CNTRLPLANE-334: Update KAS structured authentication configuration generation logic to use new uid and extra field

[kevinrizza]

What this PR does / why we need it:

• Updates the KAS structured authentication generation logic to use the new uid and extra claim mapping fields introduced to the authentications.config.openshift.io CRD in CNTRLPLANE-332: Add uid and extra claim mappings for external OIDC configuration api#2234

Supersedes #5840

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

[openshift-ci-robot]

@kevinrizza: This pull request references CNTRLPLANE-334 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

What this PR does / why we need it:

• Updates the KAS structured authentication generation logic to use the new uid and extra claim mapping fields introduced to the authentications.config.openshift.io CRD in CNTRLPLANE-332: Add uid and extra claim mappings for external OIDC configuration api#2234

Supersedes #5840

Which issue(s) this PR fixes (optional, use fixes #<issue_number>(, fixes #<issue_number>, ...) format, where issue_number might be a GitHub issue, or a Jira story:
Fixes #

Checklist

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[cwbotbot]

Test Results

e2e-aws

• Status: ✅ PASS
• Started: 2025-05-01T14:59:22Z
• View Job
• View Job History

e2e-aks

• Status: ✅ PASS
• Started: 2025-05-01T14:59:23Z
• View Job
• View Job History

[sjenning]

/retest

verify still need gofmt fixes

support/validations/authentication.go:7:1: File is not properly formatted (gci)
	configv1 "github.com/openshift/api/config/v1"
^
support/validations/authentication.go:9:1: File is not properly formatted (gci)
	"github.com/openshift/hypershift/support/supportedversion"
^
support/validations/authentication.go:13:1: File is not properly formatted (gci)
	"k8s.io/apiserver/pkg/cel/environment"
^

[kevinrizza]

/payload 4.19 ci blocking

[openshift-ci]

@kevinrizza: trigger 4 job(s) of type blocking for the ci release of OCP 4.19

• periodic-ci-openshift-release-master-ci-4.19-upgrade-from-stable-4.18-e2e-aws-ovn-upgrade
• periodic-ci-openshift-release-master-ci-4.19-upgrade-from-stable-4.18-e2e-azure-ovn-upgrade
• periodic-ci-openshift-release-master-ci-4.19-e2e-gcp-ovn-upgrade
• periodic-ci-openshift-hypershift-release-4.19-periodics-e2e-aws-ovn

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/902896e0-2478-11f0-9d0b-ba180530f3cf-0

[everettraven]

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-ovn-hypershift-guest-ext-oidc-f7

[openshift-ci]

@everettraven: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-ovn-hypershift-guest-ext-oidc-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/c9e60520-25c7-11f0-8afd-a29a931efa76-0

[everettraven]

/payload-job periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-ovn-hypershift-guest-ext-oidc-f7

[openshift-ci]

@everettraven: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-openshift-tests-private-release-4.19-amd64-nightly-aws-ipi-ovn-hypershift-guest-ext-oidc-f7

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/09f2c1b0-25e8-11f0-97aa-7d7e9f265bcc-0

[sjenning]

verify and unit are failing

# [github.com/openshift/hypershift/support/validations]
vet: support/validations/authentication_test.go:115:40: t.Context undefined (type *testing.T has no field or method Context, but does have unexported field context)

[everettraven]

/retest

[everettraven]

Verify passes when run locally and looks like it timed out in CI. Kicking.

/test verify

[everettraven]

/retest

[sjenning]

/approve
/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kevinrizza, sjenning

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [sjenning]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[everettraven]

/retitle CNTRLPLANE-334: Update KAS structured authentication configuration generation logic to use new uid and extra field

[openshift-ci-robot]

/retest-required

Remaining retests: 0 against base HEAD 109dbe3 and 2 for PR HEAD 4915b59 in total

[openshift-ci]

@kevinrizza: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-bot]

[ART PR BUILD NOTIFIER]

Distgit: hypershift
This PR has been included in build ose-hypershift-container-v4.20.0-202505060743.p0.gd2f8e41.assembly.stream.el9.
All builds following this will include this PR.

[everettraven]

/cherry-pick release-4.19

[openshift-cherrypick-robot]

@everettraven: #6073 failed to apply on top of branch "release-4.19":

Applying: byooidc: add support for specifying uid and extra claim mappings
Applying: improve validation logic for OIDC authentication mode
Applying: supportedversion: add ocp-to-kube version mapping utilities
Using index info to reconstruct a base tree...
M	support/supportedversion/version.go
Falling back to patching base and 3-way merge...
Auto-merging support/supportedversion/version.go
CONFLICT (content): Merge conflict in support/supportedversion/version.go
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
hint: When you have resolved this problem, run "git am --continue".
hint: If you prefer to skip this patch, run "git am --skip" instead.
hint: To restore the original branch and stop patching, run "git am --abort".
hint: Disable this message with "git config advice.mergeConflict false"
Patch failed at 0003 supportedversion: add ocp-to-kube version mapping utilities

In response to this:

/cherry-pick release-4.19

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.