OCPBUGS-46086: Always set service-account-jwks-uri to LB URL even with custom issuer

[ShazaAldawamneh]

Previously, when a custom service account issuer was set, the
service-account-jwks-uri argument was not configured in the KubeAPIServer,
causing the JWKS URI to default to the node IP. This led to TLS errors
because the node IP is not included in the certificate SAN.

This commit updates observedConfig to always set
service-account-jwks-uri to the API LB URL regardless of whether the
issuer is default or custom. Unit tests have been updated to validate
this behavior.

Fixes: TLS SAN issues for clients accessing JWKS URI with custom issuers.

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-46086, which is invalid:

• expected the bug to target the "4.21.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Previously, when a custom service account issuer was set, the
service-account-jwks-uri argument was not configured in the KubeAPIServer,
causing the JWKS URI to default to the node IP. This led to TLS errors
because the node IP is not included in the certificate SAN.

This commit updates observedConfig to always set
service-account-jwks-uri to the API LB URL regardless of whether the
issuer is default or custom. Unit tests have been updated to validate
this behavior.

Fixes: TLS SAN issues for clients accessing JWKS URI with custom issuers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Expanded comments and a minor refactor around service-account-jwks-uri resolution: compute and validate the API server external URL earlier, then set service-account-jwks-uri to APIServerURL + /openid/v1/jwks for the default issuer or to <observedIssuer>/openid/v1/jwks for custom issuers. Tests updated to assert the computed URI.

Changes

Cohort / File(s)	Summary
Auth config observation logic pkg/operator/configobservation/auth/auth_serviceaccountissuer.go	Moved and expanded explanatory comments about JWKS URI behavior; refactored to compute apiServerExternalURL outside inner conditional, validate its presence, and assign service-account-jwks-uri for default issuer using APIServerURL + /openid/v1/jwks; custom issuer uses observedActiveIssuer + /openid/v1/jwks. No change to observable structure or branching outcome.
Auth config observation tests pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go	Replaced boolean JWKS-visibility checks with explicit service-account-jwks-uri string assertions; updated test cases and helper apiConfigForIssuer to compute expected JWKS URI dynamically for default, empty, and custom issuer scenarios, including infra/auth error paths.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	You can run @coderabbitai generate docstrings to improve docstring coverage.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately describes the main change: ensuring service-account-jwks-uri is always set to the LB URL regardless of issuer type, which directly addresses the TLS SAN issues mentioned in the PR objectives.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

📝 Coding Plan

• Generate coding plan for human review comments

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 21e09f9 and 64ce562.

📒 Files selected for processing (3)

• pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go (4 hunks)
• tls.crt (1 hunks)
• tls.key (1 hunks)

✅ Files skipped from review due to trivial changes (1)

• tls.crt

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go

🧰 Additional context used

🪛 Gitleaks (8.27.2)

tls.key

[high] 1-27: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.

(private-key)

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (6)

pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go (6)

57-63: Reduce duplication with later custom-issuer case.

This test is effectively duplicated by the new “custom issuer, no previous issuer” case at Lines 114–121. Either drop one or vary inputs (e.g., add trustedIssuers) to cover a distinct path.

---

114-121: Good addition; add a negative test for empty APIServerURL.

To lock in the error-path contract, add a test where Infrastructure.Status.APIServerURL is empty and verify: an error is surfaced and JWKS URI is not set.

Here’s a self-contained test you can append:

+func TestObservedConfig_EmptyAPIServerURL(t *testing.T) {
+  testRecorder := events.NewInMemoryRecorder("SAIssuerTest", clock.RealClock{})
+  expectedErr := fmt.Errorf("APIServerURL is empty")
+  newConfig, errs := observedConfig(
+    unstructuredAPIConfigForIssuer(t, defaultServiceAccountIssuerValue, nil),
+    func(_ string) (*operatorv1.KubeAPIServer, error) {
+      return kasStatusForIssuer(defaultServiceAccountIssuerValue), nil
+    },
+    func(_ string) (*configv1.Infrastructure, error) {
+      return &configv1.Infrastructure{Status: configv1.InfrastructureStatus{APIServerURL: ""}}, expectedErr
+    },
+    testRecorder,
+  )
+  // Unmarshal and assert JWKS not present
+  unstructuredConfig := unstructured.Unstructured{Object: newConfig}
+  raw, err := unstructuredConfig.MarshalJSON()
+  require.NoError(t, err)
+  cfg := &kubecontrolplanev1.KubeAPIServerConfig{TypeMeta: metav1.TypeMeta{Kind: "KubeAPIServerConfig"}}
+  require.NoError(t, json.Unmarshal(raw, cfg))
+  if _, ok := cfg.APIServerArguments["service-account-jwks-uri"]; ok {
+    t.Fatalf("expected service-account-jwks-uri to be absent when APIServerURL is empty")
+  }
+  require.Contains(t, errs, expectedErr)
+}

---

174-175: Swap expected/actual in assert for clarity.

Keep testify’s expected, actual order.

-          require.Equal(t, uri, kubecontrolplanev1.Arguments{testLBURI})
+          require.Equal(t, kubecontrolplanev1.Arguments{testLBURI}, uri)

---

178-178: Avoid calling String() on slice type; print the value directly.

kubecontrolplanev1.Arguments is a slice; String() may not exist across versions.

-        t.Errorf("expected no service-account-jwks-uri to be set, it is %+v", uri.String())
+        t.Errorf("expected no service-account-jwks-uri to be set, it is %+v", uri)

---

215-218: Remove commented-out code in helper; keep intent crisp.

These deletes are confusing in tests. Drop them.

- //delete(args, "service-account-issuer")
- //delete(args, "api-audiences")
  args["service-account-jwks-uri"] = kubecontrolplanev1.Arguments{testLBURI}

---

39-40: Terminology nit: JWKS vs. JWKI.

Rename expectInternalJWKI to expectJWKSURI (or similar) for accuracy.

Also applies to: 170-177

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between 64ce562 and f33ce1f.

📒 Files selected for processing (1)

• pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go (5 hunks)

🔇 Additional comments (5)

pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go (5)

71-71: JWKS URI should always be set to LB URL — good.

---

75-80: LGTM: same issuer/no change still asserts JWKS URI present.

---

88-88: LGTM: trusted issuers preserved while JWKS URI asserted.

---

91-97: LGTM: issuer change triggers event and keeps JWKS URI.

---

99-105: Verify behavior when auth getter errors.

You still assert JWKS URI presence when auth returns an error. Confirm the observer keeps computing JWKS from Infrastructure.Status.APIServerURL even if the auth getter errors (and only fails if APIServerURL is empty).

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (5)

pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go (5)

57-63: Good expansion of table cases to always expect JWKS at the LB URL.

Covers key transitions (default→custom, custom unchanged, error pass‑through). Consider adding one more case where Infrastructure.Status.APIServerURL is empty to assert: (a) an error is surfaced and (b) service-account-jwks-uri is not set.

Sample table entry to add:

+        {
+            name:               "missing APIServerURL yields error and no jwks-uri",
+            existingIssuer:     defaultServiceAccountIssuerValue,
+            issuer:             defaultServiceAccountIssuerValue,
+            // infra getter returns empty APIServerURL
+            infraError:         fmt.Errorf("no APIServerURL"),
+            expectedIssuer:     defaultServiceAccountIssuerValue,
+            // keep this false if observed code skips jwks-uri on missing APIServerURL
+            expectInternalJWKI: false,
+            expectedChange:     true,
+        },

Also applies to: 71-71, 75-80, 88-88, 91-97, 99-105, 114-121

---

174-175: Swap expected/actual in require.Equal for clearer failures.

Testify expects require.Equal(t, expected, actual).

-                    require.Equal(t, uri, kubecontrolplanev1.Arguments{testLBURI})
+                    require.Equal(t, kubecontrolplanev1.Arguments{testLBURI}, uri)

---

178-178: Avoid calling String() on kubecontrolplanev1.Arguments.

Safer to format the slice directly; avoids coupling to a String() method.

-                t.Errorf("expected no service-account-jwks-uri to be set, it is %+v", uri.String())
+                t.Errorf("expected no service-account-jwks-uri to be set, it is %+v", uri)

---

215-217: Remove commented‑out deletes; keep expected args explicit.

Dead commented code adds noise in tests.

-    //delete(args, "service-account-issuer")
-    //delete(args, "api-audiences")
     args["service-account-jwks-uri"] = kubecontrolplanev1.Arguments{testLBURI}

---

61-61: Nit: rename expectInternalJWKI → expectJWKSURI (or expectJWKS).

Current name reads like “JWKI”. Renaming improves readability and avoids confusion with “JWKS”.

If you want, I can generate a quick sed/rg script to safely rename across the file.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

Cache: Disabled due to data retention organization setting

Knowledge base: Disabled due to Reviews -> Disable Knowledge Base setting

📥 Commits

Reviewing files that changed from the base of the PR and between f33ce1f and 47ee8ff.

📒 Files selected for processing (2)

• pkg/operator/configobservation/auth/auth_serviceaccountissuer.go (1 hunks)
• pkg/operator/configobservation/auth/auth_serviceaccountissuer_test.go (5 hunks)

🚧 Files skipped from review as they are similar to previous changes (1)

• pkg/operator/configobservation/auth/auth_serviceaccountissuer.go

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[coderabbitai]

Actionable comments posted: 1

🤖 Fix all issues with AI agents

In `@pkg/operator/configobservation/auth/auth_serviceaccountissuer.go`:
- Around line 131-136: The code validates APIServerURL via
getInfrastructureConfig but never assigns it to the apiServerArguments map;
update the block that checks infrastructureConfig.Status.APIServerURL to set
apiServerArguments["service-account-jwks-uri"] to the cluster API server JWKS
endpoint (for example by building fmt.Sprintf("%s/.well-known/jwks.json",
apiServerExternalURL) or ensuring an https:// prefix if missing) before
continuing, so the service-account-jwks-uri key in apiServerArguments (used
later when constructing the apiserver config) is populated; reference the
existing getInfrastructureConfig call, infrastructureConfig.Status.APIServerURL,
and the apiServerArguments["service-account-jwks-uri"] entry when making the
change.

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-74409, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Previously, when a custom service account issuer was set, the
service-account-jwks-uri argument was not configured in the KubeAPIServer,
causing the JWKS URI to default to the node IP. This led to TLS errors
because the node IP is not included in the certificate SAN.

This commit updates observedConfig to always set
service-account-jwks-uri to the API LB URL regardless of whether the
issuer is default or custom. Unit tests have been updated to validate
this behavior.

Fixes: TLS SAN issues for clients accessing JWKS URI with custom issuers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ShazaAldawamneh]

/verified by @ShazaAldawamneh

[openshift-ci-robot]

@ShazaAldawamneh: This PR has been marked as verified by @ShazaAldawamneh.

Details

In response to this:

/verified by @ShazaAldawamneh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@ShazaAldawamneh: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-gcp-operator-single-node	47ee8ff	link	false	/test e2e-gcp-operator-single-node

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-46086, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

Details

In response to this:

Previously, when a custom service account issuer was set, the
service-account-jwks-uri argument was not configured in the KubeAPIServer,
causing the JWKS URI to default to the node IP. This led to TLS errors
because the node IP is not included in the certificate SAN.

This commit updates observedConfig to always set
service-account-jwks-uri to the API LB URL regardless of whether the
issuer is default or custom. Unit tests have been updated to validate
this behavior.

Fixes: TLS SAN issues for clients accessing JWKS URI with custom issuers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[benluddy]

/remove-lifecycle rotten

[ShazaAldawamneh]

/verified by @ShazaAldawamneh

[openshift-ci-robot]

@ShazaAldawamneh: This PR has been marked as verified by @ShazaAldawamneh.

Details

In response to this:

/verified by @ShazaAldawamneh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ShazaAldawamneh]

/jira refresh

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-46086, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @wangke19

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[everettraven]

/lgtm

[benluddy]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: benluddy, everettraven, ShazaAldawamneh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [benluddy]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@ShazaAldawamneh: Jira Issue Verification Checks: Jira Issue OCPBUGS-46086
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-46086 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

Previously, when a custom service account issuer was set, the
service-account-jwks-uri argument was not configured in the KubeAPIServer,
causing the JWKS URI to default to the node IP. This led to TLS errors
because the node IP is not included in the certificate SAN.

This commit updates observedConfig to always set
service-account-jwks-uri to the API LB URL regardless of whether the
issuer is default or custom. Unit tests have been updated to validate
this behavior.

Fixes: TLS SAN issues for clients accessing JWKS URI with custom issuers.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[ShazaAldawamneh]

/cherry-pick release-4.21

[openshift-cherrypick-robot]

@ShazaAldawamneh: new pull request created: #2071

Details

In response to this:

/cherry-pick release-4.21

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.