evaluations take place remotely at the connected flagd instance.

Instantiate a new FlagdProvider instance and configure the OpenFeature SDK to use it:

from openfeature import api
from openfeature.contrib.provider.flagd import FlagdProvider

api.set_provider(FlagdProvider())

In-process resolver

This mode performs flag evaluations locally (in-process). Flag configurations for evaluation are obtained via gRPC protocol using sync protobuf schema service definition.

Consider the following example to create a FlagdProvider with in-process evaluations,

from openfeature import api
from openfeature.contrib.provider.flagd import FlagdProvider
from openfeature.contrib.provider.flagd.config import ResolverType

api.set_provider(
    FlagdProvider(
        resolver_type=ResolverType.IN_PROCESS,
    )
)

In the above example, in-process handlers attempt to connect to a sync service on address localhost:8013 to obtain flag definitions.

File mode

In-process resolvers can also work in an offline mode. To enable this mode, you should provide a valid flag configuration file with the option offlineFlagSourcePath.

from openfeature import api
from openfeature.contrib.provider.flagd import FlagdProvider
from openfeature.contrib.provider.flagd.config import ResolverType

api.set_provider(
    FlagdProvider(
        resolver_type=ResolverType.FILE,
        offline_flag_source_path="my-flag.json",
    )
)

Provider will attempt to detect file changes using polling. Polling happens at 5 second intervals and this is currently unconfigurable. This mode is useful for local development, tests and offline applications.

Configuration options

The default options can be defined in the FlagdProvider constructor.

Custom channel credentials

Pass custom grpc.ChannelCredentials to channel_credentials to control the TLS setup. The provider uses these credentials in both resolver modes. They take precedence over tls and cert_path, and the provider creates a secure channel even when tls is False.

To trust a private server certificate authority (CA), supply only the root certificates:

import grpc

from openfeature.contrib.provider.flagd import FlagdProvider

with open("ca.pem", "rb") as ca_file:
    credentials = grpc.ssl_channel_credentials(root_certificates=ca_file.read())

provider = FlagdProvider(channel_credentials=credentials)

When flagd requires mutual TLS (mTLS), also supply the client key and certificate:

import grpc

from openfeature.contrib.provider.flagd import FlagdProvider

with (
    open("ca.pem", "rb") as ca_file,
    open("client-key.pem", "rb") as key_file,
    open("client-cert.pem", "rb") as cert_file,
):
    credentials = grpc.ssl_channel_credentials(
        root_certificates=ca_file.read(),
        private_key=key_file.read(),
        certificate_chain=cert_file.read(),
    )

provider = FlagdProvider(channel_credentials=credentials)

Selector Handling (In-Process Mode Only)

Current Implementation

As of this SDK version, the selector parameter is passed via both gRPC metadata headers (flagd-selector) and the request body when using in-process mode. This dual approach ensures maximum compatibility with all flagd versions.

Configuration Example:

from openfeature import api
from openfeature.contrib.provider.flagd import FlagdProvider
from openfeature.contrib.provider.flagd.config import ResolverType

api.set_provider(
    FlagdProvider(
        resolver_type=ResolverType.IN_PROCESS,
        selector="my-flag-source",  # Passed via both header and request body
    )
)

The selector is automatically passed via:

• gRPC metadata header (flagd-selector) - For flagd v0.11.0+ selector normalization
• Request body - For backward compatibility with older flagd versions

Backward Compatibility

This dual transmission approach ensures the Python SDK works seamlessly with all flagd service versions:

• Older flagd versions read the selector from the request body
• Newer flagd versions (v0.11.0+) prefer the selector from the gRPC metadata header
• Both approaches are supported simultaneously for maximum compatibility

Related Resources:

• Upstream issue: open-feature/flagd#1814
• Selector normalization affects in-process evaluations that filter flag configurations by source

Reconnection

Reconnection is supported by the underlying gRPC connections. If the connection to flagd is lost, it will reconnect automatically. A failure to connect will result in an error event from the provider, though it will attempt to reconnect indefinitely.

Deadlines

Deadlines are used to define how long the provider waits to complete initialization or flag evaluations. They behave differently based on the resolver type.

Deadlines with Remote resolver (RPC)

If the remote evaluation call is not completed within this deadline, the gRPC call is terminated with the error DEADLINE_EXCEEDED and the evaluation will default.

TLS

TLS is available in situations where flagd is running on another host.

You may optionally supply an X.509 certificate in PEM format. Otherwise, the default certificate store will be used.

from openfeature import api
from openfeature.contrib.provider.flagd import FlagdProvider

api.set_provider(
    FlagdProvider(
        tls=True,  # use TLS
        cert_path="etc/cert/ca.crt",  # PEM cert
    )
)

License

Apache 2.0 - See LICENSE for more information.