Add component-scoped proxy to all controllers

Wire the component-scoped proxy into every affected controller:

Config observer: builds a proxy-aware HTTP transport for OIDC
discovery and password grant checks. The Listers struct gains
OperatorAuthLister and FeatureGateAccessor. The convertIdentity-
Providers signature changes from a ConfigMap lister to a
transportForCABuilderFunc, decoupling transport construction from
the IDP conversion logic.

Deployment controller: resolves the component proxy, injects
HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars into the OAuth Server pod,
syncs the trustedCA ConfigMap from openshift-config to
openshift-authentication, and adds a volume/mount with Optional=true
for CA hot-reload without redeployment.

Proxy validation controller: validates route reachability through
the component proxy. Tests IdP endpoint connectivity and emits
IdPEndpointUnreachable Warning events for transient failures
(does not set Degraded). Uses hash-based change detection to
avoid redundant validation.

Endpoint accessible controller: gains an optional proxy function
for route health checks. Only the route check controller gets the
proxy; service and endpoint checks remain proxy-free.

Custom route controller: uses ComponentProxyFunc for the route
availability health check, falling back to http.ProxyFromEnvironment.

Operator startup: passes operatorAuthLister, featureGateAccessor,
and operatorAuthInformer to all affected controllers.

Author: tchap

pkg/controllers/configobservation/configobservercontroller/observe_config_controller.go

@@ -5,9 +5,12 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	configinformers "github.com/openshift/client-go/config/informers/externalversions"
+	operatorv1informers "github.com/openshift/client-go/operator/informers/externalversions/operator/v1"
+	operatorv1listers "github.com/openshift/client-go/operator/listers/operator/v1"
 	"github.com/openshift/library-go/pkg/controller/factory"
 	"github.com/openshift/library-go/pkg/operator/configobserver"
 	"github.com/openshift/library-go/pkg/operator/configobserver/apiserver"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	configobserveroauth "github.com/openshift/library-go/pkg/operator/configobserver/oauth"
 	"github.com/openshift/library-go/pkg/operator/events"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
@@ -27,6 +30,8 @@ func NewConfigObserver(
 	resourceSyncer resourcesynccontroller.ResourceSyncer,
 	enabledClusterCapabilities sets.String,
 	eventRecorder events.Recorder,
+	operatorAuthInformer operatorv1informers.AuthenticationInformer,
+	featureGateAccessor featuregates.FeatureGateAccess,
 ) factory.Controller {
 	interestingNamespaces := []string{
 		"openshift-authentication",
@@ -80,6 +85,16 @@ func NewConfigObserver(
 			configobserver.WithPrefix(o, configobservation.OAuthServerConfigPrefix))
 	}
 
+	// ObserveIdentityProviders reads component proxy settings from the operator Authentication CR
+	// to build an HTTP transport for validating IDP endpoints. Register the informer so that
+	// proxy config changes trigger a re-sync and IDP re-validation.
+	var operatorAuthLister operatorv1listers.AuthenticationLister
+	if operatorAuthInformer != nil {
+		preRunCacheSynced = append(preRunCacheSynced, operatorAuthInformer.Informer().HasSynced)
+		informers = append(informers, operatorAuthInformer.Informer())
+		operatorAuthLister = operatorAuthInformer.Lister()
+	}
+
 	listers := configobservation.Listers{
 		ConfigMapLister: kubeInformersForNamespaces.ConfigMapLister(),
 		SecretsLister:   kubeInformersForNamespaces.SecretLister(),
@@ -91,6 +106,9 @@ func NewConfigObserver(
 		OAuthLister_:         configInformer.Config().V1().OAuths().Lister(),
 		ResourceSync:         resourceSyncer,
 		PreRunCachesSynced:   preRunCacheSynced,
+
+		OperatorAuthLister:  operatorAuthLister,
+		FeatureGateAccessor: featureGateAccessor,
 	}
 
 	// Check if the Console capability is enabled on the cluster and sync and add its informer, lister, and config observer

pkg/controllers/configobservation/interfaces.go

@@ -5,7 +5,9 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	configlistersv1 "github.com/openshift/client-go/config/listers/config/v1"
+	operatorv1listers "github.com/openshift/client-go/operator/listers/operator/v1"
 	"github.com/openshift/library-go/pkg/operator/configobserver"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
 )
 
@@ -26,6 +28,9 @@ type Listers struct {
 	OAuthLister_         configlistersv1.OAuthLister
 	IngressLister        configlistersv1.IngressLister
 
+	OperatorAuthLister  operatorv1listers.AuthenticationLister
+	FeatureGateAccessor featuregates.FeatureGateAccess
+
 	ResourceSync       resourcesynccontroller.ResourceSyncer
 	PreRunCachesSynced []cache.InformerSynced
 }

pkg/controllers/configobservation/oauth/idp_conversions.go

@@ -19,9 +19,12 @@ import (
 	osinv1 "github.com/openshift/api/osin/v1"
 
 	"github.com/openshift/cluster-authentication-operator/pkg/operator/datasync"
-	"github.com/openshift/cluster-authentication-operator/pkg/transport"
 )
 
+// transportForCABuilderFunc builds an http.RoundTripper for a given CA ConfigMap
+// reference. The cmLister and any proxy settings are captured in the closure.
+type transportForCABuilderFunc func(caConfigMapName, key string) (http.RoundTripper, error)
+
 // field names are used to uniquely identify a secret or config map reference
 // within a given identity provider.  thus the same IDP cannot use the same field
 // more than once.  ex: if an idp had two CA fields, it would need to use something
@@ -54,16 +57,16 @@ type idpData struct {
 }
 
 func convertIdentityProviders(
-	cmLister corelistersv1.ConfigMapLister,
 	secretsLister corelistersv1.SecretLister,
 	identityProviders []configv1.IdentityProvider,
+	buildTransport transportForCABuilderFunc,
 ) ([]interface{}, *datasync.ConfigSyncData, []error) {
 	converted := []osinv1.IdentityProvider{}
 	syncData := datasync.NewConfigSyncData()
 	errs := []error{}
 
 	for i, idp := range defaultIDPMappingMethods(identityProviders) {
-		data, err := convertProviderConfigToIDPData(cmLister, secretsLister, &idp.IdentityProviderConfig, syncData, i)
+		data, err := convertProviderConfigToIDPData(secretsLister, &idp.IdentityProviderConfig, syncData, i, buildTransport)
 		if err != nil {
 			errs = append(errs, fmt.Errorf("failed to apply IDP %s config: %v", idp.Name, err))
 			continue
@@ -111,11 +114,11 @@ func defaultIDPMappingMethods(identityProviders []configv1.IdentityProvider) []c
 }
 
 func convertProviderConfigToIDPData(
-	cmLister corelistersv1.ConfigMapLister,
 	secretsLister corelistersv1.SecretLister,
 	providerConfig *configv1.IdentityProviderConfig,
 	syncData *datasync.ConfigSyncData,
 	i int,
+	buildTransport transportForCABuilderFunc,
 ) (*idpData, error) {
 	const missingProviderFmt string = "type %s was specified, but its configuration is missing"
 
@@ -241,7 +244,7 @@ func convertProviderConfigToIDPData(
 			return nil, fmt.Errorf(missingProviderFmt, providerConfig.Type)
 		}
 
-		urls, err := discoverOpenIDURLs(cmLister, openIDConfig.Issuer, corev1.ServiceAccountRootCAKey, openIDConfig.CA)
+		urls, err := discoverOpenIDURLs(openIDConfig.Issuer, corev1.ServiceAccountRootCAKey, openIDConfig.CA, buildTransport)
 		if err != nil {
 			return nil, err
 		}
@@ -272,12 +275,12 @@ func convertProviderConfigToIDPData(
 		// challenge-redirecting IdPs to be configured with OIDC so it is safe
 		// to allow challenge-issuing flow if it's available on the OIDC side
 		challengeFlowsAllowed, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretsLister,
 			urls.Token,
 			openIDConfig.ClientID,
 			openIDConfig.CA,
 			openIDConfig.ClientSecret,
+			buildTransport,
 		)
 		if err != nil {
 			return nil, fmt.Errorf("error attempting password grant flow: %v", err)
@@ -312,7 +315,7 @@ func convertProviderConfigToIDPData(
 
 // discoverOpenIDURLs retrieves basic information about an OIDC server with hostname
 // given by the `issuer` argument
-func discoverOpenIDURLs(cmLister corelistersv1.ConfigMapLister, issuer, key string, ca configv1.ConfigMapNameReference) (*osinv1.OpenIDURLs, error) {
+func discoverOpenIDURLs(issuer, key string, ca configv1.ConfigMapNameReference, buildTransport transportForCABuilderFunc) (*osinv1.OpenIDURLs, error) {
 	issuer = strings.TrimRight(issuer, "/") // TODO make impossible via validation and remove
 
 	wellKnown := issuer + "/.well-known/openid-configuration"
@@ -321,7 +324,7 @@ func discoverOpenIDURLs(cmLister corelistersv1.ConfigMapLister, issuer, key stri
 		return nil, err
 	}
 
-	rt, err := transport.TransportForCARef(cmLister, ca.Name, key)
+	rt, err := buildTransport(ca.Name, key)
 	if err != nil {
 		return nil, err
 	}
@@ -371,11 +374,11 @@ func discoverOpenIDURLs(cmLister corelistersv1.ConfigMapLister, issuer, key stri
 }
 
 func checkOIDCPasswordGrantFlow(
-	cmLister corelistersv1.ConfigMapLister,
 	secretsLister corelistersv1.SecretLister,
 	tokenURL, clientID string,
 	caRererence configv1.ConfigMapNameReference,
 	clientSecretReference configv1.SecretNameReference,
+	buildTransport transportForCABuilderFunc,
 ) (bool, error) {
 	secret, err := secretsLister.Secrets("openshift-config").Get(clientSecretReference.Name)
 	if err != nil {
@@ -394,7 +397,7 @@ func checkOIDCPasswordGrantFlow(
 		return false, fmt.Errorf("the referenced secret does not contain a value for the 'clientSecret' key")
 	}
 
-	transport, err := transport.TransportForCARef(cmLister, caRererence.Name, corev1.ServiceAccountRootCAKey)
+	rt, err := buildTransport(caRererence.Name, corev1.ServiceAccountRootCAKey)
 	if err != nil {
 		return false, fmt.Errorf("couldn't get a transport for the referenced CA: %v", err)
 	}
@@ -417,7 +420,7 @@ func checkOIDCPasswordGrantFlow(
 	// explicitly set Accept to 'application/json' as that's the expected deserializable output
 	req.Header.Set("Accept", "application/json")
 
-	client := &http.Client{Transport: transport}
+	client := &http.Client{Transport: rt}
 	resp, err := client.Do(req)
 	if err != nil {
 		return false, err

pkg/controllers/configobservation/oauth/idp_conversions_test.go

@@ -23,6 +23,7 @@ import (
 	configv1 "github.com/openshift/api/config/v1"
 	osinv1 "github.com/openshift/api/osin/v1"
 	"github.com/openshift/cluster-authentication-operator/pkg/operator/datasync"
+	"github.com/openshift/cluster-authentication-operator/pkg/transport"
 	"github.com/openshift/library-go/pkg/crypto"
 )
 
@@ -210,7 +211,10 @@ func Test_convertProviderConfigToIDPData(t *testing.T) {
 				tt.providerConfig.OpenID.Issuer = server.URL
 			}
 
-			got, err := convertProviderConfigToIDPData(cmLister, secretLister, tt.providerConfig, syncData, 0)
+			buildTransport := func(caConfigMapName, key string) (http.RoundTripper, error) {
+				return transport.TransportForCARef(cmLister, caConfigMapName, key)
+			}
+			got, err := convertProviderConfigToIDPData(secretLister, tt.providerConfig, syncData, 0, buildTransport)
 			if (err != nil) != tt.wantErr {
 				t.Errorf("convertProviderConfigToIDPData() error = %v, wantErr %v", err, tt.wantErr)
 				return
@@ -304,16 +308,19 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 	require.NoError(t, indexer.Add(secret))
 	cmLister := corelistersv1.NewConfigMapLister(indexer)
 	secretLister := corelistersv1.NewSecretLister(indexer)
+	buildTransport := func(caConfigMapName, key string) (http.RoundTripper, error) {
+		return transport.TransportForCARef(cmLister, caConfigMapName, key)
+	}
 
 	t.Run("5xx responses are not cached", func(t *testing.T) {
 		shouldError = true
 		result, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 
 		require.NoError(t, err)
@@ -325,12 +332,12 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 		responseContent = `{"error": "invalid_grant"}`
 		shouldError = false
 		result, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 
 		require.NoError(t, err)
@@ -344,12 +351,12 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 
 		shouldError = true
 		res1, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 		require.NoError(t, err)
 		require.False(t, res1)
@@ -359,12 +366,12 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 		responseContent = `{"error": "invalid_grant"}`
 		shouldError = false
 		res2, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 		require.NoError(t, err)
 		require.True(t, res2)

pkg/controllers/configobservation/oauth/observe_idps.go

@@ -1,6 +1,8 @@
 package oauth
 
 import (
+	"net/http"
+
 	"k8s.io/klog/v2"
 
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -10,8 +12,10 @@ import (
 	"github.com/openshift/library-go/pkg/operator/configobserver"
 	"github.com/openshift/library-go/pkg/operator/events"
 
+	"github.com/openshift/cluster-authentication-operator/pkg/controllers/common"
 	"github.com/openshift/cluster-authentication-operator/pkg/controllers/configobservation"
 	"github.com/openshift/cluster-authentication-operator/pkg/operator/datasync"
+	"github.com/openshift/cluster-authentication-operator/pkg/transport"
 )
 
 var identityProvidersMounts = []string{"volumesToMount", "identityProviders"}
@@ -50,9 +54,32 @@ func ObserveIdentityProviders(genericlisters configobserver.Listers, recorder ev
 		return existingConfig, append(errs, err)
 	}
 
+	// build transport function, optionally with component-scoped proxy
+	buildTransport := transportForCABuilderFunc(func(caConfigMapName, key string) (http.RoundTripper, error) {
+		return transport.TransportForCARef(listers.ConfigMapLister, caConfigMapName, key)
+	})
+	authProxy, proxyErr := common.GetComponentProxyConfig(listers.FeatureGateAccessor, listers.OperatorAuthLister)
+	if proxyErr != nil {
+		klog.Warningf("failed to get component proxy config, falling back to cluster-wide proxy: %v", proxyErr)
+	}
+	if authProxy != nil {
+		httpProxy, httpsProxy, noProxy := common.ResolveProxyConfig(authProxy, nil)
+		var proxyCAData []byte
+		if len(authProxy.TrustedCA.Name) > 0 {
+			if caCM, caErr := listers.ConfigMapLister.ConfigMaps("openshift-config").Get(authProxy.TrustedCA.Name); caErr != nil {
+				klog.Warningf("failed to load component proxy CA configmap %q: %v", authProxy.TrustedCA.Name, caErr)
+			} else {
+				proxyCAData = []byte(caCM.Data["ca-bundle.crt"])
+			}
+		}
+		buildTransport = func(caConfigMapName, key string) (http.RoundTripper, error) {
+			return transport.TransportForCARefWithProxy(listers.ConfigMapLister, caConfigMapName, key, httpProxy, httpsProxy, noProxy, proxyCAData)
+		}
+	}
+
 	// convert identity providers from config to oauth-configuration API and
 	// extract the CMs and Secrets that need to be synchronized to the target NS
-	convertedObservedIdentityProviders, observedSyncData, idpErrs := convertIdentityProviders(listers.ConfigMapLister, listers.SecretsLister, oauthConfig.Spec.IdentityProviders)
+	convertedObservedIdentityProviders, observedSyncData, idpErrs := convertIdentityProviders(listers.SecretsLister, oauthConfig.Spec.IdentityProviders, buildTransport)
 	if len(idpErrs) > 0 {
 		return existingConfig, append(errs, idpErrs...)
 	}

pkg/controllers/customroute/custom_route_conditions.go

@@ -7,6 +7,7 @@ import (
 	"encoding/pem"
 	"fmt"
 	"net/http"
+	"net/url"
 	"reflect"
 	"time"
 
@@ -115,8 +116,8 @@ func degradeIfTimeElapsed(conditions []metav1.Condition, condition *v1.Condition
 	}
 }
 
-func checkRouteAvailablity(secretLister corev1listers.SecretLister, ingressConfig *configv1.Ingress, route *routev1.Route) []*v1.ConditionApplyConfiguration {
-	if err := routeAvailablity(secretLister, route.Spec.Host, ingressConfig); err != nil {
+func checkRouteAvailablity(secretLister corev1listers.SecretLister, ingressConfig *configv1.Ingress, route *routev1.Route, proxyFn func(*http.Request) (*url.URL, error)) []*v1.ConditionApplyConfiguration {
+	if err := routeAvailablity(secretLister, route.Spec.Host, ingressConfig, proxyFn); err != nil {
 		now := metav1.Now()
 		reason := "ErrorReachingOutToService"
 		message := fmt.Sprintf("unexpected error at %s: %v", route.Spec.Host, err)
@@ -137,7 +138,7 @@ func checkRouteAvailablity(secretLister corev1listers.SecretLister, ingressConfi
 	return nil
 }
 
-func routeAvailablity(secretLister corev1listers.SecretLister, host string, ingress *configv1.Ingress) error {
+func routeAvailablity(secretLister corev1listers.SecretLister, host string, ingress *configv1.Ingress, proxyFn func(*http.Request) (*url.URL, error)) error {
 	url := "https://" + host + "/healthz"
 
 	reqCtx, cancel := context.WithTimeout(context.TODO(), 10*time.Second) // avoid waiting forever
@@ -161,7 +162,7 @@ func routeAvailablity(secretLister corev1listers.SecretLister, host string, ingr
 	httpClient := http.Client{
 		Timeout: 5 * time.Second,
 		Transport: &http.Transport{
-			Proxy: http.ProxyFromEnvironment,
+			Proxy: proxyFn,
 			TLSClientConfig: &tls.Config{
 				RootCAs: rootCAs,
 			},