Wire a feature-gates config observer for oauth-apiserver.

Author: benluddy

pkg/operator/configobservation/configobservercontroller/config_observer_controller.go

@@ -8,6 +8,7 @@ import (
 	"github.com/openshift/library-go/pkg/operator/configobserver"
 	"github.com/openshift/library-go/pkg/operator/configobserver/apiserver"
 	libgoetcd "github.com/openshift/library-go/pkg/operator/configobserver/etcd"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	encryptobserver "github.com/openshift/library-go/pkg/operator/encryption/observer"
 	"github.com/openshift/library-go/pkg/operator/events"
 	"github.com/openshift/library-go/pkg/operator/resourcesynccontroller"
@@ -28,6 +29,7 @@ func NewConfigObserverController(
 	configInformer configinformers.SharedInformerFactory,
 	resourceSyncer resourcesynccontroller.ResourceSyncer,
 	eventRecorder events.Recorder,
+	featureGateAccessor featuregates.FeatureGateAccess,
 ) factory.Controller {
 
 	preRunCacheSynced := []cache.InformerSynced{
@@ -70,6 +72,7 @@ func NewConfigObserverController(
 		observeoauth.ObserveAccessTokenInactivityTimeout,
 		libgoetcd.ObserveStorageURLsToArguments,
 		encryptobserver.NewEncryptionConfigObserver("openshift-oauth-apiserver", "/var/run/secrets/encryption-config/encryption-config"),
+		featuregates.NewObserveFeatureFlagsFunc(nil, nil, []string{"apiServerArguments", "feature-gates"}, featureGateAccessor),
 	} {
 		observers = append(observers,
 			configobserver.WithPrefix(o, OAuthAPIServerConfigPrefix))

pkg/operator/replacement_starter.go

@@ -346,9 +346,9 @@ func CreateOperatorStarter(ctx context.Context, authOperatorInput *authenticatio
 	return ret, nil
 }
 
-type featureGateAccessorFunc func(ctx context.Context, authOperatorInput *authenticationOperatorInput, informerFactories authenticationOperatorInformerFactories) (featuregates.FeatureGate, error)
+type featureGateAccessorFunc func(ctx context.Context, authOperatorInput *authenticationOperatorInput, informerFactories authenticationOperatorInformerFactories) (featuregates.FeatureGateAccess, error)
 
-func defaultFeatureGateAccessor(ctx context.Context, authOperatorInput *authenticationOperatorInput, informerFactories authenticationOperatorInformerFactories) (featuregates.FeatureGate, error) {
+func defaultFeatureGateAccessor(ctx context.Context, authOperatorInput *authenticationOperatorInput, informerFactories authenticationOperatorInformerFactories) (featuregates.FeatureGateAccess, error) {
 	// By default, this will exit(0) if the featuregates change
 	featureGateAccessor := featuregates.NewFeatureGateAccess(
 		status.VersionForOperatorFromEnv(), "0.0.1-snapshot",
@@ -359,19 +359,12 @@ func defaultFeatureGateAccessor(ctx context.Context, authOperatorInput *authenti
 	go featureGateAccessor.Run(ctx)
 	go informerFactories.operatorConfigInformer.Start(ctx.Done())
 
-	var featureGates featuregates.FeatureGate
-	select {
-	case <-featureGateAccessor.InitialFeatureGatesObserved():
-		featureGates, _ = featureGateAccessor.CurrentFeatureGates()
-	case <-time.After(1 * time.Minute):
-		return nil, fmt.Errorf("timed out waiting for FeatureGate detection")
-	}
-	return featureGates, nil
+	return featureGateAccessor, nil
 }
 
 // staticFeatureGateAccessor is primarly used during testing to statically enable or disable features.
 func staticFeatureGateAccessor(enabled, disabled []ocpconfigv1.FeatureGateName) featureGateAccessorFunc {
-	return func(_ context.Context, _ *authenticationOperatorInput, _ authenticationOperatorInformerFactories) (featuregates.FeatureGate, error) {
-		return featuregates.NewFeatureGate(enabled, disabled), nil
+	return func(_ context.Context, _ *authenticationOperatorInput, _ authenticationOperatorInformerFactories) (featuregates.FeatureGateAccess, error) {
+		return featuregates.NewHardcodedFeatureGateAccess(enabled, disabled), nil
 	}
 }

pkg/operator/starter.go

@@ -41,6 +41,7 @@ import (
 	workloadcontroller "github.com/openshift/library-go/pkg/operator/apiserver/controller/workload"
 	apiservercontrollerset "github.com/openshift/library-go/pkg/operator/apiserver/controllerset"
 	"github.com/openshift/library-go/pkg/operator/certrotation"
+	"github.com/openshift/library-go/pkg/operator/configobserver/featuregates"
 	"github.com/openshift/library-go/pkg/operator/csr"
 	"github.com/openshift/library-go/pkg/operator/encryption"
 	"github.com/openshift/library-go/pkg/operator/encryption/controllers/migrators"
@@ -586,12 +587,18 @@ func prepareOauthAPIServerOperator(
 		return nil, nil, err
 	}
 
+	featureGateAccessor, err := authOperatorInput.featureGateAccessor(ctx, authOperatorInput, informerFactories)
+	if err != nil {
+		return nil, nil, err
+	}
+
 	configObserver := oauthapiconfigobservercontroller.NewConfigObserverController(
 		authOperatorInput.authenticationOperatorClient,
 		informerFactories.kubeInformersForNamespaces,
 		informerFactories.operatorConfigInformer,
 		resourceSyncController,
 		authOperatorInput.eventRecorder,
+		featureGateAccessor,
 	)
 
 	webhookAuthController := webhookauthenticator.NewWebhookAuthenticatorController(
@@ -680,11 +687,19 @@ func prepareExternalOIDC(
 	informerFactories authenticationOperatorInformerFactories,
 ) ([]libraryapplyconfiguration.NamedRunOnce, []libraryapplyconfiguration.RunFunc, error) {
 
-	featureGates, err := authOperatorInput.featureGateAccessor(ctx, authOperatorInput, informerFactories)
+	featureGateAccessor, err := authOperatorInput.featureGateAccessor(ctx, authOperatorInput, informerFactories)
 	if err != nil {
 		return nil, nil, err
 	}
 
+	var featureGates featuregates.FeatureGate
+	select {
+	case <-featureGateAccessor.InitialFeatureGatesObserved():
+		featureGates, _ = featureGateAccessor.CurrentFeatureGates()
+	case <-time.After(1 * time.Minute):
+		return nil, nil, fmt.Errorf("timed out waiting for FeatureGate detection")
+	}
+
 	if !(featureGates.Enabled(features.FeatureGateExternalOIDC) || featureGates.Enabled(features.FeatureGateExternalOIDCWithAdditionalClaimMappings)) {
 		return nil, nil, nil
 	}