OCPBUGS-88312: use in-cluster service for oauth-server

control-plane-operator/controllers/hostedcontrolplane/pki/oauth.go

@@ -15,7 +15,7 @@ func ReconcileOAuthServerCert(secret, ca *corev1.Secret, ownerRef config.OwnerRe
 	if oauthIP != nil {
 		ips = append(ips, externalOAuthAddress)
 	} else {
-		dnsNames = append(dnsNames, externalOAuthAddress)
+		dnsNames = append(dnsNames, externalOAuthAddress, "oauth-openshift."+secret.GetNamespace()+".svc.cluster.local")
 	}
 	return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "openshift-oauth", []string{"openshift"}, X509UsageClientServerAuth, dnsNames, ips)
 }

control-plane-operator/controllers/hostedcontrolplane/v2/assets/oauth-openshift/deployment.yaml

@@ -33,8 +33,6 @@ spec:
           value: http://127.0.0.1:8092
         - name: ALL_PROXY
           value: socks5://127.0.0.1:8090
-        - name: NO_PROXY
-          value: kube-apiserver,audit-webhook
         image: oauth-server
         imagePullPolicy: IfNotPresent
         livenessProbe:

control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config.go

@@ -9,6 +9,7 @@ import (
 	"strings"
 
 	hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1"
+	"github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/manifests"
 	"github.com/openshift/hypershift/support/api"
 	"github.com/openshift/hypershift/support/config"
 	component "github.com/openshift/hypershift/support/controlplane-component"
@@ -26,6 +27,7 @@ const (
 	auditPolicyProfileMapKey = "profile"
 
 	defaultAccessTokenMaxAgeSeconds int32 = 86400
+	OAuthServerPort                 int32 = 6443
 )
 
 // ConfigOverride defines the oauth parameters that can be overridden in special use cases. The only supported
@@ -38,6 +40,15 @@ type ConfigOverride struct {
 	Challenge *bool               `json:"challenge,omitempty"`
 }
 
+// getOAuthServiceDNS returns the internal cluster DNS name for the OAuth service
+// in the given namespace.
+func getOAuthServiceDNS(namespace string) string {
+	if namespace == "" {
+		return ""
+	}
+	return manifests.OauthServerService("").Name + "." + namespace + ".svc.cluster.local"
+}
+
 func adaptAuditConfig(cpContext component.WorkloadContext, cm *corev1.ConfigMap) error {
 	auditConfig := cpContext.HCP.Spec.Configuration.GetAuditPolicyConfig()
 	cm.Data[auditPolicyProfileMapKey] = string(auditConfig.Profile)
@@ -76,7 +87,7 @@ func adaptOAuthConfig(cpContext component.WorkloadContext, cfg *osinv1.OsinServe
 		Host:   net.JoinHostPort(cpContext.InfraStatus.OAuthHost, strconv.Itoa(int(cpContext.InfraStatus.OAuthPort))),
 	}).String()
 	controlPlaneEndpoint := cpContext.HCP.Status.ControlPlaneEndpoint
-	cfg.OAuthConfig.MasterURL = masterUrl
+	cfg.OAuthConfig.MasterURL = fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(cpContext.HCP.Namespace), OAuthServerPort)
 	cfg.OAuthConfig.MasterPublicURL = masterUrl
 
 	loginHost := controlPlaneEndpoint.Host

control-plane-operator/controllers/hostedcontrolplane/v2/oauth/config_test.go

@@ -1,6 +1,7 @@
 package oauth
 
 import (
+	"fmt"
 	"testing"
 
 	. "github.com/onsi/gomega"
@@ -10,76 +11,122 @@ import (
 	component "github.com/openshift/hypershift/support/controlplane-component"
 
 	osinv1 "github.com/openshift/api/osin/v1"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+func TestGetOAuthServiceDNS(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name      string
+		namespace string
+		expected  string
+	}{
+		{
+			name:      "When namespace is provided, it should return the correct OAuth service DNS",
+			namespace: "clusters-test-cluster",
+			expected:  "oauth-openshift.clusters-test-cluster.svc.cluster.local",
+		},
+		{
+			name:      "When namespace is empty, it should return empty string",
+			namespace: "",
+			expected:  "",
+		},
+		{
+			name:      "When namespace has special characters, it should include them in the DNS",
+			namespace: "test-ns-123",
+			expected:  "oauth-openshift.test-ns-123.svc.cluster.local",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			g := NewWithT(t)
+			result := getOAuthServiceDNS(tt.namespace)
+			g.Expect(result).To(Equal(tt.expected))
+		})
+	}
+}
+
 func TestAdaptOAuthConfig(t *testing.T) {
+
+	const (
+		testNamespace = "test-cluster"
+	)
 	testCases := []struct {
-		name              string
-		oauthHost         string
-		oauthPort         int32
-		cpEndpointHost    string
-		cpEndpointPort    int32
-		kasDNSName        string
-		loginURLOverride  string
-		expectedLoginURL  string
-		expectedMasterURL string
+		name                    string
+		oauthHost               string
+		oauthPort               int32
+		cpEndpointHost          string
+		cpEndpointPort          int32
+		kasDNSName              string
+		loginURLOverride        string
+		expectedLoginURL        string
+		expectedMasterURL       string
+		expectedMasterPublicURL string
 	}{
 		{
-			name:              "When no custom DNS is set, it should use the control plane endpoint for LoginURL",
-			oauthHost:         "oauth.example.com",
-			oauthPort:         443,
-			cpEndpointHost:    "api.example.com",
-			cpEndpointPort:    6443,
-			expectedLoginURL:  "https://api.example.com:6443",
-			expectedMasterURL: "https://oauth.example.com:443",
+			name:                    "When no custom DNS is set, it should use the control plane endpoint for LoginURL",
+			oauthHost:               "oauth.example.com",
+			oauthPort:               443,
+			cpEndpointHost:          "api.example.com",
+			cpEndpointPort:          6443,
+			expectedLoginURL:        "https://api.example.com:6443",
+			expectedMasterURL:       fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(testNamespace), OAuthServerPort),
+			expectedMasterPublicURL: "https://oauth.example.com:443",
 		},
 		{
-			name:              "When KubeAPIServerDNSName is set, it should use the custom DNS name for LoginURL",
-			oauthHost:         "oauth.example.com",
-			oauthPort:         443,
-			cpEndpointHost:    "10.0.0.1",
-			cpEndpointPort:    6443,
-			kasDNSName:        "api.custom.example.com",
-			expectedLoginURL:  "https://api.custom.example.com:6443",
-			expectedMasterURL: "https://oauth.example.com:443",
+			name:                    "When KubeAPIServerDNSName is set, it should use the custom DNS name for LoginURL",
+			oauthHost:               "oauth.example.com",
+			oauthPort:               443,
+			cpEndpointHost:          "10.0.0.1",
+			cpEndpointPort:          6443,
+			kasDNSName:              "api.custom.example.com",
+			expectedLoginURL:        "https://api.custom.example.com:6443",
+			expectedMasterURL:       fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(testNamespace), OAuthServerPort),
+			expectedMasterPublicURL: "https://oauth.example.com:443",
 		},
 		{
-			name:              "When control plane endpoint is an IP and no custom DNS is set, it should use the IP for LoginURL",
-			oauthHost:         "10.0.0.2",
-			oauthPort:         443,
-			cpEndpointHost:    "10.0.0.1",
-			cpEndpointPort:    6443,
-			expectedLoginURL:  "https://10.0.0.1:6443",
-			expectedMasterURL: "https://10.0.0.2:443",
+			name:                    "When control plane endpoint is an IP and no custom DNS is set, it should use the IP for LoginURL",
+			oauthHost:               "10.0.0.2",
+			oauthPort:               443,
+			cpEndpointHost:          "10.0.0.1",
+			cpEndpointPort:          6443,
+			expectedLoginURL:        "https://10.0.0.1:6443",
+			expectedMasterURL:       fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(testNamespace), OAuthServerPort),
+			expectedMasterPublicURL: "https://10.0.0.2:443",
 		},
 		{
-			name:              "When login URL override annotation is set, it should take precedence over KubeAPIServerDNSName",
-			oauthHost:         "oauth.example.com",
-			oauthPort:         443,
-			cpEndpointHost:    "10.0.0.1",
-			cpEndpointPort:    6443,
-			kasDNSName:        "api.custom.example.com",
-			loginURLOverride:  "https://ibm.override.example.com:6443",
-			expectedLoginURL:  "https://ibm.override.example.com:6443",
-			expectedMasterURL: "https://oauth.example.com:443",
+			name:                    "When login URL override annotation is set, it should take precedence over KubeAPIServerDNSName",
+			oauthHost:               "oauth.example.com",
+			oauthPort:               443,
+			cpEndpointHost:          "10.0.0.1",
+			cpEndpointPort:          6443,
+			kasDNSName:              "api.custom.example.com",
+			loginURLOverride:        "https://ibm.override.example.com:6443",
+			expectedLoginURL:        "https://ibm.override.example.com:6443",
+			expectedMasterURL:       fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(testNamespace), OAuthServerPort),
+			expectedMasterPublicURL: "https://oauth.example.com:443",
 		},
 		{
-			name:              "When control plane endpoint is an IPv6 address, it should bracket it in the LoginURL",
-			oauthHost:         "oauth.example.com",
-			oauthPort:         443,
-			cpEndpointHost:    "2001:db8::1",
-			cpEndpointPort:    6443,
-			expectedLoginURL:  "https://[2001:db8::1]:6443",
-			expectedMasterURL: "https://oauth.example.com:443",
+			name:                    "When control plane endpoint is an IPv6 address, it should bracket it in the LoginURL",
+			oauthHost:               "oauth.example.com",
+			oauthPort:               443,
+			cpEndpointHost:          "2001:db8::1",
+			cpEndpointPort:          6443,
+			expectedLoginURL:        "https://[2001:db8::1]:6443",
+			expectedMasterURL:       fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(testNamespace), OAuthServerPort),
+			expectedMasterPublicURL: "https://oauth.example.com:443",
 		},
 		{
-			name:              "When OAuth host is an IPv6 address, it should bracket it in the MasterURL",
-			oauthHost:         "2001:db8::2",
-			oauthPort:         443,
-			cpEndpointHost:    "api.example.com",
-			cpEndpointPort:    6443,
-			expectedLoginURL:  "https://api.example.com:6443",
-			expectedMasterURL: "https://[2001:db8::2]:443",
+			name:                    "When OAuth host is an IPv6 address, it should bracket it in the MasterURL",
+			oauthHost:               "2001:db8::2",
+			oauthPort:               443,
+			cpEndpointHost:          "api.example.com",
+			cpEndpointPort:          6443,
+			expectedLoginURL:        "https://api.example.com:6443",
+			expectedMasterURL:       fmt.Sprintf("https://%s:%d", getOAuthServiceDNS(testNamespace), OAuthServerPort),
+			expectedMasterPublicURL: "https://[2001:db8::2]:443",
 		},
 	}
 
@@ -88,6 +135,10 @@ func TestAdaptOAuthConfig(t *testing.T) {
 			g := NewWithT(t)
 
 			hcp := &hyperv1.HostedControlPlane{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:      "test-hcp",
+					Namespace: testNamespace,
+				},
 				Spec: hyperv1.HostedControlPlaneSpec{
 					KubeAPIServerDNSName: tc.kasDNSName,
 				},
@@ -119,7 +170,7 @@ func TestAdaptOAuthConfig(t *testing.T) {
 
 			g.Expect(cfg.OAuthConfig.LoginURL).To(Equal(tc.expectedLoginURL))
 			g.Expect(cfg.OAuthConfig.MasterURL).To(Equal(tc.expectedMasterURL))
-			g.Expect(cfg.OAuthConfig.MasterPublicURL).To(Equal(tc.expectedMasterURL))
+			g.Expect(cfg.OAuthConfig.MasterPublicURL).To(Equal(tc.expectedMasterPublicURL))
 		})
 	}
 }