CNTRLPLANE-2521: feat: configv1/authentication: add fields for sourcing claims from external sources#2827
Conversation
|
@everettraven: This pull request references CNTRLPLANE-2521 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci-robot
added
the
jira/valid-reference
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
Hello @everettraven! Some important instructions when contributing to openshift/api: |
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
size/XXL
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
📝 WalkthroughWalkthroughAdds feature-gated ExternalOIDCExternalClaimsSourcing to the Authentication API. Introduces new exported types and constants for external claim sources, authentication modes, OAuth2 client-credential and TLS config, URL hostname/path inputs, predicates, and claim mappings. Extends OIDCProvider with an atomic externalClaimsSources list (min 1, max 5) and cross-source uniqueness validation for mapping names. Updates CRD schemas (DevPreview and CustomNoUpgrade) with OpenAPI and x-kubernetes-validations enforcing conditional fields, formats, sizing, and uniqueness rules. Adds an apiextensions.k8s.io/v1 test manifest covering positive and negative validation cases. 🚥 Pre-merge checks | ✅ 11 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (11 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Tip 💬 Introducing Slack Agent: The best way for teams to turn conversations into code.Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.
Built for teams:
One agent for your entire SDLC. Right inside Slack. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml (1)
280-943: ⚡ Quick winAdd tests for two contract edges to prevent drift.
Please add cases for:
- duplicate
mappings[].nameacross twoexternalClaimsSourcesentries, and- explicit
predicates: []behavior (accept or reject, based on intended contract).These two edges are currently where schema-vs-contract drift is most likely.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml` around lines 280 - 943, Add two test cases to the existing list: (1) "Cannot duplicate mappings.name across externalClaimsSources" that defines two externalClaimsSources each with a mappings entry using the same name (e.g., name: email) and sets expectedError to assert duplication (e.g., "Duplicate value: \"email\"") to catch cross-source duplicate mapping names; (2) "Explicit predicates empty array behavior" that adds an externalClaimsSources entry with predicates: [] and an initial config, and set either expected (if contract allows an explicit empty predicates array) or expectedError (if contract forbids empty predicates) to reflect the intended contract—use the same structures and fields (externalClaimsSources, mappings, predicates) as the surrounding tests so the new entries align with the suite.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@config/v1/types_authentication.go`:
- Around line 893-911: The struct field Predicates is documented to allow
omitted or empty lists but the validation tag +kubebuilder:validation:MinItems=1
prevents an explicit empty slice; remove or change that validation so empty
lists are accepted (e.g., delete the +kubebuilder:validation:MinItems=1 tag or
set it to 0) on the Predicates []ExternalSourcePredicate field and keep the
existing +kubebuilder:validation:MaxItems=16 and list/map tags intact so the
documented semantics match the schema.
---
Nitpick comments:
In
`@config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml`:
- Around line 280-943: Add two test cases to the existing list: (1) "Cannot
duplicate mappings.name across externalClaimsSources" that defines two
externalClaimsSources each with a mappings entry using the same name (e.g.,
name: email) and sets expectedError to assert duplication (e.g., "Duplicate
value: \"email\"") to catch cross-source duplicate mapping names; (2) "Explicit
predicates empty array behavior" that adds an externalClaimsSources entry with
predicates: [] and an initial config, and set either expected (if contract
allows an explicit empty predicates array) or expectedError (if contract forbids
empty predicates) to reflect the intended contract—use the same structures and
fields (externalClaimsSources, mappings, predicates) as the surrounding tests so
the new entries align with the suite.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 1e34b0e9-5d75-41d8-a767-d23db5e399c1
⛔ Files ignored due to path filters (8)
config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (4)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlconfig/v1/types_authentication.gopayload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlpayload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
everettraven
force-pushed
the
feature/external-claims-api
branch
from
09e520a to
6498c6e
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml (1)
918-943: ⚡ Quick winAdd the matching invalid-name case for
authentication.clientCredential.tls.certificateAuthority.This manifest only exercises the DNS-name validation for the top-level
externalClaimsSources[].tls.certificateAuthority, but the same validation is duplicated underexternalClaimsSources[].authentication.clientCredential.tls.certificateAuthority. A broken schema generation in that nested branch would currently go uncaught.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml` around lines 918 - 943, Add a second invalid-name test case that mirrors the existing externalClaimsSources TLS CA check but for the nested authentication.clientCredential.tls.certificateAuthority path: update the YAML in ExternalOIDCExternalClaimsSourcing.yaml to include an authentication: clientCredential: tls: certificateAuthority: name: "INVALID_NAME!" entry under the same externalClaimsSources item and assert the same expectedError string ("name must start and end with a lowercase alphanumeric character, and must only contain lowercase alphanumeric characters, '-' or '.'") so the schema validation for externalClaimsSources[].authentication.clientCredential.tls.certificateAuthority is exercised just like externalClaimsSources[].tls.certificateAuthority.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@config/v1/types_authentication.go`:
- Around line 94-96: The new FeatureGate annotation
ExternalOIDCExternalClaimsSourcing was added to OIDCProviders but not propagated
across the OIDC-related API surface; update the API types and annotations so the
gate consistently enables OIDC everywhere: add the same
+openshift:enable:FeatureGate=ExternalOIDCExternalClaimsSourcing (and +optional
where appropriate) to the AuthenticationType enum entry that allows "OIDC", to
the OIDCClients (oidcClients) type/status/validation annotations, and any
xValidation annotations tied to OIDC so that oidcProviders, oidcClients, and
AuthenticationType check the same gate; locate symbols AuthenticationType,
OIDCProviders, oidcClients, and related xValidation annotations in
types_authentication.go and the OIDC client/status definitions and add the gate
annotation to each corresponding declaration to maintain consistent gating.
---
Nitpick comments:
In
`@config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml`:
- Around line 918-943: Add a second invalid-name test case that mirrors the
existing externalClaimsSources TLS CA check but for the nested
authentication.clientCredential.tls.certificateAuthority path: update the YAML
in ExternalOIDCExternalClaimsSourcing.yaml to include an authentication:
clientCredential: tls: certificateAuthority: name: "INVALID_NAME!" entry under
the same externalClaimsSources item and assert the same expectedError string
("name must start and end with a lowercase alphanumeric character, and must only
contain lowercase alphanumeric characters, '-' or '.'") so the schema validation
for
externalClaimsSources[].authentication.clientCredential.tls.certificateAuthority
is exercised just like externalClaimsSources[].tls.certificateAuthority.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: f0339821-9928-47c2-b13d-2bb067849bbb
⛔ Files ignored due to path filters (8)
config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (4)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlconfig/v1/types_authentication.gopayload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlpayload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
everettraven
force-pushed
the
feature/external-claims-api
branch
from
6498c6e to
a9da673
Compare
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml`:
- Around line 786-790: The schema for url.hostname currently allows an optional
":port" but enforces maxLength: 253 which will reject a valid 253-character
hostname with a port appended; update the constraint for the url.hostname field
(the minLength/maxLength entries) to allow the colon and up to 5 port digits by
increasing maxLength from 253 to 259, or alternatively split host and port into
separate fields (e.g., hostname and port) and validate each independently; make
the change where url.hostname's maxLength/minLength are defined so the optional
":65535" can be accommodated.
- Around line 605-611: Replace the raw-string check for user info (the rule
"self.find('@') == ''" under the "tokenEndpoint must not have user info"
message) with a parsed-URL userinfo check so paths containing '@' are not
rejected; change the rule to use the URL parser like "url(self).getUserInfo() ==
''" (or the equivalent parsed userinfo accessor in this policy language) so only
authority userinfo is disallowed while allowing '@' in the path.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 49bac58b-6fe1-4b05-b238-bdca3f196925
⛔ Files ignored due to path filters (8)
config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (4)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlconfig/v1/types_authentication.gopayload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlpayload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
🚧 Files skipped from review as they are similar to previous changes (2)
- payload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml
- config/v1/types_authentication.go
everettraven
force-pushed
the
feature/external-claims-api
branch
from
a9da673 to
ee1517b
Compare
There was a problem hiding this comment.
Actionable comments posted: 1
♻️ Duplicate comments (1)
config/v1/types_authentication.go (1)
8-8:⚠️ Potential issue | 🟠 Major | ⚡ Quick winThread
ExternalOIDCExternalClaimsSourcingthrough the rest of the OIDC API surface.This updates the top-level OIDC validation and
spec.oidcProviders, butAuthenticationTypestill does not allowOIDCfor this gate andstatus.oidcClientsis still guarded by the older gate set. With onlyExternalOIDCExternalClaimsSourcingenabled, the new manifests in this PR can still be rejected or lose the existingoidcClientsinvariant.Also applies to: 94-94
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@config/v1/types_authentication.go` at line 8, The top-level validation and spec.oidcProviders were updated for ExternalOIDCExternalClaimsSourcing, but you must also propagate that feature gate through AuthenticationType checks and the status.oidcClients guard so enabling only ExternalOIDCExternalClaimsSourcing doesn't leave AuthenticationType disallowing OIDC or keep status.oidcClients behind the old gate; update the feature-gate annotations and validation conditions that reference AuthenticationType and status.oidcClients to include ExternalOIDCExternalClaimsSourcing (in the same style as the long openshift:validation tag and inside any code paths that validate AuthenticationType == OIDC or access status.oidcClients) so the new gate is threaded consistently across AuthenticationType, spec.oidcProviders, and status.oidcClients.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@config/v1/types_authentication.go`:
- Around line 881-886: The godoc comment for the mappings field contains a stale
TODO; remove the line "TODO: Should this hold true? If so, validate it." from
the comment block that documents mappings in config/v1/types_authentication.go
so the API contract reads as definitive (keep the rest of the text about
required entries, min/max and uniqueness) and do not change any validation
logic—references to mappings and externalClaimsSources should remain intact.
---
Duplicate comments:
In `@config/v1/types_authentication.go`:
- Line 8: The top-level validation and spec.oidcProviders were updated for
ExternalOIDCExternalClaimsSourcing, but you must also propagate that feature
gate through AuthenticationType checks and the status.oidcClients guard so
enabling only ExternalOIDCExternalClaimsSourcing doesn't leave
AuthenticationType disallowing OIDC or keep status.oidcClients behind the old
gate; update the feature-gate annotations and validation conditions that
reference AuthenticationType and status.oidcClients to include
ExternalOIDCExternalClaimsSourcing (in the same style as the long
openshift:validation tag and inside any code paths that validate
AuthenticationType == OIDC or access status.oidcClients) so the new gate is
threaded consistently across AuthenticationType, spec.oidcProviders, and
status.oidcClients.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 72fbd2c4-e141-4c12-b8ef-54ee46817177
⛔ Files ignored due to path filters (8)
config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (4)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlconfig/v1/types_authentication.gopayload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlpayload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
✅ Files skipped from review due to trivial changes (2)
- payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
- payload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml
external sources Signed-off-by: Bryce Palmer <bpalmer@redhat.com>
everettraven
force-pushed
the
feature/external-claims-api
branch
from
ee1517b to
4affa2a
Compare
There was a problem hiding this comment.
♻️ Duplicate comments (1)
config/v1/types_authentication.go (1)
94-96:⚠️ Potential issue | 🟠 Major | ⚡ Quick winPropagate
ExternalOIDCExternalClaimsSourcingacross the rest of the OIDC surface.
spec.oidcProvidersis enabled for the new gate here, butAuthenticationTypestill does not allowOIDCunder that gate andstatus.oidcClientsis still missing it as well. With onlyExternalOIDCExternalClaimsSourcingenabled, the new create cases can still fail beforeexternalClaimsSourcesis even validated.Suggested follow-up
-// +openshift:enable:FeatureGate=ExternalOIDC -// +openshift:enable:FeatureGate=ExternalOIDCWithUIDAndExtraClaimMappings +// +openshift:enable:FeatureGate=ExternalOIDC +// +openshift:enable:FeatureGate=ExternalOIDCWithUIDAndExtraClaimMappings +// +openshift:enable:FeatureGate=ExternalOIDCWithUpstreamParity +// +openshift:enable:FeatureGate=ExternalOIDCExternalClaimsSourcing // +optional OIDCClients []OIDCClientStatus `json:"oidcClients"` -// +openshift:validation:FeatureGateAwareEnum:featureGate=ExternalOIDC;ExternalOIDCWithUIDAndExtraClaimMappings,enum="";None;IntegratedOAuth;OIDC +// +openshift:validation:FeatureGateAwareEnum:featureGate=ExternalOIDC;ExternalOIDCWithUIDAndExtraClaimMappings;ExternalOIDCWithUpstreamParity;ExternalOIDCExternalClaimsSourcing,enum="";None;IntegratedOAuth;OIDC type AuthenticationType string🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@config/v1/types_authentication.go` around lines 94 - 96, The new feature gate ExternalOIDCExternalClaimsSourcing is enabled for spec.oidcProviders but not propagated elsewhere; update AuthenticationType to allow the OIDC enum value when ExternalOIDCExternalClaimsSourcing is enabled (modify the validation/enum logic around AuthenticationType), and ensure status.oidcClients includes OIDC-based entries when the gate is present (add gating checks where status is constructed/updated to append OIDC client info tied to spec.oidcProviders and externalClaimsSources). Also audit any create/validation paths that currently reject OIDC when the gate is set and modify them to consult ExternalOIDCExternalClaimsSourcing so new create flows don’t fail before externalClaimsSources are validated.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Duplicate comments:
In `@config/v1/types_authentication.go`:
- Around line 94-96: The new feature gate ExternalOIDCExternalClaimsSourcing is
enabled for spec.oidcProviders but not propagated elsewhere; update
AuthenticationType to allow the OIDC enum value when
ExternalOIDCExternalClaimsSourcing is enabled (modify the validation/enum logic
around AuthenticationType), and ensure status.oidcClients includes OIDC-based
entries when the gate is present (add gating checks where status is
constructed/updated to append OIDC client info tied to spec.oidcProviders and
externalClaimsSources). Also audit any create/validation paths that currently
reject OIDC when the gate is set and modify them to consult
ExternalOIDCExternalClaimsSourcing so new create flows don’t fail before
externalClaimsSources are validated.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: aa5bf0e5-8bfc-4dbf-97be-88d9725d1175
⛔ Files ignored due to path filters (8)
config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yamlis excluded by!**/zz_generated.crd-manifests/*config/v1/zz_generated.deepcopy.gois excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests.yamlis excluded by!**/zz_generated*config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlis excluded by!**/zz_generated.featuregated-crd-manifests/**config/v1/zz_generated.swagger_doc_generated.gois excluded by!**/zz_generated*openapi/generated_openapi/zz_generated.openapi.gois excluded by!openapi/**,!**/zz_generated*openapi/openapi.jsonis excluded by!openapi/**
📒 Files selected for processing (4)
config/v1/tests/authentications.config.openshift.io/ExternalOIDCExternalClaimsSourcing.yamlconfig/v1/types_authentication.gopayload-manifests/crds/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yamlpayload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
🚧 Files skipped from review as they are similar to previous changes (1)
- payload-manifests/crds/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml
|
Holding until openshift/oauth-apiserver#197 makes it in. /hold |
openshift-ci
Bot
added
the
do-not-merge/hold
everettraven
changed the title
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@everettraven: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Description
Updates the
authentications.config.openshift.io/v1API to add new fields for sourcing claims from external sources (i.e not from the token being authenticated).This PR is based on the changes in openshift/oauth-apiserver#197 which adds all the fields to the configuration file that this API is used to generate.