CNTRLPLANE-3762: Add support for component-scoped proxy#946
Conversation
|
@tchap: This pull request references CNTRLPLANE-3762 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
/jira refresh |
|
@tchap: This pull request references CNTRLPLANE-3762 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
WalkthroughAdds component-scoped proxy resolution and threads it through controller wiring, transport creation, deployment generation, route and endpoint checks, and proxy validation. Also updates the module replace directive. ChangesComponent proxy flow
Estimated code review effort: 4 (Complex) | ~75 minutes Important Pre-merge checks failedPlease resolve all errors before merging. Addressing warnings is optional. ❌ Failed checks (1 error)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
834349a to
82ce053
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
pkg/controllers/configobservation/oauth/observe_idps.go (1)
57-82: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winAdd test coverage for the component-proxy transport branch.
The new component-scoped proxy resolution and CA-loading logic (lines 61-78) that swaps
buildTransporttotransport.TransportForCARefWithProxyisn't exercised by any test in this batch. This is the most complex new logic in the cohort and currently only has a default/no-proxy path tested (viaidp_conversions_test.go).Want me to draft a test for
ObserveIdentityProviderscovering: authProxy present with valid TrustedCA, authProxy present with missing/unreadable TrustedCA configmap, andGetComponentProxyConfigreturning an error?🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/controllers/configobservation/oauth/observe_idps.go` around lines 57 - 82, Add test coverage for the component-proxy branch in ObserveIdentityProviders, since the new authProxy path that replaces buildTransport with TransportForCARefWithProxy is not exercised yet. Add cases around observeIdentityProviders/ObserveIdentityProviders that cover authProxy being present with a valid TrustedCA ConfigMap, authProxy present but the TrustedCA ConfigMap missing or unreadable, and GetComponentProxyConfig returning an error. Verify the buildTransport closure uses the proxy values and CA data when authProxy is available, and that the fallback/default transport path is retained when proxy config lookup fails.pkg/controllers/proxyconfig/proxyconfig_controller.go (1)
166-172: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low valueComponent proxy TrustedCA changes aren't watched.
Unlike the static
caConfigMaps(filtered informers), the component-proxy'sTrustedCA.Nameconfigmap is resolved dynamically and isn't registered for change notifications — updates to it will only be picked up on the 60-minute periodic resync.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/controllers/proxyconfig/proxyconfig_controller.go` around lines 166 - 172, The component proxy TrustedCA lookup in the proxy config controller is only fetched on resync and is not watched for updates. Update the proxyconfig controller logic around the TrustedCA handling in proxyconfig_controller.go so the configmap referenced by authProxy.TrustedCA.Name is registered for change notifications through the existing informer/filtering path, similar to how caConfigMaps are tracked, and ensure the reconcile flow in the proxyconfig controller reacts when that configmap changes.pkg/controllers/proxyconfig/proxyconfig_controller_test.go (1)
244-353: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick winConsider adding a test for the hash-caching skip path.
Coverage here validates the reachability/warning-event behavior well, but there's no test exercising repeated calls with identical config to confirm the caching short-circuit (
hash == p.lastIdPValidationHash) behaves as intended — this ties into the caching-design question raised inproxyconfig_controller.go.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/controllers/proxyconfig/proxyconfig_controller_test.go` around lines 244 - 353, Add a test that exercises the hash-caching short-circuit in validateIdPConnectivity, since Test_validateIdPConnectivity currently only covers reachability and warning events. Reuse proxyConfigChecker and its validateIdPConnectivity method with the same OAuth/IdentityProvider input twice, then assert the second call hits the skip path when hash matches p.lastIdPValidationHash and does not re-emit events or repeat validation work. Use the existing test helpers like workingHTTPRoundTripper, faultyHTTPRoundTripper, and the in-memory recorder to keep the case aligned with the current test structure.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@go.mod`:
- Around line 145-147: Remove the personal-fork replace override from go.mod:
the current replace for github.com/openshift/api pointing to
github.com/tchap/api should not remain in the merged branch. Update the module
definition so github.com/openshift/api resolves to the upstream dependency
again, and keep any temporary branch-only override out of the final manifest.
Use the replace directive and github.com/openshift/api entry as the identifiers
to locate and delete the temporary fork reference.
---
Nitpick comments:
In `@pkg/controllers/configobservation/oauth/observe_idps.go`:
- Around line 57-82: Add test coverage for the component-proxy branch in
ObserveIdentityProviders, since the new authProxy path that replaces
buildTransport with TransportForCARefWithProxy is not exercised yet. Add cases
around observeIdentityProviders/ObserveIdentityProviders that cover authProxy
being present with a valid TrustedCA ConfigMap, authProxy present but the
TrustedCA ConfigMap missing or unreadable, and GetComponentProxyConfig returning
an error. Verify the buildTransport closure uses the proxy values and CA data
when authProxy is available, and that the fallback/default transport path is
retained when proxy config lookup fails.
In `@pkg/controllers/proxyconfig/proxyconfig_controller_test.go`:
- Around line 244-353: Add a test that exercises the hash-caching short-circuit
in validateIdPConnectivity, since Test_validateIdPConnectivity currently only
covers reachability and warning events. Reuse proxyConfigChecker and its
validateIdPConnectivity method with the same OAuth/IdentityProvider input twice,
then assert the second call hits the skip path when hash matches
p.lastIdPValidationHash and does not re-emit events or repeat validation work.
Use the existing test helpers like workingHTTPRoundTripper,
faultyHTTPRoundTripper, and the in-memory recorder to keep the case aligned with
the current test structure.
In `@pkg/controllers/proxyconfig/proxyconfig_controller.go`:
- Around line 166-172: The component proxy TrustedCA lookup in the proxy config
controller is only fetched on resync and is not watched for updates. Update the
proxyconfig controller logic around the TrustedCA handling in
proxyconfig_controller.go so the configmap referenced by
authProxy.TrustedCA.Name is registered for change notifications through the
existing informer/filtering path, similar to how caConfigMaps are tracked, and
ensure the reconcile flow in the proxyconfig controller reacts when that
configmap changes.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2b46b993-e90b-4627-906c-fc961b3829e3
⛔ Files ignored due to path filters (32)
go.sumis excluded by!**/*.sumvendor/github.com/openshift/api/config/v1/register.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_cluster_version.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/types_infrastructure.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/config/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/features.mdis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/features/features.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_authentication.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_csi_cluster_driver.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/types_ingresscontroller.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_authentication_01_authentications-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_csi-driver_01_clustercsidrivers-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-CustomNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-Default.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-DevPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-OKD.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.crd-manifests/0000_50_ingress_00_ingresscontrollers-TechPreviewNoUpgrade.crd.yamlis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/api/operator/v1/zz_generated.deepcopy.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/github.com/openshift/api/operator/v1/zz_generated.swagger_doc_generated.gois excluded by!**/vendor/**,!vendor/**,!**/zz_generated*vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (18)
go.modpkg/controllers/common/proxy.gopkg/controllers/common/proxy_test.gopkg/controllers/configobservation/configobservercontroller/observe_config_controller.gopkg/controllers/configobservation/interfaces.gopkg/controllers/configobservation/oauth/idp_conversions.gopkg/controllers/configobservation/oauth/idp_conversions_test.gopkg/controllers/configobservation/oauth/observe_idps.gopkg/controllers/customroute/custom_route_conditions.gopkg/controllers/customroute/custom_route_controller.gopkg/controllers/deployment/default_deployment.gopkg/controllers/deployment/deployment_controller.gopkg/controllers/oauthendpoints/oauth_endpoints_controller.gopkg/controllers/proxyconfig/proxyconfig_controller.gopkg/controllers/proxyconfig/proxyconfig_controller_test.gopkg/libs/endpointaccessible/endpoint_accessible_controller.gopkg/operator/starter.gopkg/transport/transport.go
26d4cf7 to
c1080cc
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (2)
pkg/controllers/proxyconfig/proxyconfig_controller.go (1)
174-174: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueOptional: set
MinVersionon this outbound TLS config.Same as the customroute check — this client reaches the route
/healthz(and, viaclientWithProxy, external IdP endpoints invalidateIdPConnectivity). The Go client default is TLS 1.2, so no live risk, but pinningMinVersiondocuments intent for these outbound calls.🔒 Suggested change
- tlsConfig := &tls.Config{RootCAs: caPool} + tlsConfig := &tls.Config{MinVersion: tls.VersionTLS12, RootCAs: caPool}🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/controllers/proxyconfig/proxyconfig_controller.go` at line 174, The outbound TLS config in the proxy config controller should explicitly pin a minimum TLS version for these client connections. Update the tls.Config initialization in the proxy setup path (the tlsConfig used with clientWithProxy and the /healthz / validateIdPConnectivity calls) to set MinVersion consistently with the other outbound TLS checks so the intent is documented and enforced.Source: Linters/SAST tools
pkg/controllers/customroute/custom_route_conditions.go (1)
166-168: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low valueOptional: set
MinVersionon the TLS config.Static analysis flags a missing
MinVersion. The Go client default is already TLS 1.2, so this is not a live vulnerability, but pinning it makes the intent explicit for this outbound check.🔒 Suggested change
TLSClientConfig: &tls.Config{ + MinVersion: tls.VersionTLS12, RootCAs: rootCAs, },🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/controllers/customroute/custom_route_conditions.go` around lines 166 - 168, The TLS config in custom route outbound check currently only sets RootCAs and leaves the minimum protocol version implicit. Update the tls.Config used in this client setup to explicitly set MinVersion in the same TLSClientConfig block, using the existing configuration path around the outbound check so the intent is clear in the code.Source: Linters/SAST tools
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@pkg/controllers/customroute/custom_route_conditions.go`:
- Around line 166-168: The TLS config in custom route outbound check currently
only sets RootCAs and leaves the minimum protocol version implicit. Update the
tls.Config used in this client setup to explicitly set MinVersion in the same
TLSClientConfig block, using the existing configuration path around the outbound
check so the intent is clear in the code.
In `@pkg/controllers/proxyconfig/proxyconfig_controller.go`:
- Line 174: The outbound TLS config in the proxy config controller should
explicitly pin a minimum TLS version for these client connections. Update the
tls.Config initialization in the proxy setup path (the tlsConfig used with
clientWithProxy and the /healthz / validateIdPConnectivity calls) to set
MinVersion consistently with the other outbound TLS checks so the intent is
documented and enforced.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 6648ea73-99c6-4c00-85df-d8165bf94bf5
📒 Files selected for processing (17)
pkg/controllers/common/proxy.gopkg/controllers/common/proxy_test.gopkg/controllers/configobservation/configobservercontroller/observe_config_controller.gopkg/controllers/configobservation/interfaces.gopkg/controllers/configobservation/oauth/idp_conversions.gopkg/controllers/configobservation/oauth/idp_conversions_test.gopkg/controllers/configobservation/oauth/observe_idps.gopkg/controllers/customroute/custom_route_conditions.gopkg/controllers/customroute/custom_route_controller.gopkg/controllers/deployment/default_deployment.gopkg/controllers/deployment/deployment_controller.gopkg/controllers/oauthendpoints/oauth_endpoints_controller.gopkg/controllers/proxyconfig/proxyconfig_controller.gopkg/controllers/proxyconfig/proxyconfig_controller_test.gopkg/libs/endpointaccessible/endpoint_accessible_controller.gopkg/operator/starter.gopkg/transport/transport.go
🚧 Files skipped from review as they are similar to previous changes (15)
- pkg/controllers/configobservation/configobservercontroller/observe_config_controller.go
- pkg/controllers/configobservation/interfaces.go
- pkg/controllers/oauthendpoints/oauth_endpoints_controller.go
- pkg/controllers/customroute/custom_route_controller.go
- pkg/controllers/common/proxy_test.go
- pkg/controllers/configobservation/oauth/observe_idps.go
- pkg/libs/endpointaccessible/endpoint_accessible_controller.go
- pkg/controllers/configobservation/oauth/idp_conversions_test.go
- pkg/operator/starter.go
- pkg/controllers/common/proxy.go
- pkg/controllers/deployment/default_deployment.go
- pkg/transport/transport.go
- pkg/controllers/configobservation/oauth/idp_conversions.go
- pkg/controllers/deployment/deployment_controller.go
- pkg/controllers/proxyconfig/proxyconfig_controller_test.go
c81c38f to
4078eb9
Compare
ed6c4f4 to
d40b027
Compare
d40b027 to
9a170f7
Compare
ehearne-redhat
left a comment
ehearne-redhat
left a comment
There was a problem hiding this comment.
Overall things look good - another concern that I cannot pinpoint here is if there is a mechanism we can use to interact with oauth-server to ensure that it "does what it says on the tin" i.e. hot reload.
Maybe not something we can effectively do yet until the oauth-server logic is implemented, but definitely something to note. :)
| "time" | ||
|
|
||
| "github.com/openshift/library-go/pkg/crypto" | ||
| "github.com/stretchr/testify/require" |
There was a problem hiding this comment.
I'm wondering if we should follow assertions instead of relying on an external dependency to save a few lines of code. Especially since the other test files you have created don't use this convention.
I'm thinking we should remove this to keep things consistent. If we need to write the additional lines for clarity, that should be okay. :)
There was a problem hiding this comment.
I was not paying extra attention to the library being used, but it's not a new dependency and it's being used across the code base, so I would not worry too much about it.
But the import block is badly formatted 🥲
Yeah, and this must be handled in e2e tests. |
63e56f6 to
21d380d
Compare
Add TransportForCARefWithProxy for building proxy-aware transports with optional extra CA data.
Add shared utilities for component-scoped proxy configuration: - ResolveProxy: reads spec.proxy from the Authentication operator CR when the AuthenticationComponentProxy feature gate is enabled and returns a ResolvedProxy with the effective proxy strings, falling back to the process environment when no component proxy is configured. - ResolvedProxy.ProxyFunc: returns a func(*http.Request) (*url.URL, error) suitable for http.Transport.Proxy.
Wire the component-scoped proxy into every affected controller: Config observer: builds a proxy-aware HTTP transport for OIDC discovery and password grant checks. The Listers struct gains OperatorAuthLister and FeatureGateAccessor. The convertIdentityProviders signature changes from a ConfigMap lister to a transportForCABuilderFunc, decoupling transport construction from the IDP conversion logic. Adds an ObserveProxyTrustedCA observer that injects the proxy CA bundle path into the observed config when a component proxy with a trustedCA is active. Deployment controller: resolves the component proxy, injects HTTP_PROXY/HTTPS_PROXY/NO_PROXY env vars into the OAuth Server pod, syncs the trustedCA ConfigMap from openshift-config to openshift-authentication, and adds a volume/mount with Optional=true for CA hot-reload without redeployment. Proxy validation controller: validates route reachability through the component proxy. Tests IdP endpoint connectivity and emits IdPEndpointUnreachable Warning events for transient failures (does not set Degraded). Uses hash-based change detection to avoid redundant validation. Endpoint accessible controller: gains an optional proxy function for route health checks. Only the route check controller gets the proxy because it connects to the external route hostname; service and endpoint checks connect to cluster-internal addresses and remain proxy-free. Custom route controller: resolves the component proxy via ResolveProxy for the route availability health check. Loads the proxy trusted CA via LoadCAData and appends it to the root CA pool. Fixes the routeAvailablity typo (now routeAvailability). Operator startup: passes operatorAuthLister, featureGateAccessor, and operatorAuthInformer to all affected controllers.
Extract shared test helpers into pkg/internal/transporttest: UnwrapTransport, MakeSelfSignedCA, MustParseURL. Replace local copies in transport, proxy, and observe_idps test files. Add TestBuildIDPTransport to verify that with the feature gate enabled and a component proxy with trusted CA configured, the IDP transport builder wires the proxy function and loads the CA. Add Test_validateIdPConnectivity_hashDedup to verify hash-based dedup: successful validation saves the hash and skips redundant checks; failed validation does not save the hash, allowing retry. Enable the AuthenticationComponentProxy feature gate in TestObserveIdentityProviders to exercise the gate-enabled path with no proxy configured (no-op fallback to environment).
5cb7b08 to
ccddfe3
Compare
|
/retitle CNTRLPLANE-3762: Add support for component-scoped proxy We are gonna merge this without e2e tests. |
openshift-ci
Bot
changed the title
|
/retest |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
everettraven
left a comment
everettraven
left a comment
There was a problem hiding this comment.
Leaving the review I've gotten to so far.
There is much more to try and connect here than I had initially thought. I'm going to try and step through the changes a bit more intentionally tomorrow morning with a fresh set of eyes.
Use sets.List() instead of sets.UnsortedList() to produce sorted, deterministic noProxy values and prevent oauth-server deployment churn. Remove the now-unnecessary sortedCSV test helper and the standalone TestResolveProxy_FeatureGateError that duplicated a table-driven case.
The OAuthServerRouteEndpointAccessibleController checks the OAuth route health through the proxy. When the proxy uses TLS (https://), the controller needs the proxy's trustedCA in its root CA pool. Use ResolveProxy to get the TrustedCAName, then load the CA from the source ConfigMap in openshift-config via transport.LoadCAData — consistent with how ProxyConfigController loads it.
| // ResolveProxy reads the component-scoped proxy from the Authentication | ||
| // operator CR (when the feature gate is enabled) and returns the effective proxy | ||
| // settings. When no component proxy is configured, it falls back to the process | ||
| // environment (which reflects the cluster-wide proxy). | ||
| func ResolveProxy( |
There was a problem hiding this comment.
Having gone through a lot of the code changes here, I wonder if making this a struct that contains a method equivalent to this ResolveProxy function would be a better path that reduces the amount of changes a bit further?
As an example, as part of the external OIDC work, we added
Which allowed us to minimally change function signatures to accept that new struct (or an interface that struct satisfies - which is my preference for mocking in unit tests) and avoid having to make changes to things like the listers struct to add the feature gate accessor. Instead, we instantiate it once in starter.go like
cluster-authentication-operator/pkg/operator/starter.go
Lines 138 to 144 in 8c68999
There was a problem hiding this comment.
I will look into this probably when I finish some of the e2e tests, too much context switching.
I agree this would be nice. I probably ended up with the messy approach because I was implementing things gradually and didn't get to the final refactoring.
| // transportForCABuilderFunc builds an http.RoundTripper for a given CA ConfigMap | ||
| // reference. The cmLister and any proxy settings are captured in the closure. | ||
| type transportForCABuilderFunc func(caConfigMapName, key string) (http.RoundTripper, error) |
There was a problem hiding this comment.
Is there a particular reason why this transport builder function needs to be scoped specifically to this configobserver?
I had anticipated that we would probably want a more generic transport builder implementation that things call out to to get the HTTP transport configuration / roundtripper needed for the client.
There was a problem hiding this comment.
The IDP observer is special because it needs to merge the IdP CA with the proxy CA, whereas other call sites only need the proxy CA directly. But I agree the builder pattern could be generalized.
Go's in-cluster client connects to the kube API by raw IP (from KUBERNETES_SERVICE_HOST env var), not by hostname, so the existing .svc and .cluster.local entries do not exclude it from proxy routing. Add the IP explicitly so oauth-openshift pods don't route kube API calls through the component proxy.
Introduce ProxyResolver interface and AuthProxyResolver implementation that encapsulate proxy resolution, proxy CA loading, and HTTP transport construction. This follows the AuthConfigChecker pattern: instantiated once in starter.go and passed to controllers via interface. Controllers no longer store featureGateAccessor and operatorAuthLister fields just for proxy resolution, and no longer manually load proxy CA or construct http.Transport without knet.SetTransportDefaults. NewTransport accepts functional options (WithCA for raw bytes, WithCAFromConfigMap for ConfigMap references) so callers declare what CA trust they need without knowing how it's fetched. Removes the transportForCABuilderFunc type, buildIDPTransport function, and the now-unused TransportForCARef/CAReference from pkg/transport — IDP conversions and all other callers now use ProxyResolver directly.
e9fd692 to
dbef886
Compare
|
@tchap: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
4 participants
Add component-scoped proxy support for authentication
Adds support for a per-component proxy configuration on the
operator.openshift.io/v1 AuthenticationCR, gated behindFeatureGateAuthenticationComponentProxy. When enabled, the authentication operator readsspec.proxy(HTTPProxy, HTTPSProxy, NoProxy, TrustedCA) from the Authentication CR instead of relying on the cluster-wide proxy environment variables.Enhancement: Proxy support for integrated auth stack
Motivation
In disconnected or restricted-network environments, the cluster-wide proxy may not be appropriate for authentication traffic. A component-scoped proxy allows administrators to route OAuth/OIDC and IdP traffic through a dedicated proxy with its own CA trust, independent of the global proxy configuration.
Changes
Cluster-wide proxy: no longer loaded from the
proxies.config.openshift.io/clusterAPI resource.ResolveProxyreads it from the process environment variables (HTTP_PROXY,HTTPS_PROXY,NO_PROXY), which are already injected by the cluster proxy controller. This removes the direct API dependency and theproxyLister/proxyInformerfrom the deployment controller.Transport layer (
pkg/transport)TransportForCARefWithProxy: builds proxy-aware HTTP transports with configurable CA references.LoadCAData: exported helper that reads CA bundle bytes from a ConfigMap, checkingDatafirst thenBinaryData.Proxy resolution (
pkg/controllers/common)ResolveProxy: reads the component proxy from the Authentication CR when the feature gate is enabled; falls back tohttpproxy.FromEnvironment()otherwise. Returns aResolvedProxywith the effective proxy configuration and optionalTrustedCAName.Config observer (
pkg/controllers/configobservation/oauth)ObserveProxyTrustedCAobserver injects the proxy CA bundle file path into the observed config when a trusted CA is configured.Deployment controller (
pkg/controllers/deployment)HTTP_PROXY/HTTPS_PROXY/NO_PROXYenv vars from the resolved proxy into the OAuth Server pod.openshift-configtoopenshift-authentication.Optional: truefor CA hot-reload without redeployment.Proxy validation controller (
pkg/controllers/proxyconfig)IdPEndpointUnreachablewarning events for transient failures (does not set Degraded).Endpoint accessible controller (
pkg/libs/endpointaccessible)Custom route controller (
pkg/controllers/customroute)LoadCAData.Test plan
Unit tests are in place, but e2e tests are still missing.
Summary by CodeRabbit
noProxymerging.