CNTRLPLANE-4402: add ExternalOIDCAsWebhook feature gate by liouk · Pull Request #3043 · openshift/api

liouk · 2026-09-16T11:50:41Z

Adds a feature gate for the work described in openshift/enhancements#2104

openshift-merge-bot · 2026-09-16T11:50:44Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci-robot · 2026-09-16T11:50:45Z

@liouk: This pull request references CNTRLPLANE-4402 which is a valid jira issue.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2026-09-16T11:50:49Z

Hello @liouk! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

coderabbitai · 2026-09-16T11:50:56Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: a3e8ef1f-f780-43ac-b8ef-8ce58ec22eed

📥 Commits

Reviewing files that changed from the base of the PR and between b59c020 and 666f3e5.

📒 Files selected for processing (10)

features.md
features/features.go
payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 9 remain after this review.

📝 Walkthrough

Walkthrough

The change registers the ExternalOIDCAsWebhook feature gate with authentication ownership and OpenShift scope. It adds the gate to the feature matrix for DevPreviewNoUpgrade and TechPreviewNoUpgrade on Hypershift and SelfManagedHA. It adds the gate to disabled lists for default and OKD manifests and enabled lists for preview manifests.

Suggested reviewers: vr4manta

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 666f3

The feature-gate configuration is consistent across supported profiles, with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Description check	❓ Inconclusive	No pull request description was provided, so the description does not explain the changeset.	Add a brief description stating that the ExternalOIDCAsWebhook feature gate was added and specifying its preview configurations.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The pull request changes only feature-gate declarations, documentation, and YAML manifests. The authoritative diff contains no Ginkgo test files or test titles such as It(), Describe(), Context(), or …
Test Structure And Quality	✅ Passed	PASS: The pull request changes only feature declarations, documentation, and feature-gate manifests. The authoritative diff contains no Ginkgo test code or test operations, so the listed test-quality …
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only feature metadata and feature-gate YAML manifests. The authoritative diff contains no new Ginkgo tests or test-name/body changes, so the MicroShift test-compatibilit…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The reviewed range changes only feature-gate documentation, Go feature registration, and YAML feature-gate manifests. It adds no Ginkgo e2e tests or test constructs such as `It()`, `Describe()`,…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request adds only the `ExternalOIDCAsWebhook` feature declaration, documentation, and feature-gate list entries. The authoritative diff adds no deployment, operator, or controller code …
Ote Binary Stdout Contract	✅ Passed	The pull request adds one top-level feature-gate initializer and YAML/Markdown entries only. The initializer calls the existing builder and `mustRegister`; registration performs validation, map assign…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS — The pull request adds a feature-gate declaration, documentation, and YAML manifests only. The authoritative diff contains no new Ginkgo e2e tests or test declarations, and no test networking co…
No-Weak-Crypto	✅ Passed	The pull request adds only a feature-gate declaration, feature-matrix entry, and manifest name entries. The authoritative diff has no MD5, SHA-1, DES, RC4, 3DES, Blowfish, or ECB usage. It adds no cry…
Container-Privileges	✅ Passed	PASS: The pull request adds a feature-gate declaration, documentation, and FeatureGate status entries only. The added manifest entries contain only the `ExternalOIDCAsWebhook` name. No added line cont…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request adds one feature-gate declaration, one feature-matrix row, and manifest entries. The added lines contain no logging calls or sensitive values. A scan of all changed files found no log…
Title check	✅ Passed	The title clearly identifies the addition of the ExternalOIDCAsWebhook feature gate and includes the related issue identifier.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands.}

liouk · 2026-09-21T14:10:32Z

/retitle CNTRLPLANE-4402: add ExternalOIDCAsWebhook feature gate

ShazaAldawamneh · 2026-09-23T08:43:33Z

/lgtm

openshift-merge-bot · 2026-09-23T08:44:01Z

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

everettraven · 2026-09-24T12:55:40Z

I'm going to go ahead and approve this gate introduction. This is strictly for separating work that has already been done under the existing ExternalOIDCExternalClaimsSourcing feature gate under a new gate for separate promotion cycles to unblock other improvements to this functionality.

@liouk please make sure the EP gets merged and does not go stale.

/approve
/lgtm

openshift-ci · 2026-09-24T12:58:22Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: everettraven, ShazaAldawamneh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [everettraven]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

liouk · 2026-09-24T13:20:21Z

/retest-required

liouk · 2026-09-24T14:17:49Z

/verified by ci

openshift-ci-robot · 2026-09-24T14:18:02Z

@liouk: This PR has been marked as verified by ci.

Details

In response to this:

/verified by ci

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

redhat-chai-bot · 2026-09-24T17:52:50Z

/override-sticky ci/prow/e2e-aws-ovn-techpreview

Automated triage: This failure appears unrelated to the PR changes.

Job classification: Eligible long-running generated AWS OVN TechPreview end-to-end presubmit. The job uses the openshift-e2e-aws workflow and the openshift-e2e-test step; the run lasted about 4 hours.

Revision check: Prow run SHA 666f3e5b940d0f0634ecc5f451d872bc311f6625; current PR HEAD 666f3e5b940d0f0634ecc5f451d872bc311f6625; match.

Execution status: Tests executed. The exact run's JUnit artifact reports 4,416 tests, 2,261 passed, and 2,118 skipped. The build log reports 26 blocking and 5 informing failures, plus a mass-failure sentinel. The failures repeatedly show DNS timeouts resolving the cluster API hostname through CoreDNS (172.30.0.10:53), including API, console, OAuth, and external load-balancer lookups.

Completed supporting jobs: ci/prow/build, ci/prow/e2e-aws-ovn, ci/prow/e2e-aws-ovn-hypershift, ci/prow/e2e-aws-ovn-hypershift-conformance, ci/prow/e2e-aws-serial-1of2, ci/prow/e2e-aws-serial-2of2, ci/prow/e2e-aws-serial-techpreview-1of2, ci/prow/e2e-azure, ci/prow/e2e-gcp, ci/prow/e2e-upgrade, ci/prow/e2e-upgrade-out-of-change, and ci/prow/minor-e2e-upgrade-minor all succeeded. Pending separately: ci/prow/e2e-aws-serial-techpreview-2of2 and tide.

Fleet-wide failure rate: The exact job pass rate is 26.5% over 14 days and 24.6% over 30 days. This job is AWS-only, so the AWS-filtered rates are the same. Exact per-test global and AWS-filtered rates are unavailable for this presubmit context.

Open regressions: No open Component Readiness regression or bug_tests association was found for the exact failing tests; per-test Component Readiness status is unavailable for this presubmit context.

Linked bugs: None found with an explicit bug_tests link to the failing tests.

Overlap assessment: The PR adds the ExternalOIDCAsWebhook feature-gate registration and payload-manifest entries. It does not change CoreDNS, cluster networking, storage, CLI, or the API behaviors exercised by the failing tests. The only indirect overlap is the shared TechPreview feature-set configuration; the failure signature is a cluster-wide DNS outage across unrelated API, networking, node, and storage tests, not a feature-gate assertion.

Missing-coverage risk: Accepting without this particular AWS TechPreview run leaves some TechPreview coverage absent, but the PR has successful AWS OVN, AWS serial TechPreview, Azure, GCP, upgrade, build, unit, and verification signals. The failed run's tests were broadly impacted by DNS resolution failure before they could provide meaningful signal about this feature-gate change, so the residual risk is low enough for this exceptional override.

Prior bot activity on this SHA: /test e2e-aws-ovn-techpreview was already triggered on 2026-09-23. No prior override was recorded. No additional retest is being triggered because the one-retest-per-job-per-SHA limit has been used.

Rationale: The live-HEAD run executed the suite but produced a mass DNS/CoreDNS failure pattern, while the job has a 26.5% 14-day fleet pass rate and concurrent AWS quota/API-throttling outage evidence. The failure is unrelated to the PR's feature-gate metadata changes and the required supporting checks are otherwise successful.

If you disagree with this assessment, rerun the current job with /test e2e-aws-ovn-techpreview.

AI-generated. Review for accuracy.

openshift-ci · 2026-09-24T17:53:32Z

@redhat-chai-bot: Overrode contexts on behalf of redhat-chai-bot: ci/prow/e2e-aws-ovn-techpreview

These overrides will persist across retests on the current HEAD SHA. Pushing a new commit will clear them. Use /override-cancel to remove them.

Details

In response to this:

/override-sticky ci/prow/e2e-aws-ovn-techpreview

Automated triage: This failure appears unrelated to the PR changes.

Job classification: Eligible long-running generated AWS OVN TechPreview end-to-end presubmit. The job uses the openshift-e2e-aws workflow and the openshift-e2e-test step; the run lasted about 4 hours.

Revision check: Prow run SHA 666f3e5b940d0f0634ecc5f451d872bc311f6625; current PR HEAD 666f3e5b940d0f0634ecc5f451d872bc311f6625; match.

Execution status: Tests executed. The exact run's JUnit artifact reports 4,416 tests, 2,261 passed, and 2,118 skipped. The build log reports 26 blocking and 5 informing failures, plus a mass-failure sentinel. The failures repeatedly show DNS timeouts resolving the cluster API hostname through CoreDNS (172.30.0.10:53), including API, console, OAuth, and external load-balancer lookups.

Completed supporting jobs: ci/prow/build, ci/prow/e2e-aws-ovn, ci/prow/e2e-aws-ovn-hypershift, ci/prow/e2e-aws-ovn-hypershift-conformance, ci/prow/e2e-aws-serial-1of2, ci/prow/e2e-aws-serial-2of2, ci/prow/e2e-aws-serial-techpreview-1of2, ci/prow/e2e-azure, ci/prow/e2e-gcp, ci/prow/e2e-upgrade, ci/prow/e2e-upgrade-out-of-change, and ci/prow/minor-e2e-upgrade-minor all succeeded. Pending separately: ci/prow/e2e-aws-serial-techpreview-2of2 and tide.

Fleet-wide failure rate: The exact job pass rate is 26.5% over 14 days and 24.6% over 30 days. This job is AWS-only, so the AWS-filtered rates are the same. Exact per-test global and AWS-filtered rates are unavailable for this presubmit context.

Open regressions: No open Component Readiness regression or bug_tests association was found for the exact failing tests; per-test Component Readiness status is unavailable for this presubmit context.

Linked bugs: None found with an explicit bug_tests link to the failing tests.

Overlap assessment: The PR adds the ExternalOIDCAsWebhook feature-gate registration and payload-manifest entries. It does not change CoreDNS, cluster networking, storage, CLI, or the API behaviors exercised by the failing tests. The only indirect overlap is the shared TechPreview feature-set configuration; the failure signature is a cluster-wide DNS outage across unrelated API, networking, node, and storage tests, not a feature-gate assertion.

Missing-coverage risk: Accepting without this particular AWS TechPreview run leaves some TechPreview coverage absent, but the PR has successful AWS OVN, AWS serial TechPreview, Azure, GCP, upgrade, build, unit, and verification signals. The failed run's tests were broadly impacted by DNS resolution failure before they could provide meaningful signal about this feature-gate change, so the residual risk is low enough for this exceptional override.

Prior bot activity on this SHA: /test e2e-aws-ovn-techpreview was already triggered on 2026-09-23. No prior override was recorded. No additional retest is being triggered because the one-retest-per-job-per-SHA limit has been used.

Rationale: The live-HEAD run executed the suite but produced a mass DNS/CoreDNS failure pattern, while the job has a 26.5% 14-day fleet pass rate and concurrent AWS quota/API-throttling outage evidence. The failure is unrelated to the PR's feature-gate metadata changes and the required supporting checks are otherwise successful.

If you disagree with this assessment, rerun the current job with /test e2e-aws-ovn-techpreview.

AI-generated. Review for accuracy.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

openshift-ci · 2026-09-24T19:55:31Z

@liouk: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

features: add ExternalOIDCAsWebhook feature gate

666f3e5

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 16, 2026

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 16, 2026

openshift-ci Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 16, 2026

openshift-ci Bot requested review from JoelSpeed and everettraven September 16, 2026 11:52

openshift-ci Bot changed the title ~~WIP: CNTRLPLANE-4402: add ExternalOIDCAsWebhook feature gate~~ CNTRLPLANE-4402: add ExternalOIDCAsWebhook feature gate Sep 21, 2026

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 21, 2026

openshift-ci Bot assigned ShazaAldawamneh Sep 23, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Sep 23, 2026

openshift-ci Bot assigned everettraven Sep 24, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 24, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Sep 24, 2026

openshift-merge-bot Bot merged commit 0616345 into openshift:master Sep 24, 2026
29 checks passed

Conversation

liouk commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-merge-bot Bot commented Sep 16, 2026

Uh oh!

openshift-ci-robot commented Sep 16, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Sep 16, 2026

Uh oh!

coderabbitai Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

❌ Failed checks (1 inconclusive)

Uh oh!

liouk commented Sep 21, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ShazaAldawamneh commented Sep 23, 2026

Uh oh!

openshift-merge-bot Bot commented Sep 23, 2026

Uh oh!

everettraven commented Sep 24, 2026

Uh oh!

openshift-ci Bot commented Sep 24, 2026

Uh oh!

liouk commented Sep 24, 2026

Uh oh!

liouk commented Sep 24, 2026

Uh oh!

openshift-ci-robot commented Sep 24, 2026

Uh oh!

redhat-chai-bot commented Sep 24, 2026

Uh oh!

openshift-ci Bot commented Sep 24, 2026

Uh oh!

openshift-ci Bot commented Sep 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

liouk commented Sep 16, 2026 •

edited

Loading

openshift-ci-robot commented Sep 16, 2026 •

edited by openshift-ci Bot

Loading

coderabbitai Bot commented Sep 16, 2026 •

edited

Loading

liouk commented Sep 21, 2026 •

edited by openshift-ci Bot

Loading