feat: showcase externalauth creation from frontend to backend - #5802
Closed
Miguel Soriano (miguelsorianod) wants to merge 4 commits into
Closed
Miguel Soriano (miguelsorianod) wants to merge 4 commits into
Miguel Soriano (miguelsorianod) wants to merge 4 commits into
Conversation
openshift-ci
Bot
requested review from
David Eads (deads2k) and
Gerd Oberlechner (geoberle)
June 26, 2026 07:47
Copilot started reviewing on behalf of
Miguel Soriano (miguelsorianod)
June 26, 2026 07:48
View session
Collaborator
Author
|
/hold this MR can't be merged because we will need to rollout the changes in phases. This is just to show the end-result for review as well as e2e execution |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR moves Cluster Service external auth creation out of the frontend and into the backend, adding a dedicated controller to create/adopt the Cluster Service external auth and persist its ClusterServiceID in Cosmos, while updating the external auth create operation controller to reconcile based on the resource’s persisted CS ID.
Changes:
- Removed frontend-side
PostExternalAuthcall and shifted Cluster Service coordination to backend controller(s). - Added
ExternalAuthClusterServiceCreatecontroller to create/adopt CS external auths and setServiceProviderProperties.ClusterServiceIDon the external auth Cosmos document. - Updated operation and integration test utilities to work with the new flow (including new mutation step helpers and additional controller unit tests).
Reviewed changes
Copilot reviewed 11 out of 11 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| test-integration/utils/integrationutils/set_cluster_service_id.go | Adds integration helpers to derive and persist Cluster Service internal IDs for clusters/nodepools/external auths. |
| test-integration/utils/integrationutils/cluster_service_mock.go | Adds FindClusterHREF helper to retrieve cluster HREFs from the mock for derivation logic. |
| test-integration/utils/databasemutationhelpers/step_set_cluster_service_id.go | Introduces a new integration test step for setting ClusterServiceID from file or derivation. |
| test-integration/utils/databasemutationhelpers/resource_crud_test_util.go | Registers the new setClusterServiceID step type in the test step factory. |
| test-integration/frontend/cross_version_roundtrip_test.go | Updates test flow to set external auth CSID after creation to align with backend-side CS create. |
| frontend/pkg/frontend/external_auth.go | Removes frontend-side Cluster Service external auth creation and uses an empty operation internal ID. |
| backend/pkg/controllers/operationcontrollers/operation_external_auth_create.go | Updates create operation reconciliation to use backend informers/listers and resource state (CSID + ActiveOperationID). |
| backend/pkg/controllers/operationcontrollers/operation_external_auth_create_test.go | Expands unit test coverage for new reconciliation gating logic. |
| backend/pkg/controllers/externalauthcreationcontrollers/external_auth_cluster_service_create_controller.go | Adds new controller to create/adopt CS external auth and persist the external auth CSID in Cosmos. |
| backend/pkg/controllers/externalauthcreationcontrollers/external_auth_cluster_service_create_controller_test.go | Adds unit tests for CS external auth adoption/creation and Cosmos persistence behavior. |
| backend/pkg/app/backend.go | Wires and runs the new controller and passes backend informers into the external auth create operation controller. |
Comment on lines
+75
to
+80
| clusterCSID, err := clusterClusterServiceID(ctx, resourcesDBClient, resourceID) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
| return ocm.GenerateAROHCPExternalAuthHREF(clusterCSID.ID(), resourceID.Name), nil | ||
|
|
Comment on lines
+161
to
+163
| if resourceID.Parent == nil { | ||
| return utils.TrackError(fmt.Errorf("node pool resource %s has no parent cluster", resourceID)) | ||
| } |
Comment on lines
+185
to
+187
| if resourceID.Parent == nil { | ||
| return utils.TrackError(fmt.Errorf("external auth resource %s has no parent cluster", resourceID)) | ||
| } |
Collaborator
Author
|
/retest |
Miguel Soriano (miguelsorianod)
force-pushed
the
v2-move-externalauth-cs-create-to-backend
branch
2 times, most recently
from
June 26, 2026 12:23
fd41d3e to
856817d
Compare
Copilot started reviewing on behalf of
Miguel Soriano (miguelsorianod)
June 26, 2026 12:24
View session
Comment on lines
+144
to
+145
| Expect(err).To(HaveOccurred(), "expected error when creating a second external auth config on cluster %s", clusterName) | ||
| Expect(err.Error()).To(ContainSubstring("There are other external auths on the cluster. Only one external auth is allowed per cluster.")) |
| if err != nil { | ||
| return "", err | ||
| } | ||
| return ocm.GenerateAROHCPExternalAuthHREF(clusterCSID.ID(), resourceID.Name), nil |
| csInternalID api.InternalID, | ||
| ) error { | ||
| if resourceID.Parent == nil { | ||
| return utils.TrackError(fmt.Errorf("node pool resource %s has no parent cluster", resourceID)) |
| csInternalID api.InternalID, | ||
| ) error { | ||
| if resourceID.Parent == nil { | ||
| return utils.TrackError(fmt.Errorf("external auth resource %s has no parent cluster", resourceID)) |
| return ocm.GenerateAROHCPExternalAuthHREF(clusterCSID.ID(), resourceID.Name), nil | ||
|
|
||
| default: | ||
| return "", utils.TrackError(fmt.Errorf("resource %s: setClusterServiceID supports clusters, node pools, and external auths only", resourceIDString)) |
Comment on lines
+33
to
+34
| // AdmitExternalAuth performs non-static checks of externalauth. Checks that require more information than is contained inside of | ||
| // the extrenalauth instance itself. |
Comment on lines
+33
to
+34
| existingExternalAuthResourceID = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.RedHatOpenShift/hcpOpenShiftClusters/cluster/externalAuthConfigs/existing" | ||
| otherExternalAuthResourceID = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg/providers/Microsoft.RedHatOpenShift/hcpOpenShiftClusters/cluster/externalAuthConfigs/other" |
Miguel Soriano (miguelsorianod)
force-pushed
the
v2-move-externalauth-cs-create-to-backend
branch
from
June 26, 2026 16:15
856817d to
2109a2e
Compare
Miguel Soriano (miguelsorianod)
force-pushed
the
v2-move-externalauth-cs-create-to-backend
branch
from
June 26, 2026 17:11
2109a2e to
6e96e35
Compare
Copilot started reviewing on behalf of
Miguel Soriano (miguelsorianod)
June 26, 2026 17:14
View session
| if err != nil { | ||
| return "", err | ||
| } | ||
| return ocm.GenerateAROHCPExternalAuthHREF(clusterCSID.ID(), resourceID.Name), nil |
| return ocm.GenerateAROHCPExternalAuthHREF(clusterCSID.ID(), resourceID.Name), nil | ||
|
|
||
| default: | ||
| return "", utils.TrackError(fmt.Errorf("resource %s: setClusterServiceID supports clusters, node pools, and external auths only", resourceIDString)) |
After external auth create moved to the backend, frontend integration tests no longer persist serviceProviderProperties.clusterServiceID on create. Update/delete paths still require it, so tests that only run the frontend would fail with "clusterServiceID is required". Add a setClusterServiceID databasemutation step (like completeOperation) that stamps the Cluster Service internal ID on cluster, node pool, or external auth Cosmos documents. Derivation follows backend conventions (parent cluster CS id + ARO HCP href for children; mock PostCluster HREF for clusters). Optional cluster-service-id.json overrides when needed. Wire the step into FrontendCRUD scenarios that mutate or delete node pools after create, and call the same helpers from cross-version roundtrip tests. Add ClusterServiceMock.FindClusterHREF for cluster derive.
…sabled state The backend logic to perform asynchronous externalauth creation is disabled for now: the added controller is only executed when ClusterServiceID is not set. For now in frontend we always store the ClusterServiceID so it is guaranteed to not be executed. Additionally, the externalauth create operation has been updated to retrieve the ClusterServiceID from the ExternalAuth cosmos resource instead of the operation. This allows us to stop relying on it for when we stop setting it in frontend.
Move Cluster Service interaction out of the frontend create path and hand it off to the backend's async externalauth creation controllers. External Auth create operations no longer set an InternalID as it is not needed anymore when using the new external auth creation approach in backend.
Miguel Soriano (miguelsorianod)
force-pushed
the
v2-move-externalauth-cs-create-to-backend
branch
from
June 30, 2026 15:07
6e96e35 to
20cdaf7
Compare
Collaborator
|
/lgtm if it works, split it up and we can merge. |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: deads2k, miguelsorianod The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Contributor
|
Miguel Soriano (@miguelsorianod): The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Contributor
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Collaborator
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
PR that showcases the movement of the externalauth creation CS interaction from frontend to backend as well as controller-based coordination