use prefixed observers

pkg/operator2/configobservation/configobservercontroller/observe_config_controller.go

@@ -58,8 +58,10 @@ func NewConfigObserver(
 					configInformer.Config().V1().Infrastructures().Informer().HasSynced,
 				),
 			},
-			apiserver.ObserveAdditionalCORSAllowedOrigins,
-			apiserver.ObserveTLSSecurityProfile,
+			apiserver.NewCORSObserver(configobservation.OAuthServerConfigPrefix),
+			apiserver.NewCORSObserver(configobservation.OAuthAPIServerConfigPrefix),
+			apiserver.NewTLSSecurityProfileObserver(configobservation.OAuthServerConfigPrefix),
+			apiserver.NewTLSSecurityProfileObserver(configobservation.OAuthAPIServerConfigPrefix),
 			console.ObserveConsoleURL,
 			infrastructure.ObserveAPIServerURL,
 			routersecret.ObserveRouterSecret,

pkg/operator2/configobservation/console/observe_consoleurl.go

@@ -10,7 +10,7 @@ import (
 )
 
 func ObserveConsoleURL(genericlisters configobserver.Listers, recorder events.Recorder, previouslyObservedConfig map[string]interface{}) (map[string]interface{}, []error) {
-	assetPublicURLPath := []string{"oauthConfig", "assetPublicURL"}
+	assetPublicURLPath := []string{configobservation.OAuthServerConfigPrefix, "oauthConfig", "assetPublicURL"}
 	listers := genericlisters.(configobservation.Listers)
 	errs := []error{}
 

pkg/operator2/configobservation/infrastructure/observe_apiserverurl.go

@@ -10,7 +10,7 @@ import (
 )
 
 func ObserveAPIServerURL(genericlisters configobserver.Listers, recorder events.Recorder, previouslyObservedConfig map[string]interface{}) (map[string]interface{}, []error) {
-	loginURLPath := []string{"oauthConfig", "loginURL"}
+	loginURLPath := []string{configobservation.OAuthServerConfigPrefix, "oauthConfig", "loginURL"}
 	listers := genericlisters.(configobservation.Listers)
 	errs := []error{}
 

pkg/operator2/configobservation/interfaces.go

@@ -11,6 +11,11 @@ import (
 
 var _ configobserver.Listers = Listers{}
 
+const (
+	OAuthServerConfigPrefix    = "oauthServer"
+	OAuthAPIServerConfigPrefix = "oauthServer"
+)
+
 type Listers struct {
 	SecretsLister corelistersv1.SecretLister
 

pkg/operator2/configobservation/routersecret/observe_router_secret.go

@@ -18,7 +18,7 @@ import (
 )
 
 func ObserveRouterSecret(genericlisters configobserver.Listers, recorder events.Recorder, previouslyObservedConfig map[string]interface{}) (map[string]interface{}, []error) {
-	namedCertificatesPath := []string{"servingInfo", "namedCertificates"}
+	namedCertificatesPath := []string{configobservation.OAuthServerConfigPrefix, "servingInfo", "namedCertificates"}
 	listers := genericlisters.(configobservation.Listers)
 	errs := []error{}
 

pkg/operator2/oauth.go

@@ -1,18 +1,22 @@
 package operator2
 
 import (
+	"bytes"
+	"encoding/json"
 	"fmt"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/klog"
 
 	configv1 "github.com/openshift/api/config/v1"
 	operatorv1 "github.com/openshift/api/operator/v1"
 	osinv1 "github.com/openshift/api/osin/v1"
 	routev1 "github.com/openshift/api/route/v1"
+	"github.com/openshift/cluster-authentication-operator/pkg/operator2/configobservation"
 	"github.com/openshift/library-go/pkg/operator/resource/resourcemerge"
 	"github.com/openshift/library-go/pkg/operator/v1helpers"
 )
@@ -130,8 +134,12 @@ func (c *authOperator) handleOAuthConfig(
 	}
 
 	cliConfigBytes := encodeOrDie(cliConfig)
+	observedConfig, err := grabPrefixedConfig(operatorConfig.Spec.ObservedConfig.Raw)
+	if err != nil {
+		return nil, nil, fmt.Errorf("failed to grab oauth-server configuration: %v", err)
+	}
 
-	completeConfigBytes, err := resourcemerge.MergePrunedProcessConfig(&osinv1.OsinServerConfig{}, nil, cliConfigBytes, operatorConfig.Spec.ObservedConfig.Raw, operatorConfig.Spec.UnsupportedConfigOverrides.Raw)
+	completeConfigBytes, err := resourcemerge.MergePrunedProcessConfig(&osinv1.OsinServerConfig{}, nil, cliConfigBytes, observedConfig, operatorConfig.Spec.UnsupportedConfigOverrides.Raw)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to merge config with unsupportedConfigOverrides: %v", err)
 	}
@@ -140,6 +148,20 @@ func (c *authOperator) handleOAuthConfig(
 	return getCliConfigMap(completeConfigBytes), &syncData, nil
 }
 
+func grabPrefixedConfig(observedBytes []byte) ([]byte, error) {
+	prefixedConfig := map[string]interface{}{}
+	if err := json.NewDecoder(bytes.NewBuffer(observedBytes)).Decode(&prefixedConfig); err != nil {
+		klog.V(4).Infof("decode of existing config failed with error: %v", err)
+	}
+
+	actualConfig, _, err := unstructured.NestedFieldCopy(prefixedConfig, configobservation.OAuthServerConfigPrefix)
+	if err != nil {
+		return nil, err
+	}
+
+	return json.Marshal(actualConfig)
+}
+
 func getCliConfigMap(completeConfigBytes []byte) *corev1.ConfigMap {
 	meta := defaultMeta()
 	meta.Name = "v4-0-config-system-cliconfig"

pkg/operator2/starter.go

@@ -229,14 +229,14 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle
 		configObserver,
 		configOverridesController,
 		logLevelController,
-		routerCertsController,
 		managementStateController,
+		routerCertsController,
+		staleConditions,
 	} {
 		go controller.Run(ctx, 1)
 	}
 
 	go operator.Run(ctx.Done())
-	go staleConditions.Run(1, ctx.Done())
 	go ingressStateController.Run(1, ctx.Done())
 
 	<-ctx.Done()