Add component-scoped proxy to all controllers

Wire the component-scoped proxy into every affected controller:

Config observer: builds a proxy-aware HTTP transport for OIDC
discovery and password grant checks. The Listers struct gains
OperatorAuthLister and FeatureGateAccessor. The convertIdentityProviders
signature changes from a ConfigMap lister to a transportForCABuilderFunc,
decoupling transport construction from the IDP conversion logic. Adds an
ObserveProxyTrustedCA observer that injects the proxy CA bundle path into
the observed config when a component proxy with a trustedCA is active.

Deployment controller: resolves the component proxy, injects
HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars into the OAuth Server pod,
syncs the trustedCA ConfigMap from openshift-config to
openshift-authentication, and adds a volume/mount with Optional=true
for CA hot-reload without redeployment.

Proxy validation controller: validates route reachability through
the component proxy. Tests IdP endpoint connectivity and emits
IdPEndpointUnreachable Warning events for transient failures
(does not set Degraded). Uses hash-based change detection to
avoid redundant validation.

Endpoint accessible controller: gains an optional proxy function
for route health checks. Only the route check controller gets the
proxy because it connects to the external route hostname; service
and endpoint checks connect to cluster-internal addresses and
remain proxy-free.

Custom route controller: resolves the component proxy via
ResolveProxy for the route availability health check. Loads the
proxy trusted CA via LoadCAData and appends it to the root CA pool.
Fixes the routeAvailablity typo (now routeAvailability).

Operator startup: passes operatorAuthLister, featureGateAccessor,
and operatorAuthInformer to all affected controllers.

Author: tchap

pkg/controllers/configobservation/configobservercontroller/observe_config_controller.go

@@ -5,9 +5,11 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	configinformers "github.com/openshift/client-go/config/informers/externalversions"
+	operatorv1informers "github.com/openshift/client-go/operator/informers/externalversions/operator/v1"
 	"github.com/openshift/library-go/pkg/controller/factory"
 	"github.com/openshift/library-go/pkg/operator/configobserver"
 	"github.com/openshift/library-go/pkg/operator/configobserver/apiserver"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	configobserveroauth "github.com/openshift/library-go/pkg/operator/configobserver/oauth"
 	"github.com/openshift/library-go/pkg/operator/events"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
@@ -27,6 +29,8 @@ func NewConfigObserver(
 	resourceSyncer resourcesynccontroller.ResourceSyncer,
 	enabledClusterCapabilities sets.String,
 	eventRecorder events.Recorder,
+	operatorAuthInformer operatorv1informers.AuthenticationInformer,
+	featureGateAccessor featuregates.FeatureGateAccess,
 ) factory.Controller {
 	interestingNamespaces := []string{
 		"openshift-authentication",
@@ -73,13 +77,17 @@ func NewConfigObserver(
 		oauth.ObserveTemplates,
 		oauth.ObserveTokenConfig,
 		oauth.ObserveAudit,
+		oauth.ObserveComponentProxyTrustedCA,
 		configobserveroauth.ObserveAccessTokenInactivityTimeout,
 		routersecret.ObserveRouterSecret,
 	} {
 		oauthServerObservers = append(oauthServerObservers,
 			configobserver.WithPrefix(o, configobservation.OAuthServerConfigPrefix))
 	}
 
+	preRunCacheSynced = append(preRunCacheSynced, operatorAuthInformer.Informer().HasSynced)
+	informers = append(informers, operatorAuthInformer.Informer())
+
 	listers := configobservation.Listers{
 		ConfigMapLister: kubeInformersForNamespaces.ConfigMapLister(),
 		SecretsLister:   kubeInformersForNamespaces.SecretLister(),
@@ -91,6 +99,9 @@ func NewConfigObserver(
 		OAuthLister_:         configInformer.Config().V1().OAuths().Lister(),
 		ResourceSync:         resourceSyncer,
 		PreRunCachesSynced:   preRunCacheSynced,
+
+		OperatorAuthLister:  operatorAuthInformer.Lister(),
+		FeatureGateAccessor: featureGateAccessor,
 	}
 
 	// Check if the Console capability is enabled on the cluster and sync and add its informer, lister, and config observer

pkg/controllers/configobservation/interfaces.go

@@ -5,7 +5,9 @@ import (
 	"k8s.io/client-go/tools/cache"
 
 	configlistersv1 "github.com/openshift/client-go/config/listers/config/v1"
+	operatorv1listers "github.com/openshift/client-go/operator/listers/operator/v1"
 	"github.com/openshift/library-go/pkg/operator/configobserver"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
 )
 
@@ -26,6 +28,9 @@ type Listers struct {
 	OAuthLister_         configlistersv1.OAuthLister
 	IngressLister        configlistersv1.IngressLister
 
+	OperatorAuthLister  operatorv1listers.AuthenticationLister
+	FeatureGateAccessor featuregates.FeatureGateAccess
+
 	ResourceSync       resourcesynccontroller.ResourceSyncer
 	PreRunCachesSynced []cache.InformerSynced
 }

pkg/controllers/configobservation/oauth/idp_conversions.go

@@ -19,9 +19,12 @@ import (
 	osinv1 "github.com/openshift/api/osin/v1"
 
 	"github.com/openshift/cluster-authentication-operator/pkg/operator/datasync"
-	"github.com/openshift/cluster-authentication-operator/pkg/transport"
 )
 
+// transportForCABuilderFunc builds an http.RoundTripper for a given CA ConfigMap
+// reference. The cmLister and any proxy settings are captured in the closure.
+type transportForCABuilderFunc func(caConfigMapName, key string) (http.RoundTripper, error)
+
 // field names are used to uniquely identify a secret or config map reference
 // within a given identity provider.  thus the same IDP cannot use the same field
 // more than once.  ex: if an idp had two CA fields, it would need to use something
@@ -54,16 +57,16 @@ type idpData struct {
 }
 
 func convertIdentityProviders(
-	cmLister corelistersv1.ConfigMapLister,
 	secretsLister corelistersv1.SecretLister,
 	identityProviders []configv1.IdentityProvider,
+	buildTransport transportForCABuilderFunc,
 ) ([]interface{}, *datasync.ConfigSyncData, []error) {
 	converted := []osinv1.IdentityProvider{}
 	syncData := datasync.NewConfigSyncData()
 	errs := []error{}
 
 	for i, idp := range defaultIDPMappingMethods(identityProviders) {
-		data, err := convertProviderConfigToIDPData(cmLister, secretsLister, &idp.IdentityProviderConfig, syncData, i)
+		data, err := convertProviderConfigToIDPData(secretsLister, &idp.IdentityProviderConfig, syncData, i, buildTransport)
 		if err != nil {
 			errs = append(errs, fmt.Errorf("failed to apply IDP %s config: %v", idp.Name, err))
 			continue
@@ -111,11 +114,11 @@ func defaultIDPMappingMethods(identityProviders []configv1.IdentityProvider) []c
 }
 
 func convertProviderConfigToIDPData(
-	cmLister corelistersv1.ConfigMapLister,
 	secretsLister corelistersv1.SecretLister,
 	providerConfig *configv1.IdentityProviderConfig,
 	syncData *datasync.ConfigSyncData,
 	i int,
+	buildTransport transportForCABuilderFunc,
 ) (*idpData, error) {
 	const missingProviderFmt string = "type %s was specified, but its configuration is missing"
 
@@ -241,7 +244,7 @@ func convertProviderConfigToIDPData(
 			return nil, fmt.Errorf(missingProviderFmt, providerConfig.Type)
 		}
 
-		urls, err := discoverOpenIDURLs(cmLister, openIDConfig.Issuer, corev1.ServiceAccountRootCAKey, openIDConfig.CA)
+		urls, err := discoverOpenIDURLs(openIDConfig.Issuer, corev1.ServiceAccountRootCAKey, openIDConfig.CA, buildTransport)
 		if err != nil {
 			return nil, err
 		}
@@ -272,12 +275,12 @@ func convertProviderConfigToIDPData(
 		// challenge-redirecting IdPs to be configured with OIDC so it is safe
 		// to allow challenge-issuing flow if it's available on the OIDC side
 		challengeFlowsAllowed, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretsLister,
 			urls.Token,
 			openIDConfig.ClientID,
 			openIDConfig.CA,
 			openIDConfig.ClientSecret,
+			buildTransport,
 		)
 		if err != nil {
 			return nil, fmt.Errorf("error attempting password grant flow: %v", err)
@@ -312,7 +315,7 @@ func convertProviderConfigToIDPData(
 
 // discoverOpenIDURLs retrieves basic information about an OIDC server with hostname
 // given by the `issuer` argument
-func discoverOpenIDURLs(cmLister corelistersv1.ConfigMapLister, issuer, key string, ca configv1.ConfigMapNameReference) (*osinv1.OpenIDURLs, error) {
+func discoverOpenIDURLs(issuer, key string, ca configv1.ConfigMapNameReference, buildTransport transportForCABuilderFunc) (*osinv1.OpenIDURLs, error) {
 	issuer = strings.TrimRight(issuer, "/") // TODO make impossible via validation and remove
 
 	wellKnown := issuer + "/.well-known/openid-configuration"
@@ -321,7 +324,7 @@ func discoverOpenIDURLs(cmLister corelistersv1.ConfigMapLister, issuer, key stri
 		return nil, err
 	}
 
-	rt, err := transport.TransportForCARef(cmLister, ca.Name, key)
+	rt, err := buildTransport(ca.Name, key)
 	if err != nil {
 		return nil, err
 	}
@@ -371,11 +374,11 @@ func discoverOpenIDURLs(cmLister corelistersv1.ConfigMapLister, issuer, key stri
 }
 
 func checkOIDCPasswordGrantFlow(
-	cmLister corelistersv1.ConfigMapLister,
 	secretsLister corelistersv1.SecretLister,
 	tokenURL, clientID string,
 	caRererence configv1.ConfigMapNameReference,
 	clientSecretReference configv1.SecretNameReference,
+	buildTransport transportForCABuilderFunc,
 ) (bool, error) {
 	secret, err := secretsLister.Secrets("openshift-config").Get(clientSecretReference.Name)
 	if err != nil {
@@ -394,7 +397,7 @@ func checkOIDCPasswordGrantFlow(
 		return false, fmt.Errorf("the referenced secret does not contain a value for the 'clientSecret' key")
 	}
 
-	transport, err := transport.TransportForCARef(cmLister, caRererence.Name, corev1.ServiceAccountRootCAKey)
+	rt, err := buildTransport(caRererence.Name, corev1.ServiceAccountRootCAKey)
 	if err != nil {
 		return false, fmt.Errorf("couldn't get a transport for the referenced CA: %v", err)
 	}
@@ -417,7 +420,7 @@ func checkOIDCPasswordGrantFlow(
 	// explicitly set Accept to 'application/json' as that's the expected deserializable output
 	req.Header.Set("Accept", "application/json")
 
-	client := &http.Client{Transport: transport}
+	client := &http.Client{Transport: rt}
 	resp, err := client.Do(req)
 	if err != nil {
 		return false, err

pkg/controllers/configobservation/oauth/idp_conversions_test.go

@@ -23,6 +23,7 @@ import (
 	configv1 "github.com/openshift/api/config/v1"
 	osinv1 "github.com/openshift/api/osin/v1"
 	"github.com/openshift/cluster-authentication-operator/pkg/operator/datasync"
+	"github.com/openshift/cluster-authentication-operator/pkg/transport"
 	"github.com/openshift/library-go/pkg/crypto"
 )
 
@@ -210,7 +211,7 @@ func Test_convertProviderConfigToIDPData(t *testing.T) {
 				tt.providerConfig.OpenID.Issuer = server.URL
 			}
 
-			got, err := convertProviderConfigToIDPData(cmLister, secretLister, tt.providerConfig, syncData, 0)
+			got, err := convertProviderConfigToIDPData(secretLister, tt.providerConfig, syncData, 0, newTestTransportBuilder(cmLister))
 			if (err != nil) != tt.wantErr {
 				t.Errorf("convertProviderConfigToIDPData() error = %v, wantErr %v", err, tt.wantErr)
 				return
@@ -242,6 +243,16 @@ func Test_convertProviderConfigToIDPData(t *testing.T) {
 	}
 }
 
+func newTestTransportBuilder(cmLister corelistersv1.ConfigMapLister) transportForCABuilderFunc {
+	return func(caConfigMapName, caConfigMapKey string) (http.RoundTripper, error) {
+		var caRefs []transport.CAReference
+		if len(caConfigMapName) > 0 {
+			caRefs = append(caRefs, transport.CAReference{ConfigMapName: caConfigMapName, ConfigMapKey: caConfigMapKey})
+		}
+		return transport.TransportForCARef(cmLister, caRefs, "", "", "")
+	}
+}
+
 func newTestHTTPSServer(certPEM, keyPEM []byte, content string) (*httptest.Server, error) {
 	// use a byte slice reference to replace with a valid content with replaced
 	// server URLs once the server is started
@@ -304,16 +315,17 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 	require.NoError(t, indexer.Add(secret))
 	cmLister := corelistersv1.NewConfigMapLister(indexer)
 	secretLister := corelistersv1.NewSecretLister(indexer)
+	buildTransport := newTestTransportBuilder(cmLister)
 
 	t.Run("5xx responses are not cached", func(t *testing.T) {
 		shouldError = true
 		result, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 
 		require.NoError(t, err)
@@ -325,12 +337,12 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 		responseContent = `{"error": "invalid_grant"}`
 		shouldError = false
 		result, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 
 		require.NoError(t, err)
@@ -344,12 +356,12 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 
 		shouldError = true
 		res1, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 		require.NoError(t, err)
 		require.False(t, res1)
@@ -359,12 +371,12 @@ func TestCheckOIDCPasswordGrantFlowCaching(t *testing.T) {
 		responseContent = `{"error": "invalid_grant"}`
 		shouldError = false
 		res2, err := checkOIDCPasswordGrantFlow(
-			cmLister,
 			secretLister,
 			server.URL+"/token",
 			"test-client",
 			configv1.ConfigMapNameReference{Name: ""},
 			configv1.SecretNameReference{Name: "test-secret"},
+			buildTransport,
 		)
 		require.NoError(t, err)
 		require.True(t, res2)

pkg/controllers/configobservation/oauth/observe_idps.go

@@ -1,6 +1,8 @@
 package oauth
 
 import (
+	"net/http"
+
 	"k8s.io/klog/v2"
 
 	"k8s.io/apimachinery/pkg/api/equality"
@@ -10,8 +12,10 @@ import (
 	"github.com/openshift/library-go/pkg/operator/configobserver"
 	"github.com/openshift/library-go/pkg/operator/events"
 
+	"github.com/openshift/cluster-authentication-operator/pkg/controllers/common"
 	"github.com/openshift/cluster-authentication-operator/pkg/controllers/configobservation"
 	"github.com/openshift/cluster-authentication-operator/pkg/operator/datasync"
+	"github.com/openshift/cluster-authentication-operator/pkg/transport"
 )
 
 var identityProvidersMounts = []string{"volumesToMount", "identityProviders"}
@@ -50,9 +54,14 @@ func ObserveIdentityProviders(genericlisters configobserver.Listers, recorder ev
 		return existingConfig, append(errs, err)
 	}
 
+	buildTransport, err := buildIDPTransport(listers)
+	if err != nil {
+		return existingConfig, append(errs, err)
+	}
+
 	// convert identity providers from config to oauth-configuration API and
 	// extract the CMs and Secrets that need to be synchronized to the target NS
-	convertedObservedIdentityProviders, observedSyncData, idpErrs := convertIdentityProviders(listers.ConfigMapLister, listers.SecretsLister, oauthConfig.Spec.IdentityProviders)
+	convertedObservedIdentityProviders, observedSyncData, idpErrs := convertIdentityProviders(listers.SecretsLister, oauthConfig.Spec.IdentityProviders, buildTransport)
 	if len(idpErrs) > 0 {
 		return existingConfig, append(errs, idpErrs...)
 	}
@@ -100,3 +109,22 @@ func GetIDPConfigSyncData(observedConfig map[string]interface{}) (*datasync.Conf
 
 	return datasync.NewConfigSyncDataFromJSON(currentSyncDataBytes)
 }
+
+// buildIDPTransport returns a transport builder that uses the resolved proxy settings.
+func buildIDPTransport(listers configobservation.Listers) (transportForCABuilderFunc, error) {
+	proxy, err := common.ResolveProxy(listers.FeatureGateAccessor, listers.OperatorAuthLister)
+	if err != nil {
+		return nil, err
+	}
+
+	return func(caConfigMapName, caConfigMapKey string) (http.RoundTripper, error) {
+		var caRefs []transport.CAReference
+		if len(caConfigMapName) > 0 {
+			caRefs = append(caRefs, transport.CAReference{ConfigMapName: caConfigMapName, ConfigMapKey: caConfigMapKey})
+		}
+		if len(proxy.TrustedCAName) > 0 {
+			caRefs = append(caRefs, transport.CAReference{ConfigMapName: proxy.TrustedCAName, ConfigMapKey: "ca-bundle.crt"})
+		}
+		return transport.TransportForCARef(listers.ConfigMapLister, caRefs, proxy.HTTPProxy, proxy.HTTPSProxy, proxy.NoProxy)
+	}, nil
+}

pkg/controllers/configobservation/oauth/observe_idps_test.go

@@ -15,7 +15,10 @@ import (
 	clocktesting "k8s.io/utils/clock/testing"
 
 	configv1 "github.com/openshift/api/config/v1"
+	"github.com/openshift/api/features"
 	configlistersv1 "github.com/openshift/client-go/config/listers/config/v1"
+	operatorv1listers "github.com/openshift/client-go/operator/listers/operator/v1"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	"github.com/openshift/library-go/pkg/operator/events"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
 
@@ -195,11 +198,17 @@ func TestObserveIdentityProviders(t *testing.T) {
 			}
 
 			syncerData := tt.previousSyncerData
+			operatorAuthIndexer := cache.NewIndexer(cache.MetaNamespaceKeyFunc, cache.Indexers{})
 			listers := configobservation.Listers{
-				ConfigMapLister: corelistersv1.NewConfigMapLister(indexer),
-				SecretsLister:   corelistersv1.NewSecretLister(indexer),
-				OAuthLister_:    configlistersv1.NewOAuthLister(indexer),
-				ResourceSync:    &mockResourceSyncer{t: t, synced: syncerData},
+				ConfigMapLister:    corelistersv1.NewConfigMapLister(indexer),
+				SecretsLister:      corelistersv1.NewSecretLister(indexer),
+				OAuthLister_:       configlistersv1.NewOAuthLister(indexer),
+				ResourceSync:       &mockResourceSyncer{t: t, synced: syncerData},
+				OperatorAuthLister: operatorv1listers.NewAuthenticationLister(operatorAuthIndexer),
+				FeatureGateAccessor: featuregates.NewHardcodedFeatureGateAccess(
+					nil,
+					[]configv1.FeatureGateName{features.FeatureGateAuthenticationComponentProxy},
+				),
 			}
 			eventsRecorder := events.NewInMemoryRecorder(t.Name(), clocktesting.NewFakePassiveClock(time.Now()))