OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support.#8246
OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support.#8246ShazaAldawamneh wants to merge 1 commit intoopenshift:mainfrom
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/severity-critical
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
jira/valid-reference
|
@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-81686, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
Bot
added
area/control-plane-operator
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #8246 +/- ##
==========================================
+ Coverage 37.23% 37.39% +0.16%
==========================================
Files 750 751 +1
Lines 91798 91809 +11
==========================================
+ Hits 34181 34336 +155
+ Misses 54978 54838 -140
+ Partials 2639 2635 -4
... and 34 files with indirect coverage changes
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
ShazaAldawamneh
force-pushed
the
OCPBUGS-81686
branch
from
d2bff4d to
dd4a782
Compare
ShazaAldawamneh
force-pushed
the
OCPBUGS-81686
branch
from
dd4a782 to
95ea6e1
Compare
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughThe change renames and exports 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go (1)
61-71:⚠️ Potential issue | 🟡 MinorHandle nil spec in exported
GenerateAuthConfigto avoid panic.
specis dereferenced at Line 70 without a nil check. Since this function is now exported, a nil caller would panic.Suggested fix
func GenerateAuthConfig(spec *configv1.AuthenticationSpec, ctx context.Context, c crclient.Reader, namespace string) (*AuthenticationConfiguration, error) { + if spec == nil { + return nil, fmt.Errorf("authentication spec must not be nil") + } + config := &AuthenticationConfiguration{ TypeMeta: metav1.TypeMeta{ Kind: "AuthenticationConfiguration", APIVersion: "apiserver.config.k8s.io/v1alpha1", }, JWT: []JWTAuthenticator{}, }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go` around lines 61 - 71, GenerateAuthConfig currently dereferences the incoming spec (spec.OIDCProviders) without a nil check which can panic when called with a nil spec; add an initial nil guard in GenerateAuthConfig that returns a clear error (or an empty AuthenticationConfiguration and nil error per project convention) if spec == nil, then proceed to iterate over spec.OIDCProviders and call generateJWTForProvider as before; ensure the check is in the exported function GenerateAuthConfig so callers cannot trigger a nil dereference.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Outside diff comments:
In `@control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go`:
- Around line 61-71: GenerateAuthConfig currently dereferences the incoming spec
(spec.OIDCProviders) without a nil check which can panic when called with a nil
spec; add an initial nil guard in GenerateAuthConfig that returns a clear error
(or an empty AuthenticationConfiguration and nil error per project convention)
if spec == nil, then proceed to iterate over spec.OIDCProviders and call
generateJWTForProvider as before; ensure the check is in the exported function
GenerateAuthConfig so callers cannot trigger a nil dereference.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Pro Plus
Run ID: b57baf8c-183a-49ef-908f-81ee02324bb1
📒 Files selected for processing (3)
control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.gosupport/validations/authentication.gosupport/validations/authentication_test.go
ShazaAldawamneh
force-pushed
the
OCPBUGS-81686
branch
from
95ea6e1 to
199de17
Compare
|
/uncc |
ShazaAldawamneh
changed the title
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
ShazaAldawamneh
force-pushed
the
OCPBUGS-81686
branch
from
199de17 to
e963fa4
Compare
|
Scheduling tests matching the |
|
Scheduling tests matching the |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
|
/retest-required |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
|
/retest-required |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
|
/retest-required |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
|
/retest-required |
|
/jira refresh |
|
@jparrill: This pull request references Jira Issue OCPBUGS-81686, which is invalid:
Comment DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/jira refresh |
openshift-ci-robot
added
jira/valid-bug
|
@jparrill: This pull request references Jira Issue OCPBUGS-81686, which is valid. 3 validation(s) were run on this bug
No GitHub users were found matching the public email listed for the QA contact in Jira (xxia@redhat.com), skipping review request. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
jparrill
left a comment
jparrill
left a comment
There was a problem hiding this comment.
Dropped some comments. Thanks!
…pport Signed-off-by: Shaza Aldawamneh <shaza.aldawamneh@hotmail.com>
ShazaAldawamneh
force-pushed
the
OCPBUGS-81686
branch
from
64b6698 to
cba1008
Compare
| -----END CERTIFICATE----- | ||
| ` | ||
|
|
||
| func TestGenerateAuthConfig(t *testing.T) { |
There was a problem hiding this comment.
Do we need to add explicit testing for GenerateAuthConfig? It looks like the testing we would care about here would already be covered by TestAdaptAuthConfig below?
There was a problem hiding this comment.
@jparrill requested a direct unit test for the exported function in their review comment.
I can see both perspectives:
- The functionality is already covered through TestAdaptAuthConfig
- However, since GenerateAuthConfig is now exported, testing it directly provides clearer API contract validation and easier debugging when the function fails
@jparrill @everettraven - Would you like me to keep the direct test or remove it in favor of the existing coverage through TestAdaptAuthConfig?
There was a problem hiding this comment.
I'm not that strongly opinionated here. If @jparrill feels strongly we need an explicit test here, fine by me.
|
/lgtm |
|
Scheduling tests matching the |
|
/retest-required |
|
/retest-required |
AI Test Failure AnalysisJob: Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6 |
|
@ShazaAldawamneh: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
I have all the information I need. The analysis is clear. Let me now output the final report: Test Failure Analysis CompleteJob Information
Test Failure AnalysisErrorSummaryThe Root CauseSlow Azure VM node bootstrapping during Replace-strategy config update (infrastructure flake) The replacement machine Contributing factors:
The PR changes ( Recommendations
Evidence
|
7 participants
What this PR does / why we need it:
Fixes OCPBUGS-81686
The validation logic was using v1/kas which doesn't support CEL claim
validation rules or expression-based username mappings. This was causing
errors when users configured ExternalOIDC with these features.
Changes:
Which issue(s) this PR fixes:
Fixes OCPBUGS-81686
Checklist:
Summary by CodeRabbit
Refactor
Tests