OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support.

[ShazaAldawamneh]

What this PR does / why we need it:

Fixes OCPBUGS-81686
The validation logic was using v1/kas which doesn't support CEL claim
validation rules or expression-based username mappings. This was causing
errors when users configured ExternalOIDC with these features.
Changes:

• Export GenerateAuthConfig in v2/kas/auth.go to match v1 signature
• Update support/validations/authentication.go to import v2/kas
• Add test case for CEL validation rules and username expressions

Which issue(s) this PR fixes:

Fixes OCPBUGS-81686

Checklist:

• [Y] Subject and description added to both, commit and PR.
• [Y] Relevant issues have been referenced.
• [Y] This change includes unit tests.

Summary by CodeRabbit

• Refactor

  • Authentication config generation now builds from the cluster Authentication spec with an explicit namespace; validation flows updated to use the revised generation path for consistency.

• Tests

  • OIDC validation tests expanded with feature-gated cases covering CEL-based claim validation and CEL-driven username mapping, including success and syntax-error failure scenarios.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references Jira Issue OCPBUGS-81686, which is invalid:

• expected the bug to target the "5.0.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

What this PR does / why we need it:

Fixes OCPBUGS-81686
The validation logic was using v1/kas which doesn't support CEL claim
validation rules or expression-based username mappings. This was causing
errors when users configured ExternalOIDC with these features.
Changes:

• Export GenerateAuthConfig in v2/kas/auth.go to match v1 signature
• Update support/validations/authentication.go to import v2/kas
• Add test case for CEL validation rules and username expressions

Which issue(s) this PR fixes:

Fixes OCPBUGS-81686

Checklist:

• [Y] Subject and description added to both, commit and PR.
• [Y] Relevant issues have been referenced.
• [Y] This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 37.39%. Comparing base (3fc6979) to head (cba1008).
⚠️ Report is 62 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #8246      +/-   ##
==========================================
+ Coverage   37.23%   37.39%   +0.16%     
==========================================
  Files         750      751       +1     
  Lines       91798    91809      +11     
==========================================
+ Hits        34181    34336     +155     
+ Misses      54978    54838     -140     
+ Partials     2639     2635       -4     

Files with missing lines	Coverage Δ
...ator/controllers/hostedcontrolplane/v2/kas/auth.go	83.19% <100.00%> (+0.14%)	⬆️
support/validations/authentication.go	35.13% <100.00%> (ø)

... and 34 files with indirect coverage changes

Flag	Coverage Δ
cmd-support	32.56% <100.00%> (+0.49%)	⬆️
cpo-hostedcontrolplane	36.49% <100.00%> (+<0.01%)	⬆️
cpo-other	37.73% <ø> (ø)
hypershift-operator	47.85% <ø> (ø)
other	27.77% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change renames and exports generateAuthConfig to GenerateAuthConfig(spec *configv1.AuthenticationSpec, ctx context.Context, c crclient.Reader, namespace string), removing the hyperv1 dependency and accepting an explicit AuthenticationSpec and namespace. adaptAuthConfig was updated to call the new function with cpContext.HCP.Spec.Configuration.Authentication and cpContext.HCP.Namespace. The validations package now imports controllers/hostedcontrolplane/v2/kas and uses its GenerateAuthConfig and HCPAuthConfigToAPIServerAuthConfig paths. Tests add two OIDC-focused cases exercising CEL claim validation (one valid, one with invalid CEL syntax).

🚥 Pre-merge checks | ✅ 11 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (11 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: switching to v2 authentication validation to enable CEL and expression support, which directly aligns with the changeset's core objective.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Test changes introduce two new test cases with static, deterministic names that are descriptive with no dynamic content and stable across multiple runs.
Test Structure And Quality	✅ Passed	Test follows standard Go testing practices with table-driven patterns, proper feature gate setup, single responsibility per case, and meaningful assertion messages consistent with codebase conventions.
Microshift Test Compatibility	✅ Passed	PR modifications do not add any Ginkgo e2e tests, only standard Go unit tests to authentication_test.go for OIDC validation with CEL expressions.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PR adds only unit tests to authentication_test.go using Go's standard testing package, not Ginkgo e2e tests, so topology check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	PR changes are limited to authentication configuration generation and validation logic with no scheduling constraints introduced.
Ote Binary Stdout Contract	✅ Passed	No process-level code (main, init, TestMain, BeforeSuite) that writes to stdout is introduced. Changes are function refactoring, import updates, and test-contained additions only.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The PR adds unit tests in support/validations/authentication_test.go, not Ginkgo e2e tests. Tests use standard Go testing.T and validate OIDC configuration locally without network requirements.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go (1)

61-71: ⚠️ Potential issue | 🟡 Minor

Handle nil spec in exported GenerateAuthConfig to avoid panic.

spec is dereferenced at Line 70 without a nil check. Since this function is now exported, a nil caller would panic.

Suggested fix

 func GenerateAuthConfig(spec *configv1.AuthenticationSpec, ctx context.Context, c crclient.Reader, namespace string) (*AuthenticationConfiguration, error) {
+	if spec == nil {
+		return nil, fmt.Errorf("authentication spec must not be nil")
+	}
+
 	config := &AuthenticationConfiguration{
 		TypeMeta: metav1.TypeMeta{
 			Kind:       "AuthenticationConfiguration",
 			APIVersion: "apiserver.config.k8s.io/v1alpha1",
 		},
 		JWT: []JWTAuthenticator{},
 	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go` around
lines 61 - 71, GenerateAuthConfig currently dereferences the incoming spec
(spec.OIDCProviders) without a nil check which can panic when called with a nil
spec; add an initial nil guard in GenerateAuthConfig that returns a clear error
(or an empty AuthenticationConfiguration and nil error per project convention)
if spec == nil, then proceed to iterate over spec.OIDCProviders and call
generateJWTForProvider as before; ensure the check is in the exported function
GenerateAuthConfig so callers cannot trigger a nil dereference.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In `@control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go`:
- Around line 61-71: GenerateAuthConfig currently dereferences the incoming spec
(spec.OIDCProviders) without a nil check which can panic when called with a nil
spec; add an initial nil guard in GenerateAuthConfig that returns a clear error
(or an empty AuthenticationConfiguration and nil error per project convention)
if spec == nil, then proceed to iterate over spec.OIDCProviders and call
generateJWTForProvider as before; ensure the check is in the exported function
GenerateAuthConfig so callers cannot trigger a nil dereference.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: b57baf8c-183a-49ef-908f-81ee02324bb1

📥 Commits

Reviewing files that changed from the base of the PR and between 387b8be and 95ea6e1.

📒 Files selected for processing (3)

• control-plane-operator/controllers/hostedcontrolplane/v2/kas/auth.go
• support/validations/authentication.go
• support/validations/authentication_test.go

[cblecker]

/uncc

[everettraven]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

[jparrill]

/jira refresh

[openshift-ci-robot]

@jparrill: This pull request references Jira Issue OCPBUGS-81686, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.0.0) matches configured target version for branch (5.0.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

No GitHub users were found matching the public email listed for the QA contact in Jira (xxia@redhat.com), skipping review request.

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[jparrill]

Dropped some comments. Thanks!

[everettraven]

/lgtm

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aks
/test e2e-aws
/test e2e-aws-upgrade-hypershift-operator
/test e2e-azure-self-managed
/test e2e-kubevirt-aws-ovn-reduced
/test e2e-v2-aws

[ShazaAldawamneh]

/retest-required

[ShazaAldawamneh]

/retest-required

[hypershift-jira-solve-ci]

AI Test Failure Analysis

Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed | Build: 2052772664296083456 | Cost: $4.37084635 | Failed step: hypershift-azure-run-e2e-self-managed

View full analysis report

---

_{Generated by hypershift-analyze-e2e-failure post-step using Claude claude-opus-4-6}

[ShazaAldawamneh]

/retest-required

[hypershift-jira-solve-ci]

Now I have all the evidence needed. Let me produce the final report.

Test Failure Analysis Complete

Job Information

• Prow Job: pull-ci-openshift-hypershift-main-e2e-azure-self-managed
• Build ID: 2053749079334195200
• Target: e2e-azure-self-managed
• PR: OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support. #8246 (OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support)

Test Failure Analysis

Error

step [release:initial] failed: failed to get CLI image: unable to wait for the 'cli'
image in the stable stream to populate: failed to import tag(s) [cli] on image stream
ci-op-y09zt3qs/stable-initial because of missing definition in the spec

Summary

The e2e-azure-self-managed test never started. The job failed during CI infrastructure setup when ci-operator tried to import the OCP 5.0 release payload 5.0.0-0.ci-2026-05-10-181545 as the release:initial imagestream. The release payload does not include a cli image component, so the stable-initial imagestream was created without a cli tag definition. When ci-operator subsequently attempted to wait for cli in stable-initial, it failed with "missing definition in the spec." This is an OCP 5.0 release payload assembly issue, not caused by PR #8246's code changes.

Root Cause

The OCP 5.0 CI release payload 5.0.0-0.ci-2026-05-10-181545 (assembled May 10, 2026) was built without the cli image component. This is a release payload assembly problem in the OCP 5.0 CI stream (5.0.0-0.ci).

How the failure occurs:

1. ci-operator resolves release:initial from the 5.0.0-0.ci stream → registry.ci.openshift.org/ocp/release-5:5.0.0-0.ci-2026-05-10-181545
2. The release payload is imported into the release:initial tag (succeeds in ~10s)
3. The release-images-initial-cli pod runs to extract the CLI binary (succeeds in 5s)
4. ci-operator tries to populate stable-initial imagestream with components from the payload
5. The cli tag is not defined in the payload's image list, so the stable-initial imagestream spec has no definition for cli
6. When ci-operator waits for stable-initial:cli to be importable, it immediately fails: "missing definition in the spec"
7. Since e2e-azure-self-managed depends on [release:initial], the entire job fails without running any test steps

Why this only affects recent runs:

• Runs from before May 10 used earlier 5.0 payloads (e.g., 5.0.0-0.ci-2026-05-08-154316) that included cli → they succeeded
• The May 10 payload (5.0.0-0.ci-2026-05-10-181545) dropped cli → any job picking up this payload fails
• Comparison: release:n1minor (OCP 4.22) and release:n2minor (OCP 4.21) imported successfully because their payloads include cli

Evidence the PR is not at fault: The ocp/5.0 imagestream itself still has cli (line: "Tagging ocp/5.0:cli into pipeline:cli" succeeded), and release:latest (the custom 5.0 release built from the PR) also succeeded. Only the externally-assembled release:initial payload is broken.

Recommendations

1. Retrigger the job — If a new OCP 5.0 CI payload has been published since May 10 that includes cli, retriggering will pick up the fixed payload and the job should proceed past this step.

2. Report to TRT / Release Controller team — The OCP 5.0 CI release payload 5.0.0-0.ci-2026-05-10-181545 is missing the cli image component. This affects all CI jobs that depend on release:initial from the 5.0.0-0.ci stream. File an issue against the release controller or notify the Technical Release Team (TRT).

3. Check if a newer 5.0 payload exists — The release controller API still reports 5.0.0-0.ci-2026-05-10-181545 as the latest. Until a new 5.0 payload that includes cli is assembled, all hypershift jobs using release:initial from the 5.0 stream will continue to fail.

4. This failure is unrelated to PR OCPBUGS-81686: fix(authentication): use v2 auth validation for CEL and expression support. #8246 — No action needed on the PR itself. The authentication/CEL code changes are not involved in the failure path.

Evidence

Evidence	Detail
Failed step	[release:initial] — failed after ~10s at 08:09:10 UTC
Error	failed to import tag(s) [cli] on image stream ci-op-y09zt3qs/stable-initial because of missing definition in the spec
Broken payload	registry.ci.openshift.org/ocp/release-5:5.0.0-0.ci-2026-05-10-181545
Test step status	e2e-azure-self-managed — never started (null start/finish/duration in step graph)
release:latest (custom 5.0)	✅ Succeeded — built from ocp/5.0 imagestream which has cli
release:n1minor (OCP 4.22)	✅ Succeeded — stable-n1minor:cli imported successfully
release:n2minor (OCP 4.21)	✅ Succeeded — stable-n2minor:cli imported successfully
Previous build (May 8)	Build 2052772664296083456 — import succeeded, actual tests ran (different 5.0 payload)
PR 8466 (May 8)	Same job passed with 0 failures using older 5.0 payload
ocp/5.0:cli tag	Exists and resolved to quay-proxy.ci.openshift.org/openshift/ci:ocp_5.0_cli
pipeline:cli	Successfully imported from ocp/5.0:cli

---

[ShazaAldawamneh]

/retest-required

[ShazaAldawamneh]

/verified by @ShazaAldawamneh

[openshift-ci-robot]

@ShazaAldawamneh: This PR has been marked as verified by @ShazaAldawamneh.

Details

In response to this:

/verified by @ShazaAldawamneh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[enxebre]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre, everettraven, ShazaAldawamneh

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [enxebre]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@ShazaAldawamneh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci-robot]

@ShazaAldawamneh: Jira Issue Verification Checks: Jira Issue OCPBUGS-81686
✔️ This pull request was pre-merge verified.
✔️ All associated pull requests have merged.
✔️ All associated, merged pull requests were pre-merge verified.

Jira Issue OCPBUGS-81686 has been moved to the MODIFIED state and will move to the VERIFIED state when the change is available in an accepted nightly payload. 🕓

Details

In response to this:

What this PR does / why we need it:

Fixes OCPBUGS-81686
The validation logic was using v1/kas which doesn't support CEL claim
validation rules or expression-based username mappings. This was causing
errors when users configured ExternalOIDC with these features.
Changes:

• Export GenerateAuthConfig in v2/kas/auth.go to match v1 signature
• Update support/validations/authentication.go to import v2/kas
• Add test case for CEL validation rules and username expressions

Which issue(s) this PR fixes:

Fixes OCPBUGS-81686

Checklist:

• [Y] Subject and description added to both, commit and PR.
• [Y] Relevant issues have been referenced.
• [Y] This change includes unit tests.

Summary by CodeRabbit

• Refactor

• Authentication config generation now builds from the cluster Authentication spec with an explicit namespace; validation flows updated to use the revised generation path for consistency.

• Tests

• OIDC validation tests expanded with feature-gated cases covering CEL-based claim validation and CEL-driven username mapping, including success and syntax-error failure scenarios.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-merge-robot]

Fix included in release 5.0.0-0.nightly-2026-05-12-025124