Skip to content

WIP: CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate - #3037

Open
tchap wants to merge 2 commits into
openshift:masterfrom
tchap:external-oidc-proxy-feature-gate
Open

WIP: CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate#3037
tchap wants to merge 2 commits into
openshift:masterfrom
tchap:external-oidc-proxy-feature-gate

Conversation

@tchap

@tchap tchap commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

This feature gate gates component-scoped proxy support for the External OIDC authentication stack.

@openshift-ci-robot openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 14, 2026
@openshift-ci

openshift-ci Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci-robot

openshift-ci-robot commented Sep 14, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown

@tchap: This pull request references CNTRLPLANE-4394 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

This feature gate gates component-scoped proxy support for the External OIDC authentication stack.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci

openshift-ci Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Hello @tchap! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

@coderabbitai

coderabbitai Bot commented Sep 14, 2026 •
edited
Loading

Copy link
Copy Markdown

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: daf5e729-7900-436c-b6cd-c07465de07e1

📥 Commits

Reviewing files that changed from the base of the PR and between 73b8103 and a054c47.

⛔ Files ignored due to path filters (17)
  • openapi/generated_openapi/zz_generated.openapi.go is excluded by !openapi/**, !**/zz_generated*
  • openapi/openapi.json is excluded by !openapi/**
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-4-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-4-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-5-10-SelfManagedHA-DevPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-5-10-SelfManagedHA-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-Default.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-Hypershift-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-Hypershift-DevPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-Hypershift-TechPreviewNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-OKD.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.crd-manifests/0000_50_console_01_consoles-SelfManagedHA-CustomNoUpgrade.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
  • operator/v1/zz_generated.deepcopy.go is excluded by !**/zz_generated*
  • operator/v1/zz_generated.featuregated-crd-manifests.yaml is excluded by !**/zz_generated*
  • operator/v1/zz_generated.featuregated-crd-manifests/consoles.operator.openshift.io/AuthenticationComponentProxyExternalOIDC.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
  • operator/v1/zz_generated.model_name.go is excluded by !**/zz_generated*
  • operator/v1/zz_generated.swagger_doc_generated.go is excluded by !**/zz_generated*
📒 Files selected for processing (12)
  • features.md
  • features/features.go
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-4-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-4-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-4-SelfManagedHA-TechPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-Default.yaml
  • payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
  • payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-OKD.yaml
  • payload-manifests/featuregates/featureGate-5-10-SelfManagedHA-TechPreviewNoUpgrade.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
  • features.md

Included review availability: This review used your included allowance. Your plan provides up to 12 included reviews per hour; 10 remain after this review.

📝 Walkthrough

Walkthrough

The change registers AuthenticationComponentProxyExternalOIDC and adds it to the feature-gate table. ConsoleSpec gains a gated authProxy configuration with proxy URL, noProxy, and trusted CA fields, plus validation constraints and test cases. Payload manifests enable the gate in DevPreviewNoUpgrade and TechPreviewNoUpgrade, and disable it in Default and OKD configurations. Some HyperShift manifests also change the DRADeviceTaintRules and SELinuxMount entries.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to a054c

External OIDC proxy remains disabled in Default and OKD and is enabled only in preview profiles; the Console schema and fixtures use the same gate. No concrete behavior change warrants holding this PR.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Microshift Test Compatibility ⚠️ Warning The added YAML suites generate Ginkgo Describe/DescribeTable tests through tests/generator.go. Their cases create and update operator.openshift.io/v1 Console resources. MicroShift does not s… MicroShift compatibility notice: This test uses APIs or features that are not available on MicroShift. If this repository's presubmit CI does not already include MicroShift jobs, please verify your test works on MicroShift by running an…
✅ Passed checks (14 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the addition of the AuthenticationComponentProxyExternalOIDC feature gate and includes the related issue reference.
Description check ✅ Passed The description directly explains that the feature gate controls component-scoped proxy support for the External OIDC authentication stack.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names ✅ Passed The custom check requires that Ginkgo test names must be stable and deterministic, and must never contain dynamic information. Investigation findings: 1. The pull request does NOT add any Ginkgo test …
Test Structure And Quality ✅ Passed The added suites use the repository's declarative Ginkgo test harness. Each case has one focused Console create or update behavior, with distinct names and targeted expected errors. The shared harness…
Single Node Openshift (Sno) Test Compatibility ✅ Passed PASS. The pull request adds declarative Console API validation fixtures in YAML, not Ginkgo e2e tests. The fixtures test create/update validation and feature-gate pruning only. They contain no node, s…
Topology-Aware Scheduling Compatibility ✅ Passed PASS: The pull request adds a Console API field, validation/schema output, tests, and feature-gate registrations. The authoritative diff contains no Deployment or controller scheduling changes and no …
Ote Binary Stdout Contract ✅ Passed The pull request adds feature-gate declarations, API types, generated schemas, manifests, and YAML test configurations. The changed Go code contains no stdout or logging writes and no main(), TestMain…
Ipv6 And Disconnected Network Test Compatibility ✅ Passed PASS: The added test suites are declarative YAML cases for CRD create/update validation. They contain no hardcoded IPv4 addresses, IP parsing, IPv4-only CIDRs, IPv6-unsafe URL construction, or network…
No-Weak-Crypto ✅ Passed The pull-request diff adds a feature gate, Console proxy schema, validation rules, tests, and generated manifests. It introduces no MD5, SHA1, DES, 3DES, RC4, Blowfish, or ECB usage, custom cryptograp…
Container-Privileges ✅ Passed The pull request adds a Console API field, CRD schemas, tests, and feature-gate manifests. The changed manifests are CRDs or test fixtures, not workload/container manifests. Added lines contain no `pr…
No-Sensitive-Data-In-Logs ✅ Passed The pull request adds feature-gate declarations, API fields, schemas, generated manifests, and test fixtures. It adds no logging calls or log serialization. The only password-like text is placeholder …
Full details: Microshift Test Compatibility

Explanation

The added YAML suites generate Ginkgo Describe/DescribeTable tests through tests/generator.go. Their cases create and update operator.openshift.io/v1 Console resources. MicroShift does not serve this OpenShift API group. The added test names contain no MicroShift skip label or API-group tag, and the tests have no IsMicroShiftCluster() guard.

Resolution

MicroShift compatibility notice: This test uses APIs or features that are not available on MicroShift. If this repository's presubmit CI does not already include MicroShift jobs, please verify your test works on MicroShift by running an additional CI job: /payload-job periodic-ci-openshift-microshift-release-4.22-periodics-e2e-aws-ovn-ocp-conformance If the test is intentionally not applicable to MicroShift, add an API-group skip tag such as [apigroup:operator.openshift.io] if the test framework supports it, or add [Skipped:MicroShift] / a runtime exutil.IsMicroShiftCluster() guard.

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🧪 Generate unit tests (beta)
  • Create a new PR
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

Comment @coderabbitai help to get the list of available commands.

@openshift-ci openshift-ci Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 14, 2026
@openshift-ci

openshift-ci Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tchap

tchap commented Sep 15, 2026

Copy link
Copy Markdown
Contributor Author

/retest

@tchap
tchap force-pushed the external-oidc-proxy-feature-gate branch from e64c296 to fe5dbd1 Compare September 16, 2026 12:32
@everettraven

everettraven commented Sep 16, 2026

Copy link
Copy Markdown
Contributor

The changes here LGTM.

Before merging this into the TPNU feature-set, lets get the EP reviewed, agreed upon, and merged.

If we want to merge this gate sooner than that, we can merge this under DPNU only once we have some general agreement from stakeholders that the direction in the EP is reasonable.

@tchap

tchap commented Sep 16, 2026 •
edited by openshift-ci Bot
Loading

Copy link
Copy Markdown
Contributor Author

/retitle WIP: CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate

@openshift-ci openshift-ci Bot changed the title CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate WIP: CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate Sep 16, 2026
@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 16, 2026
@tchap
tchap force-pushed the external-oidc-proxy-feature-gate branch from fe5dbd1 to 089a62a Compare September 22, 2026 11:04
@openshift-ci openshift-ci Bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 2, 2026
@tchap
Add AuthenticationComponentProxyExternalOIDC feature gate
84c5e57 
This feature gate gates component-scoped proxy support for the External
OIDC authentication stack.
@openshift-ci openshift-ci Bot added size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 2, 2026
@tchap
tchap force-pushed the external-oidc-proxy-feature-gate branch from 73b8103 to a054c47 Compare October 2, 2026 13:48
@openshift-ci openshift-ci Bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 2, 2026
@openshift-ci

openshift-ci Bot commented Oct 2, 2026

Copy link
Copy Markdown
Contributor

@tchap: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/verify-crd-schema a054c47 link true /test verify-crd-schema
ci/prow/integration a054c47 link true /test integration
ci/prow/verify a054c47 link true /test verify

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@everettraven everettraven Awaiting requested review from everettraven
@JoelSpeed JoelSpeed Awaiting requested review from JoelSpeed

Assignees

No one assigned

Labels

do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@tchap @openshift-ci-robot @everettraven @JoelSpeed