CNTRLPLANE-311: adding auth config missing fields to API #2487

ShazaAldawamneh · 2025-09-19T10:24:44Z

No description provided.

Signed-off-by: Shaza Aldawamneh <[email protected]>

openshift-ci · 2025-09-19T10:24:49Z

Hello @ShazaAldawamneh! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

openshift-ci-robot · 2025-09-19T10:25:07Z

@ShazaAldawamneh: This pull request references CNTRLPLANE-311 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.21.0" version, but no target version was set.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci · 2025-09-19T10:25:20Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign everettraven for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithNewAuthConfigFields.yaml

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithUpstreamParity.yaml

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithNewAuthConfigFields.yaml

config/v1/types_authentication.go

Signed-off-by: Shaza Aldawamneh <[email protected]>

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithNewAuthConfigFields.yaml

Signed-off-by: Shaza Aldawamneh <[email protected]>

config/v1/types_authentication.go

features/features.go

Signed-off-by: Shaza Aldawamneh <[email protected]>

everettraven · 2025-10-01T13:37:40Z

/assign

everettraven

For all of the CEL expression fields, can we also get a PR up against openshift/kubernetes similar to openshift/kubernetes#2353 to show that we are going to be adding admission time validation for the newly added CEL expression fields?

everettraven · 2025-10-01T14:01:44Z

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithUpstreamParity.yaml

+              username:
+                claim: "preferred_username"
+
+    - name: discoveryURL exceeds max length by one (2049 chars, should fail)


While more testing is always nice, I do think having many of these will make this file unnecessarily large and make the experience of making any changes to the tests in the future painful.

Lets just trust that the max length validations markers work as expected and drop any tests that are doing an explicit valid/not-valid check on length alone.

config/v1/types_authentication.go

everettraven · 2025-10-01T14:22:08Z

config/v1/types_authentication.go

+	// +kubebuilder:validation:XValidation:rule="self.size() > 0 ? (isURL(self) && url(self).getScheme() == 'https') : true",message="discoveryURL must be a valid https URL"
+	// +kubebuilder:validation:XValidation:rule="self.matches('^[^?]*$')",message="discoveryURL must not contain query parameters"
+	// +kubebuilder:validation:XValidation:rule="self.matches('^[^#]*$')",message="discoveryURL must not contain fragments"
+	// +kubebuilder:validation:XValidation:rule="self.matches('^[^@]*$')",message="discoveryURL must not contain user info"


Is this robust enough of a regular expression to effectively capture this?

As-is this seems like it would match URLs like https://en.wikipedia.org/wiki/@_(album) which doesn't contain any userinfo in the URL but does contain the @ symbol as part of the path and is technically a valid URL.

@everettraven Honestly, I’m not sure what the best replacement would be. any suggestions ?

user info seems to be generally parsed from somestring:someotherstring@hostname, maybe you can do something like ^https:\/\/.+:.+@{1}.+\/.+?

That should ensure we are only attempting to match the general user info pattern between the https:// prefix and the {hostname}/ values and allow anything in the path.

Quickly testing on https://regexr.com/ shows that it would match on https://testuser:[email protected]/some/path/@value but not https://example.com/some/path/@value or https://example.com:7784/some/path/@value which is what I think we want.

It would be good to make sure we have a few tests exercising this behavior to make sure it isn't matching something that should be valid.

everettraven · 2025-10-01T16:06:47Z

config/v1/types_authentication.go

+	//
+	// +required
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=4096


1024 please.

everettraven · 2025-10-01T16:07:31Z

config/v1/types_authentication.go

+	//
+	// If the expression evaluates to false, the token is rejected.
+	// See https://kubernetes.io/docs/reference/using-api/cel/ for CEL syntax.
+	// At least one rule must evaluate to true for the token to be considered valid.


This isn't a list, so we should move this to where the list is defined.

everettraven · 2025-10-01T16:07:57Z

config/v1/types_authentication.go

+	// +optional
+	// +kubebuilder:validation:MinLength=1
+	// +kubebuilder:validation:MaxLength=256


Same comments as the previous message field for token claim validations.

everettraven · 2025-10-01T16:09:06Z

config/v1/types_authentication.go

+	// +kubebuilder:validation:MaxItems=64
+	// +optional


Include this information in the GoDoc please.

everettraven · 2025-10-01T16:09:45Z

config/v1/types_authentication.go

+	// +kubebuilder:validation:MaxItems=64
+	// +optional
+	// +openshift:enable:FeatureGate=ExternalOIDCWithUpstreamParity
+	UserValidationRules []TokenUserValidationRule `json:"userValidationRules,omitempty"`


What other constraints are there? Looking at the upstream validations, it looks like there is a uniqueness constraint on the CEL expression, we should enforce this as well.

openshift-ci · 2025-10-01T16:25:21Z

@ShazaAldawamneh: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-crdify	`582db23`	link	true	`/test verify-crdify`
ci/prow/okd-scos-e2e-aws-ovn	`582db23`	link	false	`/test okd-scos-e2e-aws-ovn`
ci/prow/verify-crd-schema	`582db23`	link	true	`/test verify-crd-schema`
ci/prow/lint	`582db23`	link	true	`/test lint`
ci/prow/integration	`582db23`	link	true	`/test integration`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

openshift-merge-robot · 2025-10-01T16:25:25Z

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

everettraven · 2025-10-06T18:28:41Z

config/v1/types_authentication.go

+	// message allows configuring the human-readable message that is returned
+	// from the Kubernetes API server when a token fails validation based on
+	// the CEL expression defined in 'expression'. This field is optional.


I don't think this is quite true. Reading https://kubernetes.io/docs/reference/access-authn-authz/authentication/#using-authentication-configuration it looks like this is the message that is logged by the Kubernetes API server.

It isn't included in anything returned to the caller.

adding auth config missing fields

9da6c1f

Signed-off-by: Shaza Aldawamneh <[email protected]>

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Sep 19, 2025

ShazaAldawamneh changed the title ~~[WIP]: adding auth config missing fields to API~~ [WIP]: CNTRLPLANE-311: adding auth config missing fields to API Sep 19, 2025

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Sep 19, 2025

openshift-ci bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Sep 19, 2025

openshift-ci bot requested review from everettraven and JoelSpeed September 19, 2025 10:25

everettraven reviewed Sep 19, 2025

View reviewed changes

adding auth config missing fields

8e0ef94

Signed-off-by: Shaza Aldawamneh <[email protected]>

everettraven reviewed Sep 23, 2025

View reviewed changes

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithNewAuthConfigFields.yaml Outdated Show resolved Hide resolved

ShazaAldawamneh added 2 commits September 26, 2025 15:10

fixing tests

1fa3639

Signed-off-by: Shaza Aldawamneh <[email protected]>

fixing tests

e12527d

Signed-off-by: Shaza Aldawamneh <[email protected]>

everettraven reviewed Sep 29, 2025

View reviewed changes

config/v1/types_authentication.go Outdated Show resolved Hide resolved

everettraven reviewed Sep 29, 2025

View reviewed changes

config/v1/types_authentication.go Show resolved Hide resolved

everettraven reviewed Sep 29, 2025

View reviewed changes

features/features.go Show resolved Hide resolved

fixing tests

582db23

Signed-off-by: Shaza Aldawamneh <[email protected]>

ShazaAldawamneh changed the title ~~[WIP]: CNTRLPLANE-311: adding auth config missing fields to API~~ CNTRLPLANE-311: adding auth config missing fields to API Oct 1, 2025

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Oct 1, 2025

openshift-ci bot assigned everettraven Oct 1, 2025

everettraven reviewed Oct 1, 2025

View reviewed changes

openshift-merge-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Oct 1, 2025

everettraven reviewed Oct 6, 2025

View reviewed changes

CNTRLPLANE-311: adding auth config missing fields to API #2487

Are you sure you want to change the base?

CNTRLPLANE-311: adding auth config missing fields to API #2487

Conversation

ShazaAldawamneh commented Sep 19, 2025

Uh oh!

openshift-ci bot commented Sep 19, 2025

Uh oh!

openshift-ci-robot commented Sep 19, 2025 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci bot commented Sep 19, 2025

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

everettraven commented Oct 1, 2025

Uh oh!

everettraven left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ShazaAldawamneh Oct 6, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Oct 1, 2025

Uh oh!

openshift-merge-robot commented Oct 1, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

openshift-ci-robot commented Sep 19, 2025 •

edited by openshift-ci bot

Loading

ShazaAldawamneh Oct 6, 2025 •

edited

Loading