From b0437a655f7b92beb3fce080adf34781ce23750e Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 13 May 2026 13:41:55 +0200 Subject: [PATCH 01/12] feat(api): add new ExternalOIDCExternalClaimsSources feature gate The new feature gate will initially be enabled for TechPreviewNoUpgrade. This feature extends ExternalOIDC with a webhook that enables sourcing claims from external sources. --- .../v1beta1/featuregates/featureGate-Hypershift-Default.yaml | 3 +++ .../featureGate-Hypershift-TechPreviewNoUpgrade.yaml | 3 +++ .../featuregates/featureGate-SelfManagedHA-Default.yaml | 3 +++ .../featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml | 3 +++ .../featuregates/featureGate-Hypershift-Default.yaml | 3 +++ .../featureGate-Hypershift-TechPreviewNoUpgrade.yaml | 3 +++ .../featuregates/featureGate-SelfManagedHA-Default.yaml | 3 +++ .../featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml | 3 +++ control-plane-operator/featuregates/featuregates.go | 3 +++ 9 files changed, 27 insertions(+) diff --git a/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-Default.yaml b/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-Default.yaml index 49e57fef36f1..c7234b54e89e 100644 --- a/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-Default.yaml +++ b/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-Default.yaml @@ -21,6 +21,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "OpenStack" }, diff --git a/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml b/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml index 39a658ee9697..f97b823a0246 100644 --- a/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml +++ b/api/hypershift/v1beta1/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml @@ -40,6 +40,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "GCPPlatform" }, diff --git a/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-Default.yaml b/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-Default.yaml index fd5c9fe89f9d..61b26b420b10 100644 --- a/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-Default.yaml +++ b/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-Default.yaml @@ -18,6 +18,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "AROHCPManagedIdentities" }, diff --git a/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml b/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml index 0de2b3b93ba2..a5dcb7b4640e 100644 --- a/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml +++ b/api/hypershift/v1beta1/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml @@ -40,6 +40,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "GCPPlatform" }, diff --git a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml index 49e57fef36f1..c7234b54e89e 100644 --- a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml +++ b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-Default.yaml @@ -21,6 +21,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "OpenStack" }, diff --git a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml index 39a658ee9697..f97b823a0246 100644 --- a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml +++ b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-Hypershift-TechPreviewNoUpgrade.yaml @@ -40,6 +40,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "GCPPlatform" }, diff --git a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml index fd5c9fe89f9d..61b26b420b10 100644 --- a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml +++ b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-Default.yaml @@ -18,6 +18,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "AROHCPManagedIdentities" }, diff --git a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml index 0de2b3b93ba2..a5dcb7b4640e 100644 --- a/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml +++ b/cmd/install/assets/crds/hypershift-operator/payload-manifests/featuregates/featureGate-SelfManagedHA-TechPreviewNoUpgrade.yaml @@ -40,6 +40,9 @@ { "name": "ExternalOIDCWithUpstreamParity" }, + { + "name": "ExternalOIDCExternalClaimsSourcing" + }, { "name": "GCPPlatform" }, diff --git a/control-plane-operator/featuregates/featuregates.go b/control-plane-operator/featuregates/featuregates.go index 7312da65682c..78739e605294 100644 --- a/control-plane-operator/featuregates/featuregates.go +++ b/control-plane-operator/featuregates/featuregates.go @@ -12,6 +12,7 @@ import ( const ( ExternalOIDCWithUIDAndExtraClaimMappings featuregate.Feature = "ExternalOIDCWithUIDAndExtraClaimMappings" ExternalOIDCWithUpstreamParity featuregate.Feature = "ExternalOIDCWithUpstreamParity" + ExternalOIDCExternalClaimsSourcing featuregate.Feature = "ExternalOIDCExternalClaimsSourcing" ) // Initialize new features here @@ -20,12 +21,14 @@ var ( externalOIDCWithUIDAndExtraClaimMappingsFeature = featuregates.NewFeature(ExternalOIDCWithUIDAndExtraClaimMappings, featuregates.WithEnableForFeatureSets(configv1.TechPreviewNoUpgrade, configv1.Default)) externalOIDCWithUpstreamParityFeature = featuregates.NewFeature(ExternalOIDCWithUpstreamParity, featuregates.WithEnableForFeatureSets(configv1.TechPreviewNoUpgrade)) + externalOIDCExternalClaimsSourcingFeature = featuregates.NewFeature(ExternalOIDCExternalClaimsSourcing, featuregates.WithEnableForFeatureSets(configv1.TechPreviewNoUpgrade)) ) func init() { // Add featuregates here allFeatures.AddFeature(externalOIDCWithUIDAndExtraClaimMappingsFeature) allFeatures.AddFeature(externalOIDCWithUpstreamParityFeature) + allFeatures.AddFeature(externalOIDCExternalClaimsSourcingFeature) // Default to configuring the Default featureset ConfigureFeatureSet(string(configv1.Default)) } From 5f4ed6d92a23d7c43e1b46ae3afdc74bc6abfdfa Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 3 Jun 2026 14:52:46 +0200 Subject: [PATCH 02/12] refactor(cpo): clarify ConfigOAuthEnabled and remove unused helpers Rewrite ConfigOAuthEnabled as an explicit switch on known authentication types instead of a negation check against OIDC. Inline the private oauthEnabled helper into HCPOAuthEnabled and remove unused HCOAuthEnabled. --- support/util/oauth.go | 22 ++++++++-------------- 1 file changed, 8 insertions(+), 14 deletions(-) diff --git a/support/util/oauth.go b/support/util/oauth.go index 89c92724fea6..85dbe3b8f0db 100644 --- a/support/util/oauth.go +++ b/support/util/oauth.go @@ -7,24 +7,18 @@ import ( ) func HCPOAuthEnabled(hcp *hyperv1.HostedControlPlane) bool { - return oauthEnabled(hcp.Spec.Configuration) -} - -func HCOAuthEnabled(hc *hyperv1.HostedCluster) bool { - return oauthEnabled(hc.Spec.Configuration) + return hcp.Spec.Configuration == nil || ConfigOAuthEnabled(hcp.Spec.Configuration.Authentication) } func ConfigOAuthEnabled(authentication *configv1.AuthenticationSpec) bool { - if authentication != nil && - authentication.Type == configv1.AuthenticationTypeOIDC { - return false + if authentication == nil { + return true } - return true -} -func oauthEnabled(config *hyperv1.ClusterConfiguration) bool { - if config != nil { - return ConfigOAuthEnabled(config.Authentication) + switch authentication.Type { + case configv1.AuthenticationTypeIntegratedOAuth, configv1.AuthenticationTypeNone, "": + return true + default: + return false } - return true } From efc37fcb89c061191c33974b94aeb96ab015cc7d Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Thu, 4 Jun 2026 11:52:05 +0200 Subject: [PATCH 03/12] feat(kas): use webhook authenticator when ExternalOIDCExternalClaimsSourcing is enabled When the ExternalOIDCExternalClaimsSourcing feature gate is enabled, configure KAS to always use the webhook token authenticator regardless of authentication type; with that feature, even external OIDC will go via the webhook instead of --authentication-config. --- .../hostedcontrolplane/v2/kas/config.go | 3 +- .../hostedcontrolplane/v2/kas/config_test.go | 112 +++++++++++++++++- 2 files changed, 111 insertions(+), 4 deletions(-) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go index ae643d652411..8d8c301eb2cd 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config.go @@ -14,6 +14,7 @@ import ( "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/cloud/openstack" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/common" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/pki" + "github.com/openshift/hypershift/control-plane-operator/featuregates" "github.com/openshift/hypershift/support/certs" hcpconfig "github.com/openshift/hypershift/support/config" component "github.com/openshift/hypershift/support/controlplane-component" @@ -195,7 +196,7 @@ func generateConfig(p KubeAPIServerConfigParams) (*kcpv1.KubeAPIServerConfig, er args.Set("egress-selector-config-file", cpath(egressSelectorConfigVolumeName, EgressSelectorConfigKey)) args.Set("enable-admission-plugins", enabledAdmissionPlugins(p)...) args.Set("disable-admission-plugins", disabledAdmissionPlugins(p)...) - if util.ConfigOAuthEnabled(p.Authentication) { + if util.ConfigOAuthEnabled(p.Authentication) || featuregates.Gate().Enabled(featuregates.ExternalOIDCExternalClaimsSourcing) { args.Set("authentication-token-webhook-config-file", cpath(authTokenWebhookConfigVolumeName, KubeconfigKey)) args.Set("authentication-token-webhook-version", "v1") } else { diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go index abc7232ea824..c70feeaac4c7 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/config_test.go @@ -7,20 +7,25 @@ import ( kcpv1 "github.com/openshift/api/kubecontrolplane/v1" corev1 "k8s.io/api/core/v1" + "k8s.io/component-base/featuregate" + fgtesting "k8s.io/component-base/featuregate/testing" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" "k8s.io/apimachinery/pkg/runtime" podsecurityadmissionv1 "k8s.io/pod-security-admission/admission/api/v1" + featuregates "github.com/openshift/hypershift/control-plane-operator/featuregates" + "github.com/google/go-cmp/cmp" "github.com/stretchr/testify/require" ) func TestGenerateConfig(t *testing.T) { type testcase struct { - name string - params KubeAPIServerConfigParams - expected *kcpv1.KubeAPIServerConfig + name string + params KubeAPIServerConfigParams + featureGates []featuregate.Feature + expected *kcpv1.KubeAPIServerConfig } testcases := []testcase{ @@ -457,6 +462,104 @@ func TestGenerateConfig(t *testing.T) { }, ), }, + { + name: "with ExternalOIDCExternalClaimsSourcing enabled and auth type OIDC", + featureGates: []featuregate.Feature{ + featuregates.ExternalOIDCExternalClaimsSourcing, + }, + params: KubeAPIServerConfigParams{ + Authentication: &configv1.AuthenticationSpec{ + Type: configv1.AuthenticationTypeOIDC, + OIDCProviders: []configv1.OIDCProvider{ + {}, + }, + }, + }, + expected: modifyKasConfig(defaultKASConfig(), + func(kasc *kcpv1.KubeAPIServerConfig) { + kasc.APIServerArguments["enable-admission-plugins"] = kcpv1.Arguments{ + "CertificateApproval", + "CertificateSigning", + "CertificateSubjectRestriction", + "DefaultIngressClass", + "DefaultStorageClass", + "DefaultTolerationSeconds", + "LimitRanger", + "MutatingAdmissionWebhook", + "NamespaceLifecycle", + "NodeRestriction", + "OwnerReferencesPermissionEnforcement", + "PersistentVolumeClaimResize", + "PodNodeSelector", + "PodTolerationRestriction", + "Priority", + "ResourceQuota", + "RuntimeClass", + "ServiceAccount", + "StorageObjectInUseProtection", + "TaintNodesByCondition", + "ValidatingAdmissionPolicy", + "ValidatingAdmissionWebhook", + "config.openshift.io/DenyDeleteClusterConfiguration", + "config.openshift.io/ValidateAPIServer", + "config.openshift.io/ValidateAuthentication", + "config.openshift.io/ValidateConsole", + "config.openshift.io/ValidateFeatureGate", + "config.openshift.io/ValidateImage", + "config.openshift.io/ValidateOAuth", + "config.openshift.io/ValidateProject", + "config.openshift.io/ValidateScheduler", + "image.openshift.io/ImagePolicy", + "network.openshift.io/ExternalIPRanger", + "network.openshift.io/RestrictedEndpointsAdmission", + "quota.openshift.io/ClusterResourceQuota", + "quota.openshift.io/ValidateClusterResourceQuota", + "route.openshift.io/IngressAdmission", + "scheduling.openshift.io/OriginPodNodeEnvironment", + "security.openshift.io/DefaultSecurityContextConstraints", + "security.openshift.io/SCCExecRestrictions", + "security.openshift.io/SecurityContextConstraint", + "security.openshift.io/ValidateSecurityContextConstraints", + "storage.openshift.io/CSIInlineVolumeSecurity", + } + + kasc.APIServerArguments["disable-admission-plugins"] = kcpv1.Arguments{ + "authorization.openshift.io/RestrictSubjectBindings", + "authorization.openshift.io/ValidateRoleBindingRestriction", + } + + kasc.AuthConfig.OAuthMetadataFile = "" + }, + ), + }, + { + name: "with ExternalOIDCExternalClaimsSourcing enabled and auth type None", + featureGates: []featuregate.Feature{ + featuregates.ExternalOIDCExternalClaimsSourcing, + }, + params: KubeAPIServerConfigParams{ + Authentication: &configv1.AuthenticationSpec{ + Type: configv1.AuthenticationTypeNone, + }, + }, + expected: modifyKasConfig(defaultKASConfig(), + func(kasc *kcpv1.KubeAPIServerConfig) { + kasc.AuthConfig.OAuthMetadataFile = "" + }, + ), + }, + { + name: "with ExternalOIDCExternalClaimsSourcing enabled and auth type IntegratedOAuth", + featureGates: []featuregate.Feature{ + featuregates.ExternalOIDCExternalClaimsSourcing, + }, + params: KubeAPIServerConfigParams{ + Authentication: &configv1.AuthenticationSpec{ + Type: configv1.AuthenticationTypeIntegratedOAuth, + }, + }, + expected: defaultKASConfig(), + }, { name: "with etcd URL", params: KubeAPIServerConfigParams{ @@ -585,6 +688,9 @@ func TestGenerateConfig(t *testing.T) { for _, tc := range testcases { t.Run(tc.name, func(t *testing.T) { + for _, fg := range tc.featureGates { + fgtesting.SetFeatureGateDuringTest(t, featuregates.Gate(), fg, true) + } kasConfig, _ := generateConfig(tc.params) diff := cmp.Diff(tc.expected, kasConfig) From a6cb80aa0cbdb7966a74aad77fa4b711938ef7f2 Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 11:31:27 +0200 Subject: [PATCH 04/12] feat(cpo): add new external-oidc-webhook component for ExternalOIDCExternalClaimsSourcing Introduces a new CPOv2 component that runs the oauth-apiserver in external-oidc mode as a token review webhook, gated behind the ExternalOIDCExternalClaimsSourcing feature gate and OIDC auth type. --- .../external-oidc-webhook/deployment.yaml | 58 +++++++++++++++++++ .../v2/assets/external-oidc-webhook/pdb.yaml | 9 +++ .../assets/external-oidc-webhook/service.yaml | 13 +++++ .../v2/external_oidc_webhook/component.go | 58 +++++++++++++++++++ .../v2/external_oidc_webhook/deployment.go | 27 +++++++++ support/util/oauth.go | 5 ++ 6 files changed, 170 insertions(+) create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/deployment.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/pdb.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/service.yaml create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/deployment.go diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/deployment.yaml new file mode 100644 index 000000000000..a9ac9fb6c48a --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/deployment.yaml @@ -0,0 +1,58 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: external-oidc-webhook +spec: + revisionHistoryLimit: 2 + selector: + matchLabels: + app: external-oidc-webhook + strategy: + rollingUpdate: + maxSurge: 3 + maxUnavailable: 1 + type: RollingUpdate + template: + metadata: + labels: + app: external-oidc-webhook + spec: + containers: + - command: + - /usr/bin/oauth-apiserver + args: + - external-oidc + - --config=/etc/kubernetes/config/auth-config/auth-config.json + - --secure-port=8443 + - --tls-private-key-file=/etc/kubernetes/certs/serving/tls.key + - --tls-cert-file=/etc/kubernetes/certs/serving/tls.crt + - --v=2 + env: + - name: HTTP_PROXY + value: socks5://127.0.0.1:8090 + - name: HTTPS_PROXY + value: socks5://127.0.0.1:8090 + - name: NO_PROXY + value: kube-apiserver + image: oauth-apiserver + imagePullPolicy: IfNotPresent + name: external-oidc-webhook + resources: + requests: + cpu: 150m + memory: 80Mi + volumeMounts: + - mountPath: /etc/kubernetes/certs/serving + name: serving-cert + - mountPath: /etc/kubernetes/config/auth-config + name: auth-config + terminationGracePeriodSeconds: 120 + volumes: + - name: serving-cert + secret: + defaultMode: 416 + secretName: external-oidc-webhook-cert + - name: auth-config + configMap: + name: external-oidc-webhook-auth-config + defaultMode: 420 diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/pdb.yaml b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/pdb.yaml new file mode 100644 index 000000000000..c489a11e1369 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/pdb.yaml @@ -0,0 +1,9 @@ +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: external-oidc-webhook +spec: + minAvailable: 1 + selector: + matchLabels: + app: external-oidc-webhook diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/service.yaml b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/service.yaml new file mode 100644 index 000000000000..dcc3f2b729c0 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/assets/external-oidc-webhook/service.yaml @@ -0,0 +1,13 @@ +apiVersion: v1 +kind: Service +metadata: + name: external-oidc-webhook +spec: + type: ClusterIP + selector: + app: external-oidc-webhook + ports: + - name: https + port: 443 + protocol: TCP + targetPort: 8443 diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go b/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go new file mode 100644 index 000000000000..ea0c9c16ec07 --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go @@ -0,0 +1,58 @@ +package extoidc + +import ( + "github.com/openshift/hypershift/control-plane-operator/featuregates" + component "github.com/openshift/hypershift/support/controlplane-component" + "github.com/openshift/hypershift/support/podspec" + "github.com/openshift/hypershift/support/util" + + "k8s.io/utils/ptr" +) + +const ( + ComponentName = "external-oidc-webhook" +) + +var _ component.ComponentOptions = &externalOIDCWebhook{} + +type externalOIDCWebhook struct { +} + +// IsRequestServing implements [controlplanecomponent.ComponentOptions]. +func (e *externalOIDCWebhook) IsRequestServing() bool { + return false +} + +// MultiZoneSpread implements [controlplanecomponent.ComponentOptions]. +func (e *externalOIDCWebhook) MultiZoneSpread() bool { + return true +} + +// NeedsManagementKASAccess implements [controlplanecomponent.ComponentOptions]. +func (e *externalOIDCWebhook) NeedsManagementKASAccess() bool { + return false +} + +func NewComponent() component.ControlPlaneComponent { + return component.NewDeploymentComponent(ComponentName, &externalOIDCWebhook{}). + WithAdaptFunction(adaptDeployment). + WithPredicate(predicate). + WithManifestAdapter( + "pdb.yaml", + component.AdaptPodDisruptionBudget(), + ). + InjectAvailabilityProberContainer(podspec.AvailabilityProberOpts{}). + InjectKonnectivityContainer(component.KonnectivityContainerOptions{ + Mode: component.Socks5, + Socks5Options: component.Socks5Options{ + ResolveFromGuestClusterDNS: ptr.To(true), + }, + }). + Build() +} + +func predicate(cpContext component.WorkloadContext) (bool, error) { + return util.HCPExternalOIDCEnabled(cpContext.HCP) && + featuregates.Gate().Enabled(featuregates.ExternalOIDCExternalClaimsSourcing), nil + +} diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/deployment.go new file mode 100644 index 000000000000..5f9c9f141a2a --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/deployment.go @@ -0,0 +1,27 @@ +package extoidc + +import ( + "fmt" + "strings" + + "github.com/openshift/hypershift/support/config" + component "github.com/openshift/hypershift/support/controlplane-component" + "github.com/openshift/hypershift/support/podspec" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" +) + +func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Deployment) error { + configuration := cpContext.HCP.Spec.Configuration + + podspec.UpdateContainer(ComponentName, deployment.Spec.Template.Spec.Containers, func(c *corev1.Container) { + c.Args = append(c.Args, fmt.Sprintf("--tls-min-version=%s", config.MinTLSVersion(configuration.GetTLSSecurityProfile()))) + + if cipherSuites := config.CipherSuites(configuration.GetTLSSecurityProfile()); len(cipherSuites) != 0 { + c.Args = append(c.Args, fmt.Sprintf("--tls-cipher-suites=%s", strings.Join(cipherSuites, ","))) + } + }) + + return nil +} diff --git a/support/util/oauth.go b/support/util/oauth.go index 85dbe3b8f0db..67cf12d14721 100644 --- a/support/util/oauth.go +++ b/support/util/oauth.go @@ -10,6 +10,11 @@ func HCPOAuthEnabled(hcp *hyperv1.HostedControlPlane) bool { return hcp.Spec.Configuration == nil || ConfigOAuthEnabled(hcp.Spec.Configuration.Authentication) } +func HCPExternalOIDCEnabled(hcp *hyperv1.HostedControlPlane) bool { + config := hcp.Spec.Configuration + return config != nil && config.Authentication != nil && config.Authentication.Type == configv1.AuthenticationTypeOIDC +} + func ConfigOAuthEnabled(authentication *configv1.AuthenticationSpec) bool { if authentication == nil { return true From c3ce080e893dd0ab65f9efcb3283eee750d6751c Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 10:33:31 +0200 Subject: [PATCH 05/12] feat(kas): resolve token review URL based on ExternalOIDCExternalClaimsSourcing gate When the feature gate is enabled and auth type is OIDC, the KAS webhook config points at the external-oidc-webhook service instead of openshift-oauth-apiserver. --- .../controllers/hostedcontrolplane/v2/kas/oauth.go | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/oauth.go b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/oauth.go index 4372e294eb6a..d8280e87f4d9 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/kas/oauth.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/kas/oauth.go @@ -4,9 +4,12 @@ import ( "encoding/json" "fmt" + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/manifests" + "github.com/openshift/hypershift/control-plane-operator/featuregates" "github.com/openshift/hypershift/support/certs" component "github.com/openshift/hypershift/support/controlplane-component" + "github.com/openshift/hypershift/support/util" corev1 "k8s.io/api/core/v1" clientcmd "k8s.io/client-go/tools/clientcmd" @@ -73,7 +76,7 @@ func adaptAuthenticationTokenWebhookConfigSecret(cpContext component.WorkloadCon if key, ok = authenticatorCertSecret.Data[corev1.TLSPrivateKeyKey]; !ok { return fmt.Errorf("expected %s key in authenticator secret", corev1.TLSPrivateKeyKey) } - url := fmt.Sprintf("https://openshift-oauth-apiserver.%s.svc:443/apis/oauth.openshift.io/v1/tokenreviews", secret.GetNamespace()) + url := tokenReviewURL(cpContext.HCP, secret.GetNamespace()) kubeConfigBytes, err := generateAuthenticationTokenWebhookConfig(url, crt, key, ca) if err != nil { return err @@ -82,6 +85,14 @@ func adaptAuthenticationTokenWebhookConfigSecret(cpContext component.WorkloadCon return nil } +func tokenReviewURL(hcp *hyperv1.HostedControlPlane, namespace string) string { + serviceName := "openshift-oauth-apiserver" + if util.HCPExternalOIDCEnabled(hcp) && featuregates.Gate().Enabled(featuregates.ExternalOIDCExternalClaimsSourcing) { + serviceName = "external-oidc-webhook" + } + return fmt.Sprintf("https://%s.%s.svc:443/apis/oauth.openshift.io/v1/tokenreviews", serviceName, namespace) +} + func generateAuthenticationTokenWebhookConfig(url string, crtBytes, keyBytes, caBytes []byte) ([]byte, error) { kubeCfg := clientcmdapi.Config{ Kind: "Config", From 84b0b859b378110db751bd3c45d96bdc8012a7c5 Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 10:42:32 +0200 Subject: [PATCH 06/12] feat(cpo): add PKI and registration for external-oidc-webhook component Add serving cert generation with SANs matching the new Service DNS name, and register the component in the HCP controller. --- .../hostedcontrolplane_controller.go | 10 ++++++++++ .../controllers/hostedcontrolplane/manifests/pki.go | 4 ++++ .../controllers/hostedcontrolplane/pki/openshift.go | 11 +++++++++++ 3 files changed, 25 insertions(+) diff --git a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go index 629ab0e2b606..2add552c6dff 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go +++ b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go @@ -18,6 +18,7 @@ import ( hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" awsutil "github.com/openshift/hypershift/cmd/infra/aws/util" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/common" + "github.com/openshift/hypershift/control-plane-operator/featuregates" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/ignition" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/imageprovider" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/infra" @@ -1425,6 +1426,15 @@ func (r *HostedControlPlaneReconciler) reconcileOpenshiftCerts(ctx context.Conte } } + if util.HCPExternalOIDCEnabled(hcp) && featuregates.Gate().Enabled(featuregates.ExternalOIDCExternalClaimsSourcing) { + externalOIDCWebhookCertSecret := manifests.ExternalOIDCWebhookCertSecret(hcp.Namespace) + if _, err := createOrUpdate(ctx, r, externalOIDCWebhookCertSecret, func() error { + return pki.ReconcileExternalOIDCWebhookCertSecret(externalOIDCWebhookCertSecret, rootCASecret, p.OwnerRef) + }); err != nil { + return fmt.Errorf("failed to reconcile external oidc webhook cert: %w", err) + } + } + openshiftControllerManagerCertSecret := manifests.OpenShiftControllerManagerCertSecret(hcp.Namespace) if _, err := createOrUpdate(ctx, r, openshiftControllerManagerCertSecret, func() error { return pki.ReconcileOpenShiftControllerManagerCertSecret(openshiftControllerManagerCertSecret, rootCASecret, p.OwnerRef) diff --git a/control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go b/control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go index b62830610394..1c5f4f33823a 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go +++ b/control-plane-operator/controllers/hostedcontrolplane/manifests/pki.go @@ -282,6 +282,10 @@ func OpenShiftOAuthAPIServerCertSecret(ns string) *corev1.Secret { return secretFor(ns, "openshift-oauth-apiserver-cert") } +func ExternalOIDCWebhookCertSecret(ns string) *corev1.Secret { + return secretFor(ns, "external-oidc-webhook-cert") +} + func OpenshiftAuthenticatorCertSecret(ns string) *corev1.Secret { return secretFor(ns, "openshift-authenticator-cert") } diff --git a/control-plane-operator/controllers/hostedcontrolplane/pki/openshift.go b/control-plane-operator/controllers/hostedcontrolplane/pki/openshift.go index 0bdcfac04c6e..9d6c4c96f026 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/pki/openshift.go +++ b/control-plane-operator/controllers/hostedcontrolplane/pki/openshift.go @@ -30,6 +30,17 @@ func ReconcileOpenShiftOAuthAPIServerCertSecret(secret, ca *corev1.Secret, owner return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "openshift-oauth-apiserver", []string{"openshift"}, X509UsageClientServerAuth, dnsNames, nil) } +func ReconcileExternalOIDCWebhookCertSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error { + dnsNames := []string{ + "external-oidc-webhook", + fmt.Sprintf("external-oidc-webhook.%s.svc", secret.Namespace), + fmt.Sprintf("external-oidc-webhook.%s.svc.cluster.local", secret.Namespace), + "external-oidc-webhook.default.svc", + "external-oidc-webhook.default.svc.cluster.local", + } + return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "external-oidc-webhook", []string{"openshift"}, X509UsageClientServerAuth, dnsNames, nil) +} + func ReconcileOpenShiftAuthenticatorCertSecret(secret, ca *corev1.Secret, ownerRef config.OwnerRef) error { return reconcileSignedCertWithAddresses(secret, ca, ownerRef, "system:serviceaccount:openshift-oauth-apiserver:openshift-authenticator", []string{"openshift"}, X509UsageClientAuth, nil, nil) } From d0f7d5eb093385a1bd125270b3e1d66c1cd855a8 Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 10:43:50 +0200 Subject: [PATCH 07/12] feat(cpo): register external-oidc-webhook component --- .../hostedcontrolplane/hostedcontrolplane_controller.go | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go index 2add552c6dff..8b2142fce430 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go +++ b/control-plane-operator/controllers/hostedcontrolplane/hostedcontrolplane_controller.go @@ -18,7 +18,6 @@ import ( hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" awsutil "github.com/openshift/hypershift/cmd/infra/aws/util" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/common" - "github.com/openshift/hypershift/control-plane-operator/featuregates" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/ignition" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/imageprovider" "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/infra" @@ -45,6 +44,7 @@ import ( dnsoperatorv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/dnsoperator" endpointresolverv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/endpoint_resolver" etcdv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/etcd" + extoidcv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook" fgv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/fg" ignitionserverv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/ignitionserver" ignitionproxyv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/ignitionserver_proxy" @@ -68,6 +68,7 @@ import ( routerutil "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/router/util" snapshotcontrollerv2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/snapshotcontroller" storagev2 "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/storage" + "github.com/openshift/hypershift/control-plane-operator/featuregates" pkimanifests "github.com/openshift/hypershift/control-plane-pki-operator/manifests" ignitionmanifests "github.com/openshift/hypershift/hypershift-operator/controllers/manifests/ignitionserver" "github.com/openshift/hypershift/support/awsapi" @@ -246,6 +247,7 @@ func (r *HostedControlPlaneReconciler) registerComponents(hcp *hyperv1.HostedCon kcmv2.NewComponent(), schedulerv2.NewComponent(), oapiv2.NewComponent(), + extoidcv2.NewComponent(), routerv2.NewComponent(), oauthapiv2.NewComponent(), autoscalerv2.NewComponent(), From 1fe150bbd3c9dd5dac405888dbd971bfc911dd69 Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 11:29:15 +0200 Subject: [PATCH 08/12] =?UTF-8?q?test(cpo):=20add=20cross-component=20pred?= =?UTF-8?q?icate=20test=20for=20auth=20type=20=C3=97=20feature=20gate=20ma?= =?UTF-8?q?trix?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Export predicates from oauth-apiserver and external-oidc-webhook components to enable a cross-package test that verifies mutual exclusion across all auth type and gate combinations. --- .../v2/auth_predicates_test.go | 102 ++++++++++++++++++ .../v2/external_oidc_webhook/component.go | 4 +- .../v2/oauth_apiserver/component.go | 4 +- .../v2/oauth_apiserver/component_test.go | 2 +- 4 files changed, 107 insertions(+), 5 deletions(-) create mode 100644 control-plane-operator/controllers/hostedcontrolplane/v2/auth_predicates_test.go diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/auth_predicates_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/auth_predicates_test.go new file mode 100644 index 000000000000..928a5142c6cc --- /dev/null +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/auth_predicates_test.go @@ -0,0 +1,102 @@ +package v2_test + +import ( + "testing" + + . "github.com/onsi/gomega" + + configv1 "github.com/openshift/api/config/v1" + + hyperv1 "github.com/openshift/hypershift/api/hypershift/v1beta1" + extoidc "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook" + oapi "github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver" + "github.com/openshift/hypershift/control-plane-operator/featuregates" + component "github.com/openshift/hypershift/support/controlplane-component" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/component-base/featuregate" + fgtesting "k8s.io/component-base/featuregate/testing" +) + +func TestAuthComponentPredicates(t *testing.T) { + testCases := []struct { + name string + authType configv1.AuthenticationType + featureGates []featuregate.Feature + expectOAuthAPI bool + expectExtOIDCWebhook bool + }{ + { + name: "When auth type is empty and gate is off, it should enable oauth-apiserver only", + authType: "", + expectOAuthAPI: true, + expectExtOIDCWebhook: false, + }, + { + name: "When auth type is empty and gate is on, it should enable oauth-apiserver only", + authType: "", + featureGates: []featuregate.Feature{featuregates.ExternalOIDCExternalClaimsSourcing}, + expectOAuthAPI: true, + expectExtOIDCWebhook: false, + }, + { + name: "When auth type is IntegratedOAuth and gate is off, it should enable oauth-apiserver only", + authType: configv1.AuthenticationTypeIntegratedOAuth, + expectOAuthAPI: true, + expectExtOIDCWebhook: false, + }, + { + name: "When auth type is IntegratedOAuth and gate is on, it should enable oauth-apiserver only", + authType: configv1.AuthenticationTypeIntegratedOAuth, + featureGates: []featuregate.Feature{featuregates.ExternalOIDCExternalClaimsSourcing}, + expectOAuthAPI: true, + expectExtOIDCWebhook: false, + }, + { + name: "When auth type is OIDC and gate is off, it should disable both", + authType: configv1.AuthenticationTypeOIDC, + expectOAuthAPI: false, + expectExtOIDCWebhook: false, + }, + { + name: "When auth type is OIDC and gate is on, it should enable external-oidc-webhook only", + authType: configv1.AuthenticationTypeOIDC, + featureGates: []featuregate.Feature{featuregates.ExternalOIDCExternalClaimsSourcing}, + expectOAuthAPI: false, + expectExtOIDCWebhook: true, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + g := NewWithT(t) + + for _, fg := range tc.featureGates { + fgtesting.SetFeatureGateDuringTest(t, featuregates.Gate(), fg, true) + } + + cpContext := component.WorkloadContext{HCP: hcpWithAuthType(tc.authType)} + + oauthResult, err := oapi.Predicate(cpContext) + g.Expect(err).ToNot(HaveOccurred()) + g.Expect(oauthResult).To(Equal(tc.expectOAuthAPI)) + + extOIDCResult, err := extoidc.Predicate(cpContext) + g.Expect(err).ToNot(HaveOccurred()) + g.Expect(extOIDCResult).To(Equal(tc.expectExtOIDCWebhook)) + }) + } +} + +func hcpWithAuthType(authType configv1.AuthenticationType) *hyperv1.HostedControlPlane { + return &hyperv1.HostedControlPlane{ + ObjectMeta: metav1.ObjectMeta{Name: "test", Namespace: "test-ns"}, + Spec: hyperv1.HostedControlPlaneSpec{ + Configuration: &hyperv1.ClusterConfiguration{ + Authentication: &configv1.AuthenticationSpec{ + Type: authType, + }, + }, + }, + } +} diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go b/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go index ea0c9c16ec07..55814471c0f4 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/external_oidc_webhook/component.go @@ -36,7 +36,7 @@ func (e *externalOIDCWebhook) NeedsManagementKASAccess() bool { func NewComponent() component.ControlPlaneComponent { return component.NewDeploymentComponent(ComponentName, &externalOIDCWebhook{}). WithAdaptFunction(adaptDeployment). - WithPredicate(predicate). + WithPredicate(Predicate). WithManifestAdapter( "pdb.yaml", component.AdaptPodDisruptionBudget(), @@ -51,7 +51,7 @@ func NewComponent() component.ControlPlaneComponent { Build() } -func predicate(cpContext component.WorkloadContext) (bool, error) { +func Predicate(cpContext component.WorkloadContext) (bool, error) { return util.HCPExternalOIDCEnabled(cpContext.HCP) && featuregates.Gate().Enabled(featuregates.ExternalOIDCExternalClaimsSourcing), nil diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component.go b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component.go index 1a59b3e6d256..8f6196f02fc5 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component.go @@ -37,7 +37,7 @@ func (k *openshiftOAuthAPIServer) NeedsManagementKASAccess() bool { func NewComponent() component.ControlPlaneComponent { return component.NewDeploymentComponent(ComponentName, &openshiftOAuthAPIServer{}). WithAdaptFunction(adaptDeployment). - WithPredicate(predicate). + WithPredicate(Predicate). WithManifestAdapter( "audit-config.yaml", component.WithAdaptFunction(kasv2.AdaptAuditConfig), @@ -57,6 +57,6 @@ func NewComponent() component.ControlPlaneComponent { Build() } -func predicate(cpContext component.WorkloadContext) (bool, error) { +func Predicate(cpContext component.WorkloadContext) (bool, error) { return util.HCPOAuthEnabled(cpContext.HCP), nil } diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component_test.go b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component_test.go index 276036d25ee0..841fecfcef97 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component_test.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/oauth_apiserver/component_test.go @@ -129,7 +129,7 @@ func TestPredicate(t *testing.T) { HCP: tc.hcp, } - result, err := predicate(cpContext) + result, err := Predicate(cpContext) g.Expect(err).ToNot(HaveOccurred()) g.Expect(result).To(Equal(tc.expectedValue)) }) From 90f828c510eb149aff4ca60fae936f1b12b89772 Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 13:41:34 +0200 Subject: [PATCH 09/12] chore(deps): pull in required type from oauth-apiserver --- go.mod | 3 +- go.sum | 6 +- .../openshift/oauth-apiserver/LICENSE | 201 ++++++ .../externaloidc/apis/authentication/doc.go | 5 + .../apis/authentication/register.go | 36 ++ .../externaloidc/apis/authentication/types.go | 555 +++++++++++++++++ .../apis/authentication/v1alpha1/doc.go | 6 + .../apis/authentication/v1alpha1/register.go | 40 ++ .../apis/authentication/v1alpha1/types.go | 552 +++++++++++++++++ .../v1alpha1/zz_generated.conversion.go | 576 ++++++++++++++++++ .../v1alpha1/zz_generated.deepcopy.go | 406 ++++++++++++ .../authentication/zz_generated.deepcopy.go | 406 ++++++++++++ vendor/modules.txt | 6 +- 13 files changed, 2794 insertions(+), 4 deletions(-) create mode 100644 vendor/github.com/openshift/oauth-apiserver/LICENSE create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/doc.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/register.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/types.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/doc.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/register.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/types.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.conversion.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.deepcopy.go create mode 100644 vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/zz_generated.deepcopy.go diff --git a/go.mod b/go.mod index 127c298500e1..4276951eb60f 100644 --- a/go.mod +++ b/go.mod @@ -69,8 +69,9 @@ require ( github.com/openshift/cluster-node-tuning-operator v0.0.0-20250225115807-f166846b7256 github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87 github.com/openshift/hypershift/api v0.0.0-20240604072534-cd2d5291e2b7 - github.com/openshift/library-go v0.0.0-20251204132909-8814e976a023 + github.com/openshift/library-go v0.0.0-20260309173530-9ed71ac3148f github.com/openshift/multi-operator-manager v0.0.0-20260112172834-b64ebc8c627b + github.com/openshift/oauth-apiserver v0.0.0-20260626184649-9e9722dd2f3f github.com/operator-framework/api v0.37.0 github.com/pkg/errors v0.9.1 github.com/ppc64le-cloud/powervs-utils v0.0.0-20250403153021-219b161805db diff --git a/go.sum b/go.sum index d6e83718c4e2..9b3948ba0add 100644 --- a/go.sum +++ b/go.sum @@ -621,10 +621,12 @@ github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87 github.com/openshift/custom-resource-status v1.1.3-0.20220503160415-f2fdb4999d87/go.mod h1:DB/Mf2oTeiAmVVX1gN+NEqweonAPY0TKUwADizj8+ZA= github.com/openshift/kubernetes-sigs-karpenter v0.0.0-20260310165629-67e201b559d5 h1:vkWMN8h47VGeqtES4jvRDfWWDqPIGTMtm2ltcg8GcuA= github.com/openshift/kubernetes-sigs-karpenter v0.0.0-20260310165629-67e201b559d5/go.mod h1:qQOhEoIl4nqo6vkGhEw95tzcXou5Osjn/mvLzIVFw5A= -github.com/openshift/library-go v0.0.0-20251204132909-8814e976a023 h1:N3lDu1F0sA9Equpje5Cuvs0it0L6Ef6Mmcv9eoh8jtE= -github.com/openshift/library-go v0.0.0-20251204132909-8814e976a023/go.mod h1:ErDfiIrPHH+menTP/B4LKd0nxFDdvCbTamAc6SWMIh8= +github.com/openshift/library-go v0.0.0-20260309173530-9ed71ac3148f h1:4nMvQlqotxtqJo4noee7Jr9AKpJZEG7fu26IJFKX5/c= +github.com/openshift/library-go v0.0.0-20260309173530-9ed71ac3148f/go.mod h1:rYGQrSg+t1JEzeEwg6BJw3loPpXg/n3kgRygUpgxavY= github.com/openshift/multi-operator-manager v0.0.0-20260112172834-b64ebc8c627b h1:KT/Lnx+xlPZ4cN9z58KGjTShfnr9FqRpXm1etTv158Q= github.com/openshift/multi-operator-manager v0.0.0-20260112172834-b64ebc8c627b/go.mod h1:I/ZGCCccD9fBEOFGEp8mfOtq5h4o2lbCC2KWxOstMHM= +github.com/openshift/oauth-apiserver v0.0.0-20260626184649-9e9722dd2f3f h1:gcSl360G94P6h06CWNeERwY+TBIaZxurQ7mXXzh//aw= +github.com/openshift/oauth-apiserver v0.0.0-20260626184649-9e9722dd2f3f/go.mod h1:qPt46oOj0jFGgpabBjMazsgQXwrJ7KYBDwAuaesJLdE= github.com/opentracing/opentracing-go v1.2.0 h1:uEJPy/1a5RIPAJ0Ov+OIO8OxWu77jEv+1B0VhjKrZUs= github.com/opentracing/opentracing-go v1.2.0/go.mod h1:GxEUsuufX4nBwe+T+Wl9TAgYrxe9dPLANfrWvHYVTgc= github.com/operator-framework/api v0.37.0 h1:2XCMWitBnumtJTqzip6LQKUwpM2pXVlt3gkpdlkbaCE= diff --git a/vendor/github.com/openshift/oauth-apiserver/LICENSE b/vendor/github.com/openshift/oauth-apiserver/LICENSE new file mode 100644 index 000000000000..261eeb9e9f8b --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright [yyyy] [name of copyright owner] + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/doc.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/doc.go new file mode 100644 index 000000000000..c174f5b5750e --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/doc.go @@ -0,0 +1,5 @@ +// +k8s:deepcopy-gen=package,register + +// +groupName=authentication.openshift.io +// Package authentication is the internal version of the API. +package authentication diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/register.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/register.go new file mode 100644 index 000000000000..56421c7a2379 --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/register.go @@ -0,0 +1,36 @@ +package authentication + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" +) + +const ( + GroupName = "authentication.openshift.io" +) + +var ( + schemeBuilder = runtime.NewSchemeBuilder( + addKnownTypes, + ) + Install = schemeBuilder.AddToScheme + + // DEPRECATED kept for generated code + SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal} + // DEPRECATED kept for generated code + AddToScheme = schemeBuilder.AddToScheme +) + +// Resource kept for generated code +// DEPRECATED +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} + +// Adds the list of known types to api.Scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &AuthenticationConfiguration{}, + ) + return nil +} diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/types.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/types.go new file mode 100644 index 000000000000..43ea0cffe307 --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/types.go @@ -0,0 +1,555 @@ +package authentication + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +/* + +The types in this file are heavily inspired by the existing +Kubernetes AuthenticationConfiguration type found at +https://github.com/kubernetes/kubernetes/blob/b2f73c0d6b427e2ab5ba225375aaefc0b9bc45b2/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go#L56 + +The API surface here intentionally aligns with this API because it is meant +to be a wrapper around that API with some customization to support unique +functionality that OpenShift needs. + +*/ + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +type AuthenticationConfiguration struct { + metav1.TypeMeta + + // jwt is a list of authenticator to authenticate Kubernetes users using + // JWT compliant tokens. The authenticator will attempt to parse a raw ID token, + // verify it's been signed by the configured issuer. The public key to verify the + // signature is discovered from the issuer's public endpoint using OIDC discovery. + // For an incoming token, each JWT authenticator will be attempted in + // the order in which it is specified in this list. Note however that + // other authenticators may run before or after the JWT authenticators. + // The specific position of JWT authenticators in relation to other + // authenticators is neither defined nor stable across releases. Since + // each JWT authenticator must have a unique issuer URL, at most one + // JWT authenticator will attempt to cryptographically validate the token. + // + // The minimum valid JWT payload must contain the following claims: + // { + // "iss": "https://issuer.example.com", + // "aud": ["audience"], + // "exp": 1234567890, + // "": "username" + // } + JWT []JWTAuthenticator +} + +type JWTAuthenticator struct { + // issuer contains the basic OIDC provider connection options. + // +required + Issuer *Issuer + + // claimValidationRules are rules that are applied to validate token claims to authenticate users. + // +optional + ClaimValidationRules []ClaimValidationRule + + // claimMappings points claims of a token to be treated as user attributes. + // +required + ClaimMappings *ClaimMappings + + // userValidationRules are rules that are applied to final user before completing authentication. + // These allow invariants to be applied to incoming identities such as preventing the + // use of the system: prefix that is commonly used by Kubernetes components. + // The validation rules are logically ANDed together and must all return true for the validation to pass. + // +optional + UserValidationRules []UserValidationRule + + // externalClaimSources is an optional field that can be used to configure + // sources, external to the token provided in a request, in which claims + // should be fetched from and made available to the claim mapping process + // that is used to build the identity of a token holder. + // For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint. + // externalClaimSources must not exceed 5 entries. + // +optional + ExternalClaimsSources []ExternalClaimsSource +} + +// Issuer provides the configuration for an external provider's specific settings. +type Issuer struct { + // url points to the issuer URL in a format https://url or https://url/path. + // This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. + // Same value as the --oidc-issuer-url flag. + // Discovery information is fetched from "{url}/.well-known/openid-configuration" unless overridden by discoveryURL. + // Required to be unique across all JWT authenticators. + // Note that egress selection configuration is not used for this network connection. + // +required + URL string + + // discoveryURL, if specified, overrides the URL used to fetch discovery + // information instead of using "{url}/.well-known/openid-configuration". + // The exact value specified is used, so "/.well-known/openid-configuration" + // must be included in discoveryURL if needed. + // + // The "issuer" field in the fetched discovery information must match the "issuer.url" field + // in the AuthenticationConfiguration and will be used to validate the "iss" claim in the presented JWT. + // This is for scenarios where the well-known and jwks endpoints are hosted at a different + // location than the issuer (such as locally in the cluster). + // + // Example: + // A discovery url that is exposed using kubernetes service 'oidc' in namespace 'oidc-namespace' + // and discovery information is available at '/.well-known/openid-configuration'. + // discoveryURL: "https://oidc.oidc-namespace/.well-known/openid-configuration" + // certificateAuthority is used to verify the TLS connection and the hostname on the leaf certificate + // must be set to 'oidc.oidc-namespace'. + // + // curl https://oidc.oidc-namespace/.well-known/openid-configuration (.discoveryURL field) + // { + // issuer: "https://oidc.example.com" (.url field) + // } + // + // discoveryURL must be different from url. + // Required to be unique across all JWT authenticators. + // Note that egress selection configuration is not used for this network connection. + // +optional + DiscoveryURL string + + // certificateAuthority contains PEM-encoded certificate authority certificates + // used to validate the connection when fetching discovery information. + // If unset, the system verifier is used. + // Same value as the content of the file referenced by the --oidc-ca-file flag. + // +optional + CertificateAuthority string + + // audiences is the set of acceptable audiences the JWT must be issued to. + // At least one of the entries must match the "aud" claim in presented JWTs. + // Same value as the --oidc-client-id flag (though this field supports an array). + // Required to be non-empty. + // +required + Audiences []string + + // audienceMatchPolicy defines how the "audiences" field is used to match the "aud" claim in the presented JWT. + // Allowed values are: + // 1. "MatchAny" when multiple audiences are specified and + // 2. empty (or unset) or "MatchAny" when a single audience is specified. + // + // - MatchAny: the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field. + // For example, if "audiences" is ["foo", "bar"], the "aud" claim in the presented JWT must contain either "foo" or "bar" (and may contain both). + // + // - "": The match policy can be empty (or unset) when a single audience is specified in the "audiences" field. The "aud" claim in the presented JWT must contain the single audience (and may contain others). + // + // For more nuanced audience validation, use claimValidationRules. + // example: claimValidationRule[].expression: 'sets.equivalent(claims.aud, ["bar", "foo", "baz"])' to require an exact match. + // +optional + AudienceMatchPolicy AudienceMatchPolicyType +} + +// AudienceMatchPolicyType is a set of valid values for issuer.audienceMatchPolicy +type AudienceMatchPolicyType string + +// Valid types for AudienceMatchPolicyType +const ( + // MatchAny means the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field. + AudienceMatchPolicyMatchAny AudienceMatchPolicyType = "MatchAny" +) + +// ClaimValidationRule provides the configuration for a single claim validation rule. +type ClaimValidationRule struct { + // claim is the name of a required claim. + // Same as --oidc-required-claim flag. + // Only string claim keys are supported. + // Mutually exclusive with expression and message. + // +optional + Claim string + // requiredValue is the value of a required claim. + // Same as --oidc-required-claim flag. + // Only string claim values are supported. + // If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string. + // Mutually exclusive with expression and message. + // +optional + RequiredValue string + + // expression represents the expression which will be evaluated by CEL. + // Must produce a boolean. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // Must return true for the validation to pass. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim and requiredValue. + // +optional + Expression string + // message customizes the returned error message when expression returns false. + // message is a literal string. + // Mutually exclusive with claim and requiredValue. + // +optional + Message string +} + +// ClaimMappings provides the configuration for claim mapping +type ClaimMappings struct { + // username represents an option for the username attribute. + // The claim's value must be a singular string. + // Same as the --oidc-username-claim and --oidc-username-prefix flags. + // If username.expression is set, the expression must produce a string value. + // If username.expression uses 'claims.email', then 'claims.email_verified' must be used in + // username.expression or extra[*].valueExpression or claimValidationRules[*].expression. + // An example claim validation rule expression that matches the validation automatically + // applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing + // the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified + // claim will be caught at runtime. + // + // In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set, + // the default value is "sub". For the authentication config, there is no defaulting for claim or prefix. The claim and prefix must be set explicitly. + // For claim, if --oidc-username-claim was not set with legacy flag approach, configure username.claim="sub" in the authentication config. + // For prefix: + // (1) --oidc-username-prefix="-", no prefix was added to the username. For the same behavior using authentication config, + // set username.prefix="" + // (2) --oidc-username-prefix="" and --oidc-username-claim != "email", prefix was "#". For the same + // behavior using authentication config, set username.prefix="#" + // (3) --oidc-username-prefix="". For the same behavior using authentication config, set username.prefix="" + // +required + Username PrefixedClaimOrExpression + // groups represents an option for the groups attribute. + // The claim's value must be a string or string array claim. + // If groups.claim is set, the prefix must be specified (and can be the empty string). + // If groups.expression is set, the expression must produce a string or string array value. + // "", [], and null values are treated as the group mapping not being present. + // +optional + Groups PrefixedClaimOrExpression + + // uid represents an option for the uid attribute. + // Claim must be a singular string claim. + // If uid.expression is set, the expression must produce a string value. + // +optional + UID ClaimOrExpression + + // extra represents an option for the extra attribute. + // expression must produce a string or string array value. + // If the value is empty, the extra mapping will not be present. + // + // hard-coded extra key/value + // - key: "foo" + // valueExpression: "'bar'" + // This will result in an extra attribute - foo: ["bar"] + // + // hard-coded key, value copying claim value + // - key: "foo" + // valueExpression: "claims.some_claim" + // This will result in an extra attribute - foo: [value of some_claim] + // + // hard-coded key, value derived from claim value + // - key: "admin" + // valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""' + // This will result in: + // - if is_admin claim is present and true, extra attribute - admin: ["true"] + // - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added + // + // +optional + Extra []ExtraMapping +} + +// PrefixedClaimOrExpression provides the configuration for a single prefixed claim or expression. +type PrefixedClaimOrExpression struct { + // claim is the JWT claim to use. + // Mutually exclusive with expression. + // +optional + Claim string + // prefix is prepended to claim's value to prevent clashes with existing names. + // prefix needs to be set if claim is set and can be the empty string. + // Mutually exclusive with expression. + // +optional + Prefix *string + + // expression represents the expression which will be evaluated by CEL. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim and prefix. + // +optional + Expression string +} + +// ClaimOrExpression provides the configuration for a single claim or expression. +type ClaimOrExpression struct { + // claim is the JWT claim to use. + // Either claim or expression must be set. + // Mutually exclusive with expression. + // +optional + Claim string + + // expression represents the expression which will be evaluated by CEL. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim. + // +optional + Expression string +} + +// ExtraMapping provides the configuration for a single extra mapping. +type ExtraMapping struct { + // key is a string to use as the extra attribute key. + // key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid + // subdomain as defined by RFC 1123. All characters trailing the first "/" must + // be valid HTTP Path characters as defined by RFC 3986. + // key must be lowercase. + // Required to be unique. + // +required + Key string + + // valueExpression is a CEL expression to extract extra attribute value. + // valueExpression must produce a string or string array value. + // "", [], and null values are treated as the extra mapping not being present. + // Empty string values contained within a string array are filtered out. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // +required + ValueExpression string +} + +// UserValidationRule provides the configuration for a single user info validation rule. +type UserValidationRule struct { + // expression represents the expression which will be evaluated by CEL. + // Must return true for the validation to pass. + // + // CEL expressions have access to the contents of UserInfo, organized into CEL variable: + // - 'user' - authentication.k8s.io/v1, Kind=UserInfo object + // Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition. + // API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // +required + Expression string + + // message customizes the returned error message when rule returns false. + // message is a literal string. + // +optional + Message string +} + +// ExternalClaimsSource provides the configuration for a single external claim source. +type ExternalClaimsSource struct { + // authentication is an optional field that configures how the apiserver authenticates with an external claims source. + // When not specified, anonymous authentication is used. + // +optional + Authentication *Authentication + // tls is an optional field that configures the http client TLS + // settings when fetching external claims from this source. + // At least one subfield must be set when this field is specified. + // +optional + TLS *TLS + // url is a required configuration of the URL + // for which the external claims are located. + // +required + URL *SourceURL + // mappings is a required list of the claim + // and response handling expression pairs + // that produces the claims from the external source. + // mappings must have at least 1 entry and must not exceed 16 entries. + // Entries must have a unique name across all external claim sources. + // + // WARNING: claims sourced using these mappings will override any claims + // that exist within the token during the claim-to-identity mapping + // process. Use caution when sourcing external claims to avoid unintentionally + // overriding token claims. To help guard against this, sourcing + // external claims can have guard conditions defined in the 'conditions' + // field. + // + // +required + Mappings []SourcedClaimMapping + // conditions is an optional list of conditions in + // which claims should attempt to be fetched from this + // external source. + // When omitted or empty, claims are always attempted to be fetched + // from this external source. + // When specified, all conditions must evaluate to 'true' + // before claims are attempted to be fetched from this external source. + // conditions must not exceed 16 entries. + // Entries must have unique expressions. + // +optional + Conditions []ExternalSourceCondition +} + +// TLS configures the TLS options that the apiserver uses as a client +// when making a request to the external claim source. +// At least one field must be set when specified. +type TLS struct { + // certificateAuthority is an optional field that configures the certificate authority + // used to validate TLS connections with the external claims source. + // Must not be empty and must be a valid PEM-encoded certificate. + // +optional + CertificateAuthority *string +} + +func (t *TLS) IsZero() bool { + return t.CertificateAuthority == nil +} + +// Authentication configures how the apiserver should attempt to authenticate +// with an external claims source. +type Authentication struct { + // type is a required field that sets the type of + // authentication method used by the authenticator + // when fetching external claims. + // + // Allowed values are 'RequestProvidedToken' and 'ClientCredential'. + // + // When set to 'RequestProvidedToken', the authenticator will + // use the token provided to the kube-apiserver as part of the + // request to authenticate with the external claims source. + // + // When set to 'ClientCredential', the authenticator will + // use the configured client-id, client-secret, and token endpoint + // to fetch an access token using the OAuth2 client credentials grant + // flow. The fetched access token will then be used to authenticate + // with the external claims source. + // +required + Type *AuthenticationType + + // clientCredential configures the client credentials + // and token endpoint to use to get an access token. + // This field must be set when type is ClientCredential. + // This field must not be set when type is not ClientCredential. + // +optional + ClientCredential *ClientCredentialConfig +} + +// AuthenticationType is the type of authentication that should be used +// when fetching claims from an external source. +type AuthenticationType string + +const ( + // AuthenticationTypeRequestProvidedToken is an AuthenticationType + // that represents that the token being evaluated for authentication + // should be used for authenticating with the external claims source. + // This is useful for scenarios where a token has multiple audiences + // and scopes so that it can be used to access both the cluster and + // the UserInfo endpoint that contains additional information about the + // user not present in the token. + AuthenticationTypeRequestProvidedToken AuthenticationType = "RequestProvidedToken" + + // AuthenticationTypeClientCredential is an AuthenticationType + // that represents that the authenticator should use the OAuth2 + // client credentials grant flow to obtain an access token for + // authenticating with the external claims source. + // This is useful for scenarios such as fetching user information + // from Microsoft's Graph API where a separate client credential + // is needed to access the API. + AuthenticationTypeClientCredential AuthenticationType = "ClientCredential" +) + +// ClientCredentialConfig configures the client credentials and token endpoint +// to use to get an access token via the OAuth2 client credentials grant flow. +type ClientCredentialConfig struct { + // clientID is the client identifier to use during the OAuth2 client credentials flow. + // clientID must not be an empty string (""). + // clientID must only contain printable ASCII characters. + // +required + ClientID string + + // clientSecret is the client secret to use during the OAuth2 client credentials flow. + // clientSecret is the literal string value of the client secret. + // clientSecret must not be an empty string (""). + // clientSecret must only contain printable ASCII characters. + // +required + ClientSecret string + + // tokenEndpoint is a required URL to query for an access token using + // the client credential OAuth2 flow. + // tokenEndpoint must not be an empty string (""). + // tokenEndpoint must be a valid HTTPS URL. + // tokenEndpoint must have a host and a path. + // tokenEndpoint must not contain query parameters, fragments, + // or user information (e.g., "user:password@host"). + // +required + TokenEndpoint string + + // scopes is an optional list of OAuth2 scopes to request when obtaining + // an access token. If not specified, the token endpoint's default scopes + // will be used. Each scope must not be an empty string (""). + // +optional + Scopes []string + + // tls is an optional field that configures the http client TLS + // settings when fetching an access token for this source. + // At least one subfield must be set when this field is specified. + // +optional + TLS *TLS +} + +// SourceURL configures the options used to build the URL that is queried for external claims. +type SourceURL struct { + // hostname is a required hostname for which the external claims are located. + // It must be a valid DNS subdomain name as per RFC1123. + // This means that it must start and end with a lowercase alphanumeric character, + // must only consist of lowercase alphanumeric characters, '-', and '.'. + // hostname must not be an empty string ("") and must not exceed 253 characters in length. + // hostname may optionally specify a port in the format ':{port}'. + // +required + Hostname *string + // pathExpression is a required CEL expression that returns a list + // of string values used to construct the URL path. + // Claims from the token used for the request to the kube-apiserver + // are made available via the `claims` variable. + // expression must not be an empty string (""). + // +required + PathExpression *string +} + +// SourcedClaimMapping configures the mapping behavior for a single external claim +// from the response the apiserver received from the external claim source. +type SourcedClaimMapping struct { + // name is a required name of the claim that + // will be produced and made available during + // the claim-to-identity mapping process. + // name must consist of only lowercase alpha characters and underscores ('_'). + // name must not be an empty string ("") and must not exceed 256 characters in length. + // +required + Name *string + + // expression is a required CEL expression that + // will produce a value to be assigned to the claim. + // The full response body from the request to the + // external claim source is provided via the + // `response` variable. + // expression must not be an empty string (""). + // +required + Expression *string +} + +// ExternalSourceCondition configures a singular condition +// that must return true before the external source is queried +// to retrieve external claims. +type ExternalSourceCondition struct { + // expression is a required CEL expression that + // is used to determine whether or not an external + // source should be used to fetch external claims. + // The expression must return a boolean value, + // where true means that the source should be consulted + // and false means that it should not. + // Claims from the token used for the request to the kube-apiserver + // are made available via the `claims` variable. + // expression must not be an empty string (""). + // +required + Expression *string +} diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/doc.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/doc.go new file mode 100644 index 000000000000..9946dec99bc5 --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/doc.go @@ -0,0 +1,6 @@ +// +k8s:conversion-gen=github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication +// +k8s:deepcopy-gen=package,register + +// +groupName=authentication.openshift.io +// Package v1alpha1 is the v1alpha1 version of the API. +package v1alpha1 diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/register.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/register.go new file mode 100644 index 000000000000..1f062a1bf4a6 --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/register.go @@ -0,0 +1,40 @@ +package v1alpha1 + +import ( + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + + "github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication" +) + +const ( + GroupName = "authentication.openshift.io" +) + +var ( + schemeBuilder = runtime.NewSchemeBuilder( + authentication.Install, + addKnownTypes, + ) + Install = schemeBuilder.AddToScheme + + // DEPRECATED kept for generated code + SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1alpha1"} + // DEPRECATED kept for generated code + AddToScheme = schemeBuilder.AddToScheme + localSchemeBuilder = &schemeBuilder +) + +// Resource kept for generated code +// DEPRECATED +func Resource(resource string) schema.GroupResource { + return SchemeGroupVersion.WithResource(resource).GroupResource() +} + +// Adds the list of known types to api.Scheme. +func addKnownTypes(scheme *runtime.Scheme) error { + scheme.AddKnownTypes(SchemeGroupVersion, + &AuthenticationConfiguration{}, + ) + return nil +} diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/types.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/types.go new file mode 100644 index 000000000000..e354e81ad073 --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/types.go @@ -0,0 +1,552 @@ +package v1alpha1 + +import ( + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +/* + +The types in this file are heavily inspired by the existing +Kubernetes AuthenticationConfiguration type found at +https://github.com/kubernetes/kubernetes/blob/b2f73c0d6b427e2ab5ba225375aaefc0b9bc45b2/staging/src/k8s.io/apiserver/pkg/apis/apiserver/v1/types.go#L56 + +The API surface here intentionally aligns with this API because it is meant +to be a wrapper around that API with some customization to support unique +functionality that OpenShift needs. + +*/ + +// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object + +type AuthenticationConfiguration struct { + metav1.TypeMeta + + // jwt is a list of authenticator to authenticate Kubernetes users using + // JWT compliant tokens. The authenticator will attempt to parse a raw ID token, + // verify it's been signed by the configured issuer. The public key to verify the + // signature is discovered from the issuer's public endpoint using OIDC discovery. + // For an incoming token, each JWT authenticator will be attempted in + // the order in which it is specified in this list. Note however that + // other authenticators may run before or after the JWT authenticators. + // The specific position of JWT authenticators in relation to other + // authenticators is neither defined nor stable across releases. Since + // each JWT authenticator must have a unique issuer URL, at most one + // JWT authenticator will attempt to cryptographically validate the token. + // + // The minimum valid JWT payload must contain the following claims: + // { + // "iss": "https://issuer.example.com", + // "aud": ["audience"], + // "exp": 1234567890, + // "": "username" + // } + JWT []JWTAuthenticator `json:"jwt,omitempty"` +} + +type JWTAuthenticator struct { + // issuer contains the basic OIDC provider connection options. + // +required + Issuer *Issuer `json:"issuer,omitempty"` + + // claimValidationRules are rules that are applied to validate token claims to authenticate users. + // +optional + ClaimValidationRules []ClaimValidationRule `json:"claimValidationRules,omitempty"` + + // claimMappings points claims of a token to be treated as user attributes. + // +required + ClaimMappings *ClaimMappings `json:"claimMappings,omitempty"` + + // userValidationRules are rules that are applied to final user before completing authentication. + // These allow invariants to be applied to incoming identities such as preventing the + // use of the system: prefix that is commonly used by Kubernetes components. + // The validation rules are logically ANDed together and must all return true for the validation to pass. + // +optional + UserValidationRules []UserValidationRule `json:"userValidationRules,omitempty"` + + // externalClaimSources is an optional field that can be used to configure + // sources, external to the token provided in a request, in which claims + // should be fetched from and made available to the claim mapping process + // that is used to build the identity of a token holder. + // For example, fetching additional user metadata from an OIDC provider's UserInfo endpoint. + // externalClaimSources must not exceed 5 entries. + // +optional + ExternalClaimsSources []ExternalClaimsSource `json:"externalClaimsSources,omitempty"` +} + +// Issuer provides the configuration for an external provider's specific settings. +type Issuer struct { + // url points to the issuer URL in a format https://url or https://url/path. + // This must match the "iss" claim in the presented JWT, and the issuer returned from discovery. + // Same value as the --oidc-issuer-url flag. + // Discovery information is fetched from "{url}/.well-known/openid-configuration" unless overridden by discoveryURL. + // Required to be unique across all JWT authenticators. + // Note that egress selection configuration is not used for this network connection. + // +required + URL string `json:"url"` + + // discoveryURL, if specified, overrides the URL used to fetch discovery + // information instead of using "{url}/.well-known/openid-configuration". + // The exact value specified is used, so "/.well-known/openid-configuration" + // must be included in discoveryURL if needed. + // + // The "issuer" field in the fetched discovery information must match the "issuer.url" field + // in the AuthenticationConfiguration and will be used to validate the "iss" claim in the presented JWT. + // This is for scenarios where the well-known and jwks endpoints are hosted at a different + // location than the issuer (such as locally in the cluster). + // + // Example: + // A discovery url that is exposed using kubernetes service 'oidc' in namespace 'oidc-namespace' + // and discovery information is available at '/.well-known/openid-configuration'. + // discoveryURL: "https://oidc.oidc-namespace/.well-known/openid-configuration" + // certificateAuthority is used to verify the TLS connection and the hostname on the leaf certificate + // must be set to 'oidc.oidc-namespace'. + // + // curl https://oidc.oidc-namespace/.well-known/openid-configuration (.discoveryURL field) + // { + // issuer: "https://oidc.example.com" (.url field) + // } + // + // discoveryURL must be different from url. + // Required to be unique across all JWT authenticators. + // Note that egress selection configuration is not used for this network connection. + // +optional + DiscoveryURL string `json:"discoveryURL,omitempty"` + + // certificateAuthority contains PEM-encoded certificate authority certificates + // used to validate the connection when fetching discovery information. + // If unset, the system verifier is used. + // Same value as the content of the file referenced by the --oidc-ca-file flag. + // +optional + CertificateAuthority string `json:"certificateAuthority,omitempty"` + + // audiences is the set of acceptable audiences the JWT must be issued to. + // At least one of the entries must match the "aud" claim in presented JWTs. + // Same value as the --oidc-client-id flag (though this field supports an array). + // Required to be non-empty. + // +required + Audiences []string `json:"audiences"` + + // audienceMatchPolicy defines how the "audiences" field is used to match the "aud" claim in the presented JWT. + // Allowed values are: + // 1. "MatchAny" when multiple audiences are specified and + // 2. empty (or unset) or "MatchAny" when a single audience is specified. + // + // - MatchAny: the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field. + // For example, if "audiences" is ["foo", "bar"], the "aud" claim in the presented JWT must contain either "foo" or "bar" (and may contain both). + // + // - "": The match policy can be empty (or unset) when a single audience is specified in the "audiences" field. The "aud" claim in the presented JWT must contain the single audience (and may contain others). + // + // For more nuanced audience validation, use claimValidationRules. + // example: claimValidationRule[].expression: 'sets.equivalent(claims.aud, ["bar", "foo", "baz"])' to require an exact match. + // +optional + AudienceMatchPolicy AudienceMatchPolicyType `json:"audienceMatchPolicy,omitempty"` +} + +// AudienceMatchPolicyType is a set of valid values for issuer.audienceMatchPolicy +type AudienceMatchPolicyType string + +// Valid types for AudienceMatchPolicyType +const ( + // MatchAny means the "aud" claim in the presented JWT must match at least one of the entries in the "audiences" field. + AudienceMatchPolicyMatchAny AudienceMatchPolicyType = "MatchAny" +) + +// ClaimValidationRule provides the configuration for a single claim validation rule. +type ClaimValidationRule struct { + // claim is the name of a required claim. + // Same as --oidc-required-claim flag. + // Only string claim keys are supported. + // Mutually exclusive with expression and message. + // +optional + Claim string `json:"claim,omitempty"` + // requiredValue is the value of a required claim. + // Same as --oidc-required-claim flag. + // Only string claim values are supported. + // If claim is set and requiredValue is not set, the claim must be present with a value set to the empty string. + // Mutually exclusive with expression and message. + // +optional + RequiredValue string `json:"requiredValue,omitempty"` + + // expression represents the expression which will be evaluated by CEL. + // Must produce a boolean. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // Must return true for the validation to pass. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim and requiredValue. + // +optional + Expression string `json:"expression,omitempty"` + // message customizes the returned error message when expression returns false. + // message is a literal string. + // Mutually exclusive with claim and requiredValue. + // +optional + Message string `json:"message,omitempty"` +} + +// ClaimMappings provides the configuration for claim mapping +type ClaimMappings struct { + // username represents an option for the username attribute. + // The claim's value must be a singular string. + // Same as the --oidc-username-claim and --oidc-username-prefix flags. + // If username.expression is set, the expression must produce a string value. + // If username.expression uses 'claims.email', then 'claims.email_verified' must be used in + // username.expression or extra[*].valueExpression or claimValidationRules[*].expression. + // An example claim validation rule expression that matches the validation automatically + // applied when username.claim is set to 'email' is 'claims.?email_verified.orValue(true) == true'. By explicitly comparing + // the value to true, we let type-checking see the result will be a boolean, and to make sure a non-boolean email_verified + // claim will be caught at runtime. + // + // In the flag based approach, the --oidc-username-claim and --oidc-username-prefix are optional. If --oidc-username-claim is not set, + // the default value is "sub". For the authentication config, there is no defaulting for claim or prefix. The claim and prefix must be set explicitly. + // For claim, if --oidc-username-claim was not set with legacy flag approach, configure username.claim="sub" in the authentication config. + // For prefix: + // (1) --oidc-username-prefix="-", no prefix was added to the username. For the same behavior using authentication config, + // set username.prefix="" + // (2) --oidc-username-prefix="" and --oidc-username-claim != "email", prefix was "#". For the same + // behavior using authentication config, set username.prefix="#" + // (3) --oidc-username-prefix="". For the same behavior using authentication config, set username.prefix="" + // +required + Username PrefixedClaimOrExpression `json:"username"` + // groups represents an option for the groups attribute. + // The claim's value must be a string or string array claim. + // If groups.claim is set, the prefix must be specified (and can be the empty string). + // If groups.expression is set, the expression must produce a string or string array value. + // "", [], and null values are treated as the group mapping not being present. + // +optional + Groups PrefixedClaimOrExpression `json:"groups,omitempty"` + + // uid represents an option for the uid attribute. + // Claim must be a singular string claim. + // If uid.expression is set, the expression must produce a string value. + // +optional + UID ClaimOrExpression `json:"uid"` + + // extra represents an option for the extra attribute. + // expression must produce a string or string array value. + // If the value is empty, the extra mapping will not be present. + // + // hard-coded extra key/value + // - key: "foo" + // valueExpression: "'bar'" + // This will result in an extra attribute - foo: ["bar"] + // + // hard-coded key, value copying claim value + // - key: "foo" + // valueExpression: "claims.some_claim" + // This will result in an extra attribute - foo: [value of some_claim] + // + // hard-coded key, value derived from claim value + // - key: "admin" + // valueExpression: '(has(claims.is_admin) && claims.is_admin) ? "true":""' + // This will result in: + // - if is_admin claim is present and true, extra attribute - admin: ["true"] + // - if is_admin claim is present and false or is_admin claim is not present, no extra attribute will be added + // + // +optional + Extra []ExtraMapping `json:"extra,omitempty"` +} + +// PrefixedClaimOrExpression provides the configuration for a single prefixed claim or expression. +type PrefixedClaimOrExpression struct { + // claim is the JWT claim to use. + // Mutually exclusive with expression. + // +optional + Claim string `json:"claim,omitempty"` + // prefix is prepended to claim's value to prevent clashes with existing names. + // prefix needs to be set if claim is set and can be the empty string. + // Mutually exclusive with expression. + // +optional + Prefix *string `json:"prefix,omitempty"` + + // expression represents the expression which will be evaluated by CEL. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim and prefix. + // +optional + Expression string `json:"expression,omitempty"` +} + +// ClaimOrExpression provides the configuration for a single claim or expression. +type ClaimOrExpression struct { + // claim is the JWT claim to use. + // Either claim or expression must be set. + // Mutually exclusive with expression. + // +optional + Claim string `json:"claim,omitempty"` + + // expression represents the expression which will be evaluated by CEL. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // Mutually exclusive with claim. + // +optional + Expression string `json:"expression,omitempty"` +} + +// ExtraMapping provides the configuration for a single extra mapping. +type ExtraMapping struct { + // key is a string to use as the extra attribute key. + // key must be a domain-prefix path (e.g. example.org/foo). All characters before the first "/" must be a valid + // subdomain as defined by RFC 1123. All characters trailing the first "/" must + // be valid HTTP Path characters as defined by RFC 3986. + // key must be lowercase. + // Required to be unique. + // +required + Key string `json:"key"` + + // valueExpression is a CEL expression to extract extra attribute value. + // valueExpression must produce a string or string array value. + // "", [], and null values are treated as the extra mapping not being present. + // Empty string values contained within a string array are filtered out. + // + // CEL expressions have access to the contents of the token claims, organized into CEL variable: + // - 'claims' is a map of claim names to claim values. + // For example, a variable named 'sub' can be accessed as 'claims.sub'. + // Nested claims can be accessed using dot notation, e.g. 'claims.foo.bar'. + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // +required + ValueExpression string `json:"valueExpression"` +} + +// UserValidationRule provides the configuration for a single user info validation rule. +type UserValidationRule struct { + // expression represents the expression which will be evaluated by CEL. + // Must return true for the validation to pass. + // + // CEL expressions have access to the contents of UserInfo, organized into CEL variable: + // - 'user' - authentication.k8s.io/v1, Kind=UserInfo object + // Refer to https://github.com/kubernetes/api/blob/release-1.28/authentication/v1/types.go#L105-L122 for the definition. + // API documentation: https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.28/#userinfo-v1-authentication-k8s-io + // + // Documentation on CEL: https://kubernetes.io/docs/reference/using-api/cel/ + // + // +required + Expression string `json:"expression"` + + // message customizes the returned error message when rule returns false. + // message is a literal string. + // +optional + Message string `json:"message,omitempty"` +} + +// ExternalClaimsSource provides the configuration for a single external claim source. +type ExternalClaimsSource struct { + // authentication is an optional field that configures how the apiserver authenticates with an external claims source. + // When not specified, anonymous authentication is used. + // +optional + Authentication *Authentication `json:"authentication,omitempty"` + // tls is an optional field that configures the http client TLS + // settings when fetching external claims from this source. + // At least one subfield must be set when this field is specified. + // +optional + TLS *TLS `json:"tls,omitempty"` + // url is a required configuration of the URL + // for which the external claims are located. + // +required + URL *SourceURL `json:"url,omitempty"` + // mappings is a required list of the claim + // and response handling expression pairs + // that produces the claims from the external source. + // + // mappings must have at least 1 entry and must not exceed 16 entries. + // Entries must have a unique name across all external claim sources. + // + // WARNING: claims sourced using these mappings will override any claims + // that exist within the token during the claim-to-identity mapping + // process. Use caution when sourcing external claims to avoid unintentionally + // overriding token claims. To help guard against this, sourcing + // external claims can have guard conditions defined in the 'conditions' + // field. + // + // +required + Mappings []SourcedClaimMapping `json:"mappings,omitempty"` + // conditions is an optional list of conditions in + // which claims should attempt to be fetched from this + // external source. + // When omitted or empty, claims are always attempted to be fetched + // from this external source. + // When specified, all conditions must evaluate to 'true' + // before claims are attempted to be fetched from this external source. + // conditions must not exceed 16 entries. + // Entries must have unique expressions. + // +optional + Conditions []ExternalSourceCondition `json:"conditions,omitempty"` +} + +// TLS configures the TLS options that the apiserver uses as a client +// when making a request to the external claim source. +// At least one field must be set when specified. +type TLS struct { + // certificateAuthority is an optional field that configures the certificate authority + // used to validate TLS connections with the external claims source. + // Must not be empty and must be a valid PEM-encoded certificate. + // +optional + CertificateAuthority *string `json:"certificateAuthority,omitempty"` +} + +// Authentication configures how the apiserver should attempt to authenticate +// with an external claims source. +type Authentication struct { + // type is a required field that sets the type of + // authentication method used by the authenticator + // when fetching external claims. + // + // Allowed values are 'RequestProvidedToken' and 'ClientCredential'. + // + // When set to 'RequestProvidedToken', the authenticator will + // use the token provided to the kube-apiserver as part of the + // request to authenticate with the external claims source. + // + // When set to 'ClientCredential', the authenticator will + // use the configured client-id, client-secret, and token endpoint + // to fetch an access token using the OAuth2 client credentials grant + // flow. The fetched access token will then be used to authenticate + // with the external claims source. + // +required + Type *AuthenticationType `json:"type,omitempty"` + + // clientCredential configures the client credentials + // and token endpoint to use to get an access token. + // This field must be set when type is ClientCredential. + // This field must not be set when type is not ClientCredential. + // +optional + ClientCredential *ClientCredentialConfig `json:"clientCredential,omitempty"` +} + +// AuthenticationType is the type of authentication that should be used +// when fetching claims from an external source. +type AuthenticationType string + +const ( + // AuthenticationTypeRequestProvidedToken is an AuthenticationType + // that represents that the token being evaluated for authentication + // should be used for authenticating with the external claims source. + // This is useful for scenarios where a token has multiple audiences + // and scopes so that it can be used to access both the cluster and + // the UserInfo endpoint that contains additional information about the + // user not present in the token. + AuthenticationTypeRequestProvidedToken AuthenticationType = "RequestProvidedToken" + + // AuthenticationTypeClientCredential is an AuthenticationType + // that represents that the authenticator should use the OAuth2 + // client credentials grant flow to obtain an access token for + // authenticating with the external claims source. + // This is useful for scenarios such as fetching user information + // from Microsoft's Graph API where a separate client credential + // is needed to access the API. + AuthenticationTypeClientCredential AuthenticationType = "ClientCredential" +) + +// ClientCredentialConfig configures the client credentials and token endpoint +// to use to get an access token via the OAuth2 client credentials grant flow. +type ClientCredentialConfig struct { + // clientID is the client identifier to use during the OAuth2 client credentials flow. + // clientID must not be an empty string (""). + // clientID must only contain printable ASCII characters. + // +required + ClientID string `json:"clientID,omitempty"` + + // clientSecret is the client secret to use during the OAuth2 client credentials flow. + // clientSecret is the literal string value of the client secret. + // clientSecret must not be an empty string (""). + // clientSecret must only contain printable ASCII characters. + // +required + ClientSecret string `json:"clientSecret,omitempty"` + + // tokenEndpoint is a required URL to query for an access token using + // the client credential OAuth2 flow. + // tokenEndpoint must not be an empty string (""). + // tokenEndpoint must be a valid HTTPS URL. + // tokenEndpoint must have a host and a path. + // tokenEndpoint must not contain query parameters, fragments, + // or user information (e.g., "user:password@host"). + // +required + TokenEndpoint string `json:"tokenEndpoint,omitempty"` + + // scopes is an optional list of OAuth2 scopes to request when obtaining + // an access token. If not specified, the token endpoint's default scopes + // will be used. Each scope must not be an empty string (""). + // +optional + Scopes []string `json:"scopes,omitempty"` + + // tls is an optional field that configures the http client TLS + // settings when fetching an access token for this source. + // At least one subfield must be set when this field is specified. + // +optional + TLS *TLS `json:"tls,omitempty"` +} + +// SourceURL configures the options used to build the URL that is queried for external claims. +type SourceURL struct { + // hostname is a required hostname for which the external claims are located. + // It must be a valid DNS subdomain name as per RFC1123. + // This means that it must start and end with a lowercase alphanumeric character, + // must only consist of lowercase alphanumeric characters, '-', and '.'. + // hostname must not be an empty string ("") and must not exceed 253 characters in length. + // hostname may optionally specify a port in the format ':{port}'. + // +required + Hostname *string `json:"hostname,omitempty"` + // pathExpression is a required CEL expression that returns a list + // of string values used to construct the URL path. + // Claims from the token used for the request to the kube-apiserver + // are made available via the `claims` variable. + // expression must not be an empty string (""). + // +required + PathExpression *string `json:"pathExpression,omitempty"` +} + +// SourcedClaimMapping configures the mapping behavior for a single external claim +// from the response the apiserver received from the external claim source. +type SourcedClaimMapping struct { + // name is a required name of the claim that + // will be produced and made available during + // the claim-to-identity mapping process. + // name must consist of only lowercase alpha characters and underscores ('_'). + // name must not be an empty string ("") and must not exceed 256 characters in length. + // +required + Name *string `json:"name,omitempty"` + + // expression is a required CEL expression that + // will produce a value to be assigned to the claim. + // The full response body from the request to the + // external claim source is provided via the + // `response` variable. + // expression must not be an empty string (""). + // +required + Expression *string `json:"expression,omitempty"` +} + +// ExternalSourceCondition configures a singular condition +// that must return true before the external source is queried +// to retrieve external claims. +type ExternalSourceCondition struct { + // expression is a required CEL expression that + // is used to determine whether or not an external + // source should be used to fetch external claims. + // The expression must return a boolean value, + // where true means that the source should be consulted + // and false means that it should not. + // Claims from the token used for the request to the kube-apiserver + // are made available via the `claims` variable. + // expression must not be an empty string (""). + // +required + Expression *string `json:"expression,omitempty"` +} diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.conversion.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.conversion.go new file mode 100644 index 000000000000..307f5a47d31b --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.conversion.go @@ -0,0 +1,576 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by conversion-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + unsafe "unsafe" + + authentication "github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication" + conversion "k8s.io/apimachinery/pkg/conversion" + runtime "k8s.io/apimachinery/pkg/runtime" +) + +func init() { + localSchemeBuilder.Register(RegisterConversions) +} + +// RegisterConversions adds conversion functions to the given scheme. +// Public to allow building arbitrary schemes. +func RegisterConversions(s *runtime.Scheme) error { + if err := s.AddGeneratedConversionFunc((*Authentication)(nil), (*authentication.Authentication)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_Authentication_To_authentication_Authentication(a.(*Authentication), b.(*authentication.Authentication), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.Authentication)(nil), (*Authentication)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_Authentication_To_v1alpha1_Authentication(a.(*authentication.Authentication), b.(*Authentication), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*AuthenticationConfiguration)(nil), (*authentication.AuthenticationConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_AuthenticationConfiguration_To_authentication_AuthenticationConfiguration(a.(*AuthenticationConfiguration), b.(*authentication.AuthenticationConfiguration), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.AuthenticationConfiguration)(nil), (*AuthenticationConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_AuthenticationConfiguration_To_v1alpha1_AuthenticationConfiguration(a.(*authentication.AuthenticationConfiguration), b.(*AuthenticationConfiguration), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ClaimMappings)(nil), (*authentication.ClaimMappings)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ClaimMappings_To_authentication_ClaimMappings(a.(*ClaimMappings), b.(*authentication.ClaimMappings), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ClaimMappings)(nil), (*ClaimMappings)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ClaimMappings_To_v1alpha1_ClaimMappings(a.(*authentication.ClaimMappings), b.(*ClaimMappings), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ClaimOrExpression)(nil), (*authentication.ClaimOrExpression)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ClaimOrExpression_To_authentication_ClaimOrExpression(a.(*ClaimOrExpression), b.(*authentication.ClaimOrExpression), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ClaimOrExpression)(nil), (*ClaimOrExpression)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ClaimOrExpression_To_v1alpha1_ClaimOrExpression(a.(*authentication.ClaimOrExpression), b.(*ClaimOrExpression), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ClaimValidationRule)(nil), (*authentication.ClaimValidationRule)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ClaimValidationRule_To_authentication_ClaimValidationRule(a.(*ClaimValidationRule), b.(*authentication.ClaimValidationRule), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ClaimValidationRule)(nil), (*ClaimValidationRule)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ClaimValidationRule_To_v1alpha1_ClaimValidationRule(a.(*authentication.ClaimValidationRule), b.(*ClaimValidationRule), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ClientCredentialConfig)(nil), (*authentication.ClientCredentialConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ClientCredentialConfig_To_authentication_ClientCredentialConfig(a.(*ClientCredentialConfig), b.(*authentication.ClientCredentialConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ClientCredentialConfig)(nil), (*ClientCredentialConfig)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ClientCredentialConfig_To_v1alpha1_ClientCredentialConfig(a.(*authentication.ClientCredentialConfig), b.(*ClientCredentialConfig), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ExternalClaimsSource)(nil), (*authentication.ExternalClaimsSource)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ExternalClaimsSource_To_authentication_ExternalClaimsSource(a.(*ExternalClaimsSource), b.(*authentication.ExternalClaimsSource), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ExternalClaimsSource)(nil), (*ExternalClaimsSource)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ExternalClaimsSource_To_v1alpha1_ExternalClaimsSource(a.(*authentication.ExternalClaimsSource), b.(*ExternalClaimsSource), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ExternalSourceCondition)(nil), (*authentication.ExternalSourceCondition)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ExternalSourceCondition_To_authentication_ExternalSourceCondition(a.(*ExternalSourceCondition), b.(*authentication.ExternalSourceCondition), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ExternalSourceCondition)(nil), (*ExternalSourceCondition)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ExternalSourceCondition_To_v1alpha1_ExternalSourceCondition(a.(*authentication.ExternalSourceCondition), b.(*ExternalSourceCondition), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*ExtraMapping)(nil), (*authentication.ExtraMapping)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_ExtraMapping_To_authentication_ExtraMapping(a.(*ExtraMapping), b.(*authentication.ExtraMapping), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.ExtraMapping)(nil), (*ExtraMapping)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_ExtraMapping_To_v1alpha1_ExtraMapping(a.(*authentication.ExtraMapping), b.(*ExtraMapping), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*Issuer)(nil), (*authentication.Issuer)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_Issuer_To_authentication_Issuer(a.(*Issuer), b.(*authentication.Issuer), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.Issuer)(nil), (*Issuer)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_Issuer_To_v1alpha1_Issuer(a.(*authentication.Issuer), b.(*Issuer), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*JWTAuthenticator)(nil), (*authentication.JWTAuthenticator)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_JWTAuthenticator_To_authentication_JWTAuthenticator(a.(*JWTAuthenticator), b.(*authentication.JWTAuthenticator), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.JWTAuthenticator)(nil), (*JWTAuthenticator)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_JWTAuthenticator_To_v1alpha1_JWTAuthenticator(a.(*authentication.JWTAuthenticator), b.(*JWTAuthenticator), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*PrefixedClaimOrExpression)(nil), (*authentication.PrefixedClaimOrExpression)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression(a.(*PrefixedClaimOrExpression), b.(*authentication.PrefixedClaimOrExpression), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.PrefixedClaimOrExpression)(nil), (*PrefixedClaimOrExpression)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression(a.(*authentication.PrefixedClaimOrExpression), b.(*PrefixedClaimOrExpression), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*SourceURL)(nil), (*authentication.SourceURL)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_SourceURL_To_authentication_SourceURL(a.(*SourceURL), b.(*authentication.SourceURL), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.SourceURL)(nil), (*SourceURL)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_SourceURL_To_v1alpha1_SourceURL(a.(*authentication.SourceURL), b.(*SourceURL), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*SourcedClaimMapping)(nil), (*authentication.SourcedClaimMapping)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_SourcedClaimMapping_To_authentication_SourcedClaimMapping(a.(*SourcedClaimMapping), b.(*authentication.SourcedClaimMapping), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.SourcedClaimMapping)(nil), (*SourcedClaimMapping)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_SourcedClaimMapping_To_v1alpha1_SourcedClaimMapping(a.(*authentication.SourcedClaimMapping), b.(*SourcedClaimMapping), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*TLS)(nil), (*authentication.TLS)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_TLS_To_authentication_TLS(a.(*TLS), b.(*authentication.TLS), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.TLS)(nil), (*TLS)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_TLS_To_v1alpha1_TLS(a.(*authentication.TLS), b.(*TLS), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*UserValidationRule)(nil), (*authentication.UserValidationRule)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_v1alpha1_UserValidationRule_To_authentication_UserValidationRule(a.(*UserValidationRule), b.(*authentication.UserValidationRule), scope) + }); err != nil { + return err + } + if err := s.AddGeneratedConversionFunc((*authentication.UserValidationRule)(nil), (*UserValidationRule)(nil), func(a, b interface{}, scope conversion.Scope) error { + return Convert_authentication_UserValidationRule_To_v1alpha1_UserValidationRule(a.(*authentication.UserValidationRule), b.(*UserValidationRule), scope) + }); err != nil { + return err + } + return nil +} + +func autoConvert_v1alpha1_Authentication_To_authentication_Authentication(in *Authentication, out *authentication.Authentication, s conversion.Scope) error { + out.Type = (*authentication.AuthenticationType)(unsafe.Pointer(in.Type)) + out.ClientCredential = (*authentication.ClientCredentialConfig)(unsafe.Pointer(in.ClientCredential)) + return nil +} + +// Convert_v1alpha1_Authentication_To_authentication_Authentication is an autogenerated conversion function. +func Convert_v1alpha1_Authentication_To_authentication_Authentication(in *Authentication, out *authentication.Authentication, s conversion.Scope) error { + return autoConvert_v1alpha1_Authentication_To_authentication_Authentication(in, out, s) +} + +func autoConvert_authentication_Authentication_To_v1alpha1_Authentication(in *authentication.Authentication, out *Authentication, s conversion.Scope) error { + out.Type = (*AuthenticationType)(unsafe.Pointer(in.Type)) + out.ClientCredential = (*ClientCredentialConfig)(unsafe.Pointer(in.ClientCredential)) + return nil +} + +// Convert_authentication_Authentication_To_v1alpha1_Authentication is an autogenerated conversion function. +func Convert_authentication_Authentication_To_v1alpha1_Authentication(in *authentication.Authentication, out *Authentication, s conversion.Scope) error { + return autoConvert_authentication_Authentication_To_v1alpha1_Authentication(in, out, s) +} + +func autoConvert_v1alpha1_AuthenticationConfiguration_To_authentication_AuthenticationConfiguration(in *AuthenticationConfiguration, out *authentication.AuthenticationConfiguration, s conversion.Scope) error { + out.JWT = *(*[]authentication.JWTAuthenticator)(unsafe.Pointer(&in.JWT)) + return nil +} + +// Convert_v1alpha1_AuthenticationConfiguration_To_authentication_AuthenticationConfiguration is an autogenerated conversion function. +func Convert_v1alpha1_AuthenticationConfiguration_To_authentication_AuthenticationConfiguration(in *AuthenticationConfiguration, out *authentication.AuthenticationConfiguration, s conversion.Scope) error { + return autoConvert_v1alpha1_AuthenticationConfiguration_To_authentication_AuthenticationConfiguration(in, out, s) +} + +func autoConvert_authentication_AuthenticationConfiguration_To_v1alpha1_AuthenticationConfiguration(in *authentication.AuthenticationConfiguration, out *AuthenticationConfiguration, s conversion.Scope) error { + out.JWT = *(*[]JWTAuthenticator)(unsafe.Pointer(&in.JWT)) + return nil +} + +// Convert_authentication_AuthenticationConfiguration_To_v1alpha1_AuthenticationConfiguration is an autogenerated conversion function. +func Convert_authentication_AuthenticationConfiguration_To_v1alpha1_AuthenticationConfiguration(in *authentication.AuthenticationConfiguration, out *AuthenticationConfiguration, s conversion.Scope) error { + return autoConvert_authentication_AuthenticationConfiguration_To_v1alpha1_AuthenticationConfiguration(in, out, s) +} + +func autoConvert_v1alpha1_ClaimMappings_To_authentication_ClaimMappings(in *ClaimMappings, out *authentication.ClaimMappings, s conversion.Scope) error { + if err := Convert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression(&in.Username, &out.Username, s); err != nil { + return err + } + if err := Convert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression(&in.Groups, &out.Groups, s); err != nil { + return err + } + if err := Convert_v1alpha1_ClaimOrExpression_To_authentication_ClaimOrExpression(&in.UID, &out.UID, s); err != nil { + return err + } + out.Extra = *(*[]authentication.ExtraMapping)(unsafe.Pointer(&in.Extra)) + return nil +} + +// Convert_v1alpha1_ClaimMappings_To_authentication_ClaimMappings is an autogenerated conversion function. +func Convert_v1alpha1_ClaimMappings_To_authentication_ClaimMappings(in *ClaimMappings, out *authentication.ClaimMappings, s conversion.Scope) error { + return autoConvert_v1alpha1_ClaimMappings_To_authentication_ClaimMappings(in, out, s) +} + +func autoConvert_authentication_ClaimMappings_To_v1alpha1_ClaimMappings(in *authentication.ClaimMappings, out *ClaimMappings, s conversion.Scope) error { + if err := Convert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression(&in.Username, &out.Username, s); err != nil { + return err + } + if err := Convert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression(&in.Groups, &out.Groups, s); err != nil { + return err + } + if err := Convert_authentication_ClaimOrExpression_To_v1alpha1_ClaimOrExpression(&in.UID, &out.UID, s); err != nil { + return err + } + out.Extra = *(*[]ExtraMapping)(unsafe.Pointer(&in.Extra)) + return nil +} + +// Convert_authentication_ClaimMappings_To_v1alpha1_ClaimMappings is an autogenerated conversion function. +func Convert_authentication_ClaimMappings_To_v1alpha1_ClaimMappings(in *authentication.ClaimMappings, out *ClaimMappings, s conversion.Scope) error { + return autoConvert_authentication_ClaimMappings_To_v1alpha1_ClaimMappings(in, out, s) +} + +func autoConvert_v1alpha1_ClaimOrExpression_To_authentication_ClaimOrExpression(in *ClaimOrExpression, out *authentication.ClaimOrExpression, s conversion.Scope) error { + out.Claim = in.Claim + out.Expression = in.Expression + return nil +} + +// Convert_v1alpha1_ClaimOrExpression_To_authentication_ClaimOrExpression is an autogenerated conversion function. +func Convert_v1alpha1_ClaimOrExpression_To_authentication_ClaimOrExpression(in *ClaimOrExpression, out *authentication.ClaimOrExpression, s conversion.Scope) error { + return autoConvert_v1alpha1_ClaimOrExpression_To_authentication_ClaimOrExpression(in, out, s) +} + +func autoConvert_authentication_ClaimOrExpression_To_v1alpha1_ClaimOrExpression(in *authentication.ClaimOrExpression, out *ClaimOrExpression, s conversion.Scope) error { + out.Claim = in.Claim + out.Expression = in.Expression + return nil +} + +// Convert_authentication_ClaimOrExpression_To_v1alpha1_ClaimOrExpression is an autogenerated conversion function. +func Convert_authentication_ClaimOrExpression_To_v1alpha1_ClaimOrExpression(in *authentication.ClaimOrExpression, out *ClaimOrExpression, s conversion.Scope) error { + return autoConvert_authentication_ClaimOrExpression_To_v1alpha1_ClaimOrExpression(in, out, s) +} + +func autoConvert_v1alpha1_ClaimValidationRule_To_authentication_ClaimValidationRule(in *ClaimValidationRule, out *authentication.ClaimValidationRule, s conversion.Scope) error { + out.Claim = in.Claim + out.RequiredValue = in.RequiredValue + out.Expression = in.Expression + out.Message = in.Message + return nil +} + +// Convert_v1alpha1_ClaimValidationRule_To_authentication_ClaimValidationRule is an autogenerated conversion function. +func Convert_v1alpha1_ClaimValidationRule_To_authentication_ClaimValidationRule(in *ClaimValidationRule, out *authentication.ClaimValidationRule, s conversion.Scope) error { + return autoConvert_v1alpha1_ClaimValidationRule_To_authentication_ClaimValidationRule(in, out, s) +} + +func autoConvert_authentication_ClaimValidationRule_To_v1alpha1_ClaimValidationRule(in *authentication.ClaimValidationRule, out *ClaimValidationRule, s conversion.Scope) error { + out.Claim = in.Claim + out.RequiredValue = in.RequiredValue + out.Expression = in.Expression + out.Message = in.Message + return nil +} + +// Convert_authentication_ClaimValidationRule_To_v1alpha1_ClaimValidationRule is an autogenerated conversion function. +func Convert_authentication_ClaimValidationRule_To_v1alpha1_ClaimValidationRule(in *authentication.ClaimValidationRule, out *ClaimValidationRule, s conversion.Scope) error { + return autoConvert_authentication_ClaimValidationRule_To_v1alpha1_ClaimValidationRule(in, out, s) +} + +func autoConvert_v1alpha1_ClientCredentialConfig_To_authentication_ClientCredentialConfig(in *ClientCredentialConfig, out *authentication.ClientCredentialConfig, s conversion.Scope) error { + out.ClientID = in.ClientID + out.ClientSecret = in.ClientSecret + out.TokenEndpoint = in.TokenEndpoint + out.Scopes = *(*[]string)(unsafe.Pointer(&in.Scopes)) + out.TLS = (*authentication.TLS)(unsafe.Pointer(in.TLS)) + return nil +} + +// Convert_v1alpha1_ClientCredentialConfig_To_authentication_ClientCredentialConfig is an autogenerated conversion function. +func Convert_v1alpha1_ClientCredentialConfig_To_authentication_ClientCredentialConfig(in *ClientCredentialConfig, out *authentication.ClientCredentialConfig, s conversion.Scope) error { + return autoConvert_v1alpha1_ClientCredentialConfig_To_authentication_ClientCredentialConfig(in, out, s) +} + +func autoConvert_authentication_ClientCredentialConfig_To_v1alpha1_ClientCredentialConfig(in *authentication.ClientCredentialConfig, out *ClientCredentialConfig, s conversion.Scope) error { + out.ClientID = in.ClientID + out.ClientSecret = in.ClientSecret + out.TokenEndpoint = in.TokenEndpoint + out.Scopes = *(*[]string)(unsafe.Pointer(&in.Scopes)) + out.TLS = (*TLS)(unsafe.Pointer(in.TLS)) + return nil +} + +// Convert_authentication_ClientCredentialConfig_To_v1alpha1_ClientCredentialConfig is an autogenerated conversion function. +func Convert_authentication_ClientCredentialConfig_To_v1alpha1_ClientCredentialConfig(in *authentication.ClientCredentialConfig, out *ClientCredentialConfig, s conversion.Scope) error { + return autoConvert_authentication_ClientCredentialConfig_To_v1alpha1_ClientCredentialConfig(in, out, s) +} + +func autoConvert_v1alpha1_ExternalClaimsSource_To_authentication_ExternalClaimsSource(in *ExternalClaimsSource, out *authentication.ExternalClaimsSource, s conversion.Scope) error { + out.Authentication = (*authentication.Authentication)(unsafe.Pointer(in.Authentication)) + out.TLS = (*authentication.TLS)(unsafe.Pointer(in.TLS)) + out.URL = (*authentication.SourceURL)(unsafe.Pointer(in.URL)) + out.Mappings = *(*[]authentication.SourcedClaimMapping)(unsafe.Pointer(&in.Mappings)) + out.Conditions = *(*[]authentication.ExternalSourceCondition)(unsafe.Pointer(&in.Conditions)) + return nil +} + +// Convert_v1alpha1_ExternalClaimsSource_To_authentication_ExternalClaimsSource is an autogenerated conversion function. +func Convert_v1alpha1_ExternalClaimsSource_To_authentication_ExternalClaimsSource(in *ExternalClaimsSource, out *authentication.ExternalClaimsSource, s conversion.Scope) error { + return autoConvert_v1alpha1_ExternalClaimsSource_To_authentication_ExternalClaimsSource(in, out, s) +} + +func autoConvert_authentication_ExternalClaimsSource_To_v1alpha1_ExternalClaimsSource(in *authentication.ExternalClaimsSource, out *ExternalClaimsSource, s conversion.Scope) error { + out.Authentication = (*Authentication)(unsafe.Pointer(in.Authentication)) + out.TLS = (*TLS)(unsafe.Pointer(in.TLS)) + out.URL = (*SourceURL)(unsafe.Pointer(in.URL)) + out.Mappings = *(*[]SourcedClaimMapping)(unsafe.Pointer(&in.Mappings)) + out.Conditions = *(*[]ExternalSourceCondition)(unsafe.Pointer(&in.Conditions)) + return nil +} + +// Convert_authentication_ExternalClaimsSource_To_v1alpha1_ExternalClaimsSource is an autogenerated conversion function. +func Convert_authentication_ExternalClaimsSource_To_v1alpha1_ExternalClaimsSource(in *authentication.ExternalClaimsSource, out *ExternalClaimsSource, s conversion.Scope) error { + return autoConvert_authentication_ExternalClaimsSource_To_v1alpha1_ExternalClaimsSource(in, out, s) +} + +func autoConvert_v1alpha1_ExternalSourceCondition_To_authentication_ExternalSourceCondition(in *ExternalSourceCondition, out *authentication.ExternalSourceCondition, s conversion.Scope) error { + out.Expression = (*string)(unsafe.Pointer(in.Expression)) + return nil +} + +// Convert_v1alpha1_ExternalSourceCondition_To_authentication_ExternalSourceCondition is an autogenerated conversion function. +func Convert_v1alpha1_ExternalSourceCondition_To_authentication_ExternalSourceCondition(in *ExternalSourceCondition, out *authentication.ExternalSourceCondition, s conversion.Scope) error { + return autoConvert_v1alpha1_ExternalSourceCondition_To_authentication_ExternalSourceCondition(in, out, s) +} + +func autoConvert_authentication_ExternalSourceCondition_To_v1alpha1_ExternalSourceCondition(in *authentication.ExternalSourceCondition, out *ExternalSourceCondition, s conversion.Scope) error { + out.Expression = (*string)(unsafe.Pointer(in.Expression)) + return nil +} + +// Convert_authentication_ExternalSourceCondition_To_v1alpha1_ExternalSourceCondition is an autogenerated conversion function. +func Convert_authentication_ExternalSourceCondition_To_v1alpha1_ExternalSourceCondition(in *authentication.ExternalSourceCondition, out *ExternalSourceCondition, s conversion.Scope) error { + return autoConvert_authentication_ExternalSourceCondition_To_v1alpha1_ExternalSourceCondition(in, out, s) +} + +func autoConvert_v1alpha1_ExtraMapping_To_authentication_ExtraMapping(in *ExtraMapping, out *authentication.ExtraMapping, s conversion.Scope) error { + out.Key = in.Key + out.ValueExpression = in.ValueExpression + return nil +} + +// Convert_v1alpha1_ExtraMapping_To_authentication_ExtraMapping is an autogenerated conversion function. +func Convert_v1alpha1_ExtraMapping_To_authentication_ExtraMapping(in *ExtraMapping, out *authentication.ExtraMapping, s conversion.Scope) error { + return autoConvert_v1alpha1_ExtraMapping_To_authentication_ExtraMapping(in, out, s) +} + +func autoConvert_authentication_ExtraMapping_To_v1alpha1_ExtraMapping(in *authentication.ExtraMapping, out *ExtraMapping, s conversion.Scope) error { + out.Key = in.Key + out.ValueExpression = in.ValueExpression + return nil +} + +// Convert_authentication_ExtraMapping_To_v1alpha1_ExtraMapping is an autogenerated conversion function. +func Convert_authentication_ExtraMapping_To_v1alpha1_ExtraMapping(in *authentication.ExtraMapping, out *ExtraMapping, s conversion.Scope) error { + return autoConvert_authentication_ExtraMapping_To_v1alpha1_ExtraMapping(in, out, s) +} + +func autoConvert_v1alpha1_Issuer_To_authentication_Issuer(in *Issuer, out *authentication.Issuer, s conversion.Scope) error { + out.URL = in.URL + out.DiscoveryURL = in.DiscoveryURL + out.CertificateAuthority = in.CertificateAuthority + out.Audiences = *(*[]string)(unsafe.Pointer(&in.Audiences)) + out.AudienceMatchPolicy = authentication.AudienceMatchPolicyType(in.AudienceMatchPolicy) + return nil +} + +// Convert_v1alpha1_Issuer_To_authentication_Issuer is an autogenerated conversion function. +func Convert_v1alpha1_Issuer_To_authentication_Issuer(in *Issuer, out *authentication.Issuer, s conversion.Scope) error { + return autoConvert_v1alpha1_Issuer_To_authentication_Issuer(in, out, s) +} + +func autoConvert_authentication_Issuer_To_v1alpha1_Issuer(in *authentication.Issuer, out *Issuer, s conversion.Scope) error { + out.URL = in.URL + out.DiscoveryURL = in.DiscoveryURL + out.CertificateAuthority = in.CertificateAuthority + out.Audiences = *(*[]string)(unsafe.Pointer(&in.Audiences)) + out.AudienceMatchPolicy = AudienceMatchPolicyType(in.AudienceMatchPolicy) + return nil +} + +// Convert_authentication_Issuer_To_v1alpha1_Issuer is an autogenerated conversion function. +func Convert_authentication_Issuer_To_v1alpha1_Issuer(in *authentication.Issuer, out *Issuer, s conversion.Scope) error { + return autoConvert_authentication_Issuer_To_v1alpha1_Issuer(in, out, s) +} + +func autoConvert_v1alpha1_JWTAuthenticator_To_authentication_JWTAuthenticator(in *JWTAuthenticator, out *authentication.JWTAuthenticator, s conversion.Scope) error { + out.Issuer = (*authentication.Issuer)(unsafe.Pointer(in.Issuer)) + out.ClaimValidationRules = *(*[]authentication.ClaimValidationRule)(unsafe.Pointer(&in.ClaimValidationRules)) + out.ClaimMappings = (*authentication.ClaimMappings)(unsafe.Pointer(in.ClaimMappings)) + out.UserValidationRules = *(*[]authentication.UserValidationRule)(unsafe.Pointer(&in.UserValidationRules)) + out.ExternalClaimsSources = *(*[]authentication.ExternalClaimsSource)(unsafe.Pointer(&in.ExternalClaimsSources)) + return nil +} + +// Convert_v1alpha1_JWTAuthenticator_To_authentication_JWTAuthenticator is an autogenerated conversion function. +func Convert_v1alpha1_JWTAuthenticator_To_authentication_JWTAuthenticator(in *JWTAuthenticator, out *authentication.JWTAuthenticator, s conversion.Scope) error { + return autoConvert_v1alpha1_JWTAuthenticator_To_authentication_JWTAuthenticator(in, out, s) +} + +func autoConvert_authentication_JWTAuthenticator_To_v1alpha1_JWTAuthenticator(in *authentication.JWTAuthenticator, out *JWTAuthenticator, s conversion.Scope) error { + out.Issuer = (*Issuer)(unsafe.Pointer(in.Issuer)) + out.ClaimValidationRules = *(*[]ClaimValidationRule)(unsafe.Pointer(&in.ClaimValidationRules)) + out.ClaimMappings = (*ClaimMappings)(unsafe.Pointer(in.ClaimMappings)) + out.UserValidationRules = *(*[]UserValidationRule)(unsafe.Pointer(&in.UserValidationRules)) + out.ExternalClaimsSources = *(*[]ExternalClaimsSource)(unsafe.Pointer(&in.ExternalClaimsSources)) + return nil +} + +// Convert_authentication_JWTAuthenticator_To_v1alpha1_JWTAuthenticator is an autogenerated conversion function. +func Convert_authentication_JWTAuthenticator_To_v1alpha1_JWTAuthenticator(in *authentication.JWTAuthenticator, out *JWTAuthenticator, s conversion.Scope) error { + return autoConvert_authentication_JWTAuthenticator_To_v1alpha1_JWTAuthenticator(in, out, s) +} + +func autoConvert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression(in *PrefixedClaimOrExpression, out *authentication.PrefixedClaimOrExpression, s conversion.Scope) error { + out.Claim = in.Claim + out.Prefix = (*string)(unsafe.Pointer(in.Prefix)) + out.Expression = in.Expression + return nil +} + +// Convert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression is an autogenerated conversion function. +func Convert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression(in *PrefixedClaimOrExpression, out *authentication.PrefixedClaimOrExpression, s conversion.Scope) error { + return autoConvert_v1alpha1_PrefixedClaimOrExpression_To_authentication_PrefixedClaimOrExpression(in, out, s) +} + +func autoConvert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression(in *authentication.PrefixedClaimOrExpression, out *PrefixedClaimOrExpression, s conversion.Scope) error { + out.Claim = in.Claim + out.Prefix = (*string)(unsafe.Pointer(in.Prefix)) + out.Expression = in.Expression + return nil +} + +// Convert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression is an autogenerated conversion function. +func Convert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression(in *authentication.PrefixedClaimOrExpression, out *PrefixedClaimOrExpression, s conversion.Scope) error { + return autoConvert_authentication_PrefixedClaimOrExpression_To_v1alpha1_PrefixedClaimOrExpression(in, out, s) +} + +func autoConvert_v1alpha1_SourceURL_To_authentication_SourceURL(in *SourceURL, out *authentication.SourceURL, s conversion.Scope) error { + out.Hostname = (*string)(unsafe.Pointer(in.Hostname)) + out.PathExpression = (*string)(unsafe.Pointer(in.PathExpression)) + return nil +} + +// Convert_v1alpha1_SourceURL_To_authentication_SourceURL is an autogenerated conversion function. +func Convert_v1alpha1_SourceURL_To_authentication_SourceURL(in *SourceURL, out *authentication.SourceURL, s conversion.Scope) error { + return autoConvert_v1alpha1_SourceURL_To_authentication_SourceURL(in, out, s) +} + +func autoConvert_authentication_SourceURL_To_v1alpha1_SourceURL(in *authentication.SourceURL, out *SourceURL, s conversion.Scope) error { + out.Hostname = (*string)(unsafe.Pointer(in.Hostname)) + out.PathExpression = (*string)(unsafe.Pointer(in.PathExpression)) + return nil +} + +// Convert_authentication_SourceURL_To_v1alpha1_SourceURL is an autogenerated conversion function. +func Convert_authentication_SourceURL_To_v1alpha1_SourceURL(in *authentication.SourceURL, out *SourceURL, s conversion.Scope) error { + return autoConvert_authentication_SourceURL_To_v1alpha1_SourceURL(in, out, s) +} + +func autoConvert_v1alpha1_SourcedClaimMapping_To_authentication_SourcedClaimMapping(in *SourcedClaimMapping, out *authentication.SourcedClaimMapping, s conversion.Scope) error { + out.Name = (*string)(unsafe.Pointer(in.Name)) + out.Expression = (*string)(unsafe.Pointer(in.Expression)) + return nil +} + +// Convert_v1alpha1_SourcedClaimMapping_To_authentication_SourcedClaimMapping is an autogenerated conversion function. +func Convert_v1alpha1_SourcedClaimMapping_To_authentication_SourcedClaimMapping(in *SourcedClaimMapping, out *authentication.SourcedClaimMapping, s conversion.Scope) error { + return autoConvert_v1alpha1_SourcedClaimMapping_To_authentication_SourcedClaimMapping(in, out, s) +} + +func autoConvert_authentication_SourcedClaimMapping_To_v1alpha1_SourcedClaimMapping(in *authentication.SourcedClaimMapping, out *SourcedClaimMapping, s conversion.Scope) error { + out.Name = (*string)(unsafe.Pointer(in.Name)) + out.Expression = (*string)(unsafe.Pointer(in.Expression)) + return nil +} + +// Convert_authentication_SourcedClaimMapping_To_v1alpha1_SourcedClaimMapping is an autogenerated conversion function. +func Convert_authentication_SourcedClaimMapping_To_v1alpha1_SourcedClaimMapping(in *authentication.SourcedClaimMapping, out *SourcedClaimMapping, s conversion.Scope) error { + return autoConvert_authentication_SourcedClaimMapping_To_v1alpha1_SourcedClaimMapping(in, out, s) +} + +func autoConvert_v1alpha1_TLS_To_authentication_TLS(in *TLS, out *authentication.TLS, s conversion.Scope) error { + out.CertificateAuthority = (*string)(unsafe.Pointer(in.CertificateAuthority)) + return nil +} + +// Convert_v1alpha1_TLS_To_authentication_TLS is an autogenerated conversion function. +func Convert_v1alpha1_TLS_To_authentication_TLS(in *TLS, out *authentication.TLS, s conversion.Scope) error { + return autoConvert_v1alpha1_TLS_To_authentication_TLS(in, out, s) +} + +func autoConvert_authentication_TLS_To_v1alpha1_TLS(in *authentication.TLS, out *TLS, s conversion.Scope) error { + out.CertificateAuthority = (*string)(unsafe.Pointer(in.CertificateAuthority)) + return nil +} + +// Convert_authentication_TLS_To_v1alpha1_TLS is an autogenerated conversion function. +func Convert_authentication_TLS_To_v1alpha1_TLS(in *authentication.TLS, out *TLS, s conversion.Scope) error { + return autoConvert_authentication_TLS_To_v1alpha1_TLS(in, out, s) +} + +func autoConvert_v1alpha1_UserValidationRule_To_authentication_UserValidationRule(in *UserValidationRule, out *authentication.UserValidationRule, s conversion.Scope) error { + out.Expression = in.Expression + out.Message = in.Message + return nil +} + +// Convert_v1alpha1_UserValidationRule_To_authentication_UserValidationRule is an autogenerated conversion function. +func Convert_v1alpha1_UserValidationRule_To_authentication_UserValidationRule(in *UserValidationRule, out *authentication.UserValidationRule, s conversion.Scope) error { + return autoConvert_v1alpha1_UserValidationRule_To_authentication_UserValidationRule(in, out, s) +} + +func autoConvert_authentication_UserValidationRule_To_v1alpha1_UserValidationRule(in *authentication.UserValidationRule, out *UserValidationRule, s conversion.Scope) error { + out.Expression = in.Expression + out.Message = in.Message + return nil +} + +// Convert_authentication_UserValidationRule_To_v1alpha1_UserValidationRule is an autogenerated conversion function. +func Convert_authentication_UserValidationRule_To_v1alpha1_UserValidationRule(in *authentication.UserValidationRule, out *UserValidationRule, s conversion.Scope) error { + return autoConvert_authentication_UserValidationRule_To_v1alpha1_UserValidationRule(in, out, s) +} diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.deepcopy.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.deepcopy.go new file mode 100644 index 000000000000..d62e0272eecd --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1/zz_generated.deepcopy.go @@ -0,0 +1,406 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package v1alpha1 + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Authentication) DeepCopyInto(out *Authentication) { + *out = *in + if in.Type != nil { + in, out := &in.Type, &out.Type + *out = new(AuthenticationType) + **out = **in + } + if in.ClientCredential != nil { + in, out := &in.ClientCredential, &out.ClientCredential + *out = new(ClientCredentialConfig) + (*in).DeepCopyInto(*out) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Authentication. +func (in *Authentication) DeepCopy() *Authentication { + if in == nil { + return nil + } + out := new(Authentication) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AuthenticationConfiguration) DeepCopyInto(out *AuthenticationConfiguration) { + *out = *in + out.TypeMeta = in.TypeMeta + if in.JWT != nil { + in, out := &in.JWT, &out.JWT + *out = make([]JWTAuthenticator, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationConfiguration. +func (in *AuthenticationConfiguration) DeepCopy() *AuthenticationConfiguration { + if in == nil { + return nil + } + out := new(AuthenticationConfiguration) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *AuthenticationConfiguration) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimMappings) DeepCopyInto(out *ClaimMappings) { + *out = *in + in.Username.DeepCopyInto(&out.Username) + in.Groups.DeepCopyInto(&out.Groups) + out.UID = in.UID + if in.Extra != nil { + in, out := &in.Extra, &out.Extra + *out = make([]ExtraMapping, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimMappings. +func (in *ClaimMappings) DeepCopy() *ClaimMappings { + if in == nil { + return nil + } + out := new(ClaimMappings) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimOrExpression) DeepCopyInto(out *ClaimOrExpression) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimOrExpression. +func (in *ClaimOrExpression) DeepCopy() *ClaimOrExpression { + if in == nil { + return nil + } + out := new(ClaimOrExpression) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimValidationRule) DeepCopyInto(out *ClaimValidationRule) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimValidationRule. +func (in *ClaimValidationRule) DeepCopy() *ClaimValidationRule { + if in == nil { + return nil + } + out := new(ClaimValidationRule) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClientCredentialConfig) DeepCopyInto(out *ClientCredentialConfig) { + *out = *in + if in.Scopes != nil { + in, out := &in.Scopes, &out.Scopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.TLS != nil { + in, out := &in.TLS, &out.TLS + *out = new(TLS) + (*in).DeepCopyInto(*out) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientCredentialConfig. +func (in *ClientCredentialConfig) DeepCopy() *ClientCredentialConfig { + if in == nil { + return nil + } + out := new(ClientCredentialConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalClaimsSource) DeepCopyInto(out *ExternalClaimsSource) { + *out = *in + if in.Authentication != nil { + in, out := &in.Authentication, &out.Authentication + *out = new(Authentication) + (*in).DeepCopyInto(*out) + } + if in.TLS != nil { + in, out := &in.TLS, &out.TLS + *out = new(TLS) + (*in).DeepCopyInto(*out) + } + if in.URL != nil { + in, out := &in.URL, &out.URL + *out = new(SourceURL) + (*in).DeepCopyInto(*out) + } + if in.Mappings != nil { + in, out := &in.Mappings, &out.Mappings + *out = make([]SourcedClaimMapping, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]ExternalSourceCondition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalClaimsSource. +func (in *ExternalClaimsSource) DeepCopy() *ExternalClaimsSource { + if in == nil { + return nil + } + out := new(ExternalClaimsSource) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalSourceCondition) DeepCopyInto(out *ExternalSourceCondition) { + *out = *in + if in.Expression != nil { + in, out := &in.Expression, &out.Expression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSourceCondition. +func (in *ExternalSourceCondition) DeepCopy() *ExternalSourceCondition { + if in == nil { + return nil + } + out := new(ExternalSourceCondition) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExtraMapping) DeepCopyInto(out *ExtraMapping) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraMapping. +func (in *ExtraMapping) DeepCopy() *ExtraMapping { + if in == nil { + return nil + } + out := new(ExtraMapping) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Issuer) DeepCopyInto(out *Issuer) { + *out = *in + if in.Audiences != nil { + in, out := &in.Audiences, &out.Audiences + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Issuer. +func (in *Issuer) DeepCopy() *Issuer { + if in == nil { + return nil + } + out := new(Issuer) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator) { + *out = *in + if in.Issuer != nil { + in, out := &in.Issuer, &out.Issuer + *out = new(Issuer) + (*in).DeepCopyInto(*out) + } + if in.ClaimValidationRules != nil { + in, out := &in.ClaimValidationRules, &out.ClaimValidationRules + *out = make([]ClaimValidationRule, len(*in)) + copy(*out, *in) + } + if in.ClaimMappings != nil { + in, out := &in.ClaimMappings, &out.ClaimMappings + *out = new(ClaimMappings) + (*in).DeepCopyInto(*out) + } + if in.UserValidationRules != nil { + in, out := &in.UserValidationRules, &out.UserValidationRules + *out = make([]UserValidationRule, len(*in)) + copy(*out, *in) + } + if in.ExternalClaimsSources != nil { + in, out := &in.ExternalClaimsSources, &out.ExternalClaimsSources + *out = make([]ExternalClaimsSource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator. +func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator { + if in == nil { + return nil + } + out := new(JWTAuthenticator) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PrefixedClaimOrExpression) DeepCopyInto(out *PrefixedClaimOrExpression) { + *out = *in + if in.Prefix != nil { + in, out := &in.Prefix, &out.Prefix + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrefixedClaimOrExpression. +func (in *PrefixedClaimOrExpression) DeepCopy() *PrefixedClaimOrExpression { + if in == nil { + return nil + } + out := new(PrefixedClaimOrExpression) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourceURL) DeepCopyInto(out *SourceURL) { + *out = *in + if in.Hostname != nil { + in, out := &in.Hostname, &out.Hostname + *out = new(string) + **out = **in + } + if in.PathExpression != nil { + in, out := &in.PathExpression, &out.PathExpression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceURL. +func (in *SourceURL) DeepCopy() *SourceURL { + if in == nil { + return nil + } + out := new(SourceURL) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourcedClaimMapping) DeepCopyInto(out *SourcedClaimMapping) { + *out = *in + if in.Name != nil { + in, out := &in.Name, &out.Name + *out = new(string) + **out = **in + } + if in.Expression != nil { + in, out := &in.Expression, &out.Expression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourcedClaimMapping. +func (in *SourcedClaimMapping) DeepCopy() *SourcedClaimMapping { + if in == nil { + return nil + } + out := new(SourcedClaimMapping) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TLS) DeepCopyInto(out *TLS) { + *out = *in + if in.CertificateAuthority != nil { + in, out := &in.CertificateAuthority, &out.CertificateAuthority + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS. +func (in *TLS) DeepCopy() *TLS { + if in == nil { + return nil + } + out := new(TLS) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *UserValidationRule) DeepCopyInto(out *UserValidationRule) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserValidationRule. +func (in *UserValidationRule) DeepCopy() *UserValidationRule { + if in == nil { + return nil + } + out := new(UserValidationRule) + in.DeepCopyInto(out) + return out +} diff --git a/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/zz_generated.deepcopy.go b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/zz_generated.deepcopy.go new file mode 100644 index 000000000000..1332d28cb1db --- /dev/null +++ b/vendor/github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/zz_generated.deepcopy.go @@ -0,0 +1,406 @@ +//go:build !ignore_autogenerated +// +build !ignore_autogenerated + +// Code generated by deepcopy-gen. DO NOT EDIT. + +package authentication + +import ( + runtime "k8s.io/apimachinery/pkg/runtime" +) + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Authentication) DeepCopyInto(out *Authentication) { + *out = *in + if in.Type != nil { + in, out := &in.Type, &out.Type + *out = new(AuthenticationType) + **out = **in + } + if in.ClientCredential != nil { + in, out := &in.ClientCredential, &out.ClientCredential + *out = new(ClientCredentialConfig) + (*in).DeepCopyInto(*out) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Authentication. +func (in *Authentication) DeepCopy() *Authentication { + if in == nil { + return nil + } + out := new(Authentication) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *AuthenticationConfiguration) DeepCopyInto(out *AuthenticationConfiguration) { + *out = *in + out.TypeMeta = in.TypeMeta + if in.JWT != nil { + in, out := &in.JWT, &out.JWT + *out = make([]JWTAuthenticator, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AuthenticationConfiguration. +func (in *AuthenticationConfiguration) DeepCopy() *AuthenticationConfiguration { + if in == nil { + return nil + } + out := new(AuthenticationConfiguration) + in.DeepCopyInto(out) + return out +} + +// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object. +func (in *AuthenticationConfiguration) DeepCopyObject() runtime.Object { + if c := in.DeepCopy(); c != nil { + return c + } + return nil +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimMappings) DeepCopyInto(out *ClaimMappings) { + *out = *in + in.Username.DeepCopyInto(&out.Username) + in.Groups.DeepCopyInto(&out.Groups) + out.UID = in.UID + if in.Extra != nil { + in, out := &in.Extra, &out.Extra + *out = make([]ExtraMapping, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimMappings. +func (in *ClaimMappings) DeepCopy() *ClaimMappings { + if in == nil { + return nil + } + out := new(ClaimMappings) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimOrExpression) DeepCopyInto(out *ClaimOrExpression) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimOrExpression. +func (in *ClaimOrExpression) DeepCopy() *ClaimOrExpression { + if in == nil { + return nil + } + out := new(ClaimOrExpression) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClaimValidationRule) DeepCopyInto(out *ClaimValidationRule) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClaimValidationRule. +func (in *ClaimValidationRule) DeepCopy() *ClaimValidationRule { + if in == nil { + return nil + } + out := new(ClaimValidationRule) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ClientCredentialConfig) DeepCopyInto(out *ClientCredentialConfig) { + *out = *in + if in.Scopes != nil { + in, out := &in.Scopes, &out.Scopes + *out = make([]string, len(*in)) + copy(*out, *in) + } + if in.TLS != nil { + in, out := &in.TLS, &out.TLS + *out = new(TLS) + (*in).DeepCopyInto(*out) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ClientCredentialConfig. +func (in *ClientCredentialConfig) DeepCopy() *ClientCredentialConfig { + if in == nil { + return nil + } + out := new(ClientCredentialConfig) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalClaimsSource) DeepCopyInto(out *ExternalClaimsSource) { + *out = *in + if in.Authentication != nil { + in, out := &in.Authentication, &out.Authentication + *out = new(Authentication) + (*in).DeepCopyInto(*out) + } + if in.TLS != nil { + in, out := &in.TLS, &out.TLS + *out = new(TLS) + (*in).DeepCopyInto(*out) + } + if in.URL != nil { + in, out := &in.URL, &out.URL + *out = new(SourceURL) + (*in).DeepCopyInto(*out) + } + if in.Mappings != nil { + in, out := &in.Mappings, &out.Mappings + *out = make([]SourcedClaimMapping, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + if in.Conditions != nil { + in, out := &in.Conditions, &out.Conditions + *out = make([]ExternalSourceCondition, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalClaimsSource. +func (in *ExternalClaimsSource) DeepCopy() *ExternalClaimsSource { + if in == nil { + return nil + } + out := new(ExternalClaimsSource) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExternalSourceCondition) DeepCopyInto(out *ExternalSourceCondition) { + *out = *in + if in.Expression != nil { + in, out := &in.Expression, &out.Expression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExternalSourceCondition. +func (in *ExternalSourceCondition) DeepCopy() *ExternalSourceCondition { + if in == nil { + return nil + } + out := new(ExternalSourceCondition) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *ExtraMapping) DeepCopyInto(out *ExtraMapping) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraMapping. +func (in *ExtraMapping) DeepCopy() *ExtraMapping { + if in == nil { + return nil + } + out := new(ExtraMapping) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *Issuer) DeepCopyInto(out *Issuer) { + *out = *in + if in.Audiences != nil { + in, out := &in.Audiences, &out.Audiences + *out = make([]string, len(*in)) + copy(*out, *in) + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Issuer. +func (in *Issuer) DeepCopy() *Issuer { + if in == nil { + return nil + } + out := new(Issuer) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *JWTAuthenticator) DeepCopyInto(out *JWTAuthenticator) { + *out = *in + if in.Issuer != nil { + in, out := &in.Issuer, &out.Issuer + *out = new(Issuer) + (*in).DeepCopyInto(*out) + } + if in.ClaimValidationRules != nil { + in, out := &in.ClaimValidationRules, &out.ClaimValidationRules + *out = make([]ClaimValidationRule, len(*in)) + copy(*out, *in) + } + if in.ClaimMappings != nil { + in, out := &in.ClaimMappings, &out.ClaimMappings + *out = new(ClaimMappings) + (*in).DeepCopyInto(*out) + } + if in.UserValidationRules != nil { + in, out := &in.UserValidationRules, &out.UserValidationRules + *out = make([]UserValidationRule, len(*in)) + copy(*out, *in) + } + if in.ExternalClaimsSources != nil { + in, out := &in.ExternalClaimsSources, &out.ExternalClaimsSources + *out = make([]ExternalClaimsSource, len(*in)) + for i := range *in { + (*in)[i].DeepCopyInto(&(*out)[i]) + } + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new JWTAuthenticator. +func (in *JWTAuthenticator) DeepCopy() *JWTAuthenticator { + if in == nil { + return nil + } + out := new(JWTAuthenticator) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *PrefixedClaimOrExpression) DeepCopyInto(out *PrefixedClaimOrExpression) { + *out = *in + if in.Prefix != nil { + in, out := &in.Prefix, &out.Prefix + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PrefixedClaimOrExpression. +func (in *PrefixedClaimOrExpression) DeepCopy() *PrefixedClaimOrExpression { + if in == nil { + return nil + } + out := new(PrefixedClaimOrExpression) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourceURL) DeepCopyInto(out *SourceURL) { + *out = *in + if in.Hostname != nil { + in, out := &in.Hostname, &out.Hostname + *out = new(string) + **out = **in + } + if in.PathExpression != nil { + in, out := &in.PathExpression, &out.PathExpression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourceURL. +func (in *SourceURL) DeepCopy() *SourceURL { + if in == nil { + return nil + } + out := new(SourceURL) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *SourcedClaimMapping) DeepCopyInto(out *SourcedClaimMapping) { + *out = *in + if in.Name != nil { + in, out := &in.Name, &out.Name + *out = new(string) + **out = **in + } + if in.Expression != nil { + in, out := &in.Expression, &out.Expression + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SourcedClaimMapping. +func (in *SourcedClaimMapping) DeepCopy() *SourcedClaimMapping { + if in == nil { + return nil + } + out := new(SourcedClaimMapping) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *TLS) DeepCopyInto(out *TLS) { + *out = *in + if in.CertificateAuthority != nil { + in, out := &in.CertificateAuthority, &out.CertificateAuthority + *out = new(string) + **out = **in + } + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new TLS. +func (in *TLS) DeepCopy() *TLS { + if in == nil { + return nil + } + out := new(TLS) + in.DeepCopyInto(out) + return out +} + +// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil. +func (in *UserValidationRule) DeepCopyInto(out *UserValidationRule) { + *out = *in + return +} + +// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new UserValidationRule. +func (in *UserValidationRule) DeepCopy() *UserValidationRule { + if in == nil { + return nil + } + out := new(UserValidationRule) + in.DeepCopyInto(out) + return out +} diff --git a/vendor/modules.txt b/vendor/modules.txt index 9ac103adc06f..9ac9a8d6838c 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -1137,7 +1137,7 @@ github.com/openshift/hypershift/api/scheduling github.com/openshift/hypershift/api/scheduling/v1alpha1 github.com/openshift/hypershift/api/util/configrefs github.com/openshift/hypershift/api/util/ipnet -# github.com/openshift/library-go v0.0.0-20251204132909-8814e976a023 +# github.com/openshift/library-go v0.0.0-20260309173530-9ed71ac3148f ## explicit; go 1.24.0 github.com/openshift/library-go/pkg/apiserver/jsonpatch github.com/openshift/library-go/pkg/authorization/hardcodedauthorizer @@ -1172,6 +1172,10 @@ github.com/openshift/library-go/test/library/metrics ## explicit; go 1.24.0 github.com/openshift/multi-operator-manager/pkg/library/libraryinputresources github.com/openshift/multi-operator-manager/pkg/library/libraryoutputresources +# github.com/openshift/oauth-apiserver v0.0.0-20260626184649-9e9722dd2f3f +## explicit; go 1.24.0 +github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication +github.com/openshift/oauth-apiserver/pkg/externaloidc/apis/authentication/v1alpha1 # github.com/opentracing/opentracing-go v1.2.0 ## explicit; go 1.14 github.com/opentracing/opentracing-go From 9e3de311c45bfa087ee47bec5a894cec532b0d5f Mon Sep 17 00:00:00 2001 From: Ilias Rinis Date: Wed, 1 Jul 2026 16:27:45 +0200 Subject: [PATCH 10/12] chore(deps): pull in POC generator library Also bump transitive dependencides, including openshift/api --- api/go.mod | 11 +- api/go.sum | 20 +- ..._generated.featuregated-crd-manifests.yaml | 10 +- .../AAA_ungated.yaml | 112 +- .../ClusterUpdateAcceptRisks.yaml | 112 +- .../ClusterVersionOperatorConfiguration.yaml | 112 +- .../ExternalOIDC.yaml | 112 +- .../ExternalOIDCExternalClaimsSourcing.yaml | 8184 ++++++++++++++++ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 112 +- .../ExternalOIDCWithUpstreamParity.yaml | 112 +- .../GCPPlatform.yaml | 112 +- .../HCPEtcdBackup.yaml | 112 +- ...perShiftOnlyDynamicResourceAllocation.yaml | 112 +- .../ImageStreamImportMode.yaml | 112 +- .../KMSEncryption.yaml | 7722 +++++++++++++++ ....yaml => NetworkObservabilityInstall.yaml} | 212 +- .../OpenStack.yaml | 112 +- .../TLSAdherence.yaml | 112 +- .../TLSGroupPreferences.yaml | 7470 ++++++++++++++ .../AAA_ungated.yaml | 112 +- .../ClusterUpdateAcceptRisks.yaml | 112 +- .../ClusterVersionOperatorConfiguration.yaml | 112 +- .../ExternalOIDC.yaml | 112 +- .../ExternalOIDCExternalClaimsSourcing.yaml | 8027 +++++++++++++++ ...ernalOIDCWithUIDAndExtraClaimMappings.yaml | 112 +- .../ExternalOIDCWithUpstreamParity.yaml | 112 +- .../GCPPlatform.yaml | 112 +- .../HCPEtcdBackup.yaml | 112 +- ...perShiftOnlyDynamicResourceAllocation.yaml | 112 +- .../ImageStreamImportMode.yaml | 112 +- .../KMSEncryption.yaml | 7565 ++++++++++++++ ....yaml => NetworkObservabilityInstall.yaml} | 212 +- .../OpenStack.yaml | 112 +- .../TLSAdherence.yaml | 112 +- .../TLSGroupPreferences.yaml | 7313 ++++++++++++++ .../github.com/openshift/api/config/v1/doc.go | 1 + .../openshift/api/config/v1/register.go | 2 + .../api/config/v1/types_apiserver.go | 7 +- .../api/config/v1/types_authentication.go | 391 +- .../api/config/v1/types_cluster_operator.go | 5 +- .../api/config/v1/types_cluster_version.go | 25 +- .../types_crio_credential_provider_config.go | 186 + .../openshift/api/config/v1/types_image.go | 30 + .../api/config/v1/types_infrastructure.go | 34 +- .../api/config/v1/types_kmsencryption.go | 264 +- .../openshift/api/config/v1/types_network.go | 33 + .../api/config/v1/types_tlssecurityprofile.go | 122 +- .../api/config/v1/zz_generated.deepcopy.go | 443 +- ..._generated.featuregated-crd-manifests.yaml | 34 +- .../api/config/v1/zz_generated.model_name.go | 1566 +++ .../v1/zz_generated.swagger_doc_generated.go | 255 +- .../openshift/api/operator/v1/doc.go | 1 + .../api/operator/v1/types_authentication.go | 5 + .../operator/v1/types_csi_cluster_driver.go | 163 +- .../openshift/api/operator/v1/types_etcd.go | 4 +- ..._ingress.go => types_ingresscontroller.go} | 46 + .../api/operator/v1/types_kmsencryption.go | 80 + .../api/operator/v1/types_kubeapiserver.go | 5 + .../operator/v1/types_openshiftapiserver.go | 5 + .../api/operator/v1/zz_generated.deepcopy.go | 162 +- ..._generated.featuregated-crd-manifests.yaml | 8 +- .../operator/v1/zz_generated.model_name.go | 1226 +++ .../v1/zz_generated.swagger_doc_generated.go | 107 +- api/vendor/k8s.io/klog/v2/README.md | 2 - .../klog/v2/internal/serialize/keyvalues.go | 232 +- .../internal/serialize/keyvalues_no_slog.go | 10 +- .../v2/internal/serialize/keyvalues_slog.go | 12 +- api/vendor/k8s.io/klog/v2/klog.go | 87 +- api/vendor/k8s.io/klog/v2/klogr.go | 4 +- api/vendor/k8s.io/klog/v2/klogr_slog.go | 11 +- api/vendor/modules.txt | 16 +- .../v6/value/reflectcache.go | 4 + ...usters-Hypershift-CustomNoUpgrade.crd.yaml | 900 +- ...hostedclusters-Hypershift-Default.crd.yaml | 112 +- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 546 +- ...planes-Hypershift-CustomNoUpgrade.crd.yaml | 900 +- ...dcontrolplanes-Hypershift-Default.crd.yaml | 112 +- ...s-Hypershift-TechPreviewNoUpgrade.crd.yaml | 546 +- go.mod | 46 +- go.sum | 82 +- .../openshift/api/.ci-operator.yaml | 2 +- .../github.com/openshift/api/Dockerfile.ocp | 4 +- vendor/github.com/openshift/api/Makefile | 21 + .../api/apiextensions/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 61 + .../openshift/api/apiserver/v1/doc.go | 1 + .../apiserver/v1/zz_generated.model_name.go | 46 + .../openshift/api/apps/.codegen.yaml | 2 + .../github.com/openshift/api/apps/v1/doc.go | 1 + .../api/apps/v1/zz_generated.model_name.go | 116 + .../openshift/api/authorization/.codegen.yaml | 2 + .../openshift/api/authorization/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 171 + .../openshift/api/build/.codegen.yaml | 2 + .../github.com/openshift/api/build/v1/doc.go | 1 + .../api/build/v1/zz_generated.model_name.go | 301 + .../openshift/api/cloudnetwork/.codegen.yaml | 2 + .../openshift/api/cloudnetwork/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 26 + .../github.com/openshift/api/config/v1/doc.go | 1 + .../openshift/api/config/v1/register.go | 2 + .../api/config/v1/types_apiserver.go | 7 +- .../api/config/v1/types_authentication.go | 391 +- .../api/config/v1/types_cluster_operator.go | 5 +- .../api/config/v1/types_cluster_version.go | 25 +- .../types_crio_credential_provider_config.go | 186 + .../openshift/api/config/v1/types_image.go | 30 + .../api/config/v1/types_infrastructure.go | 34 +- .../api/config/v1/types_kmsencryption.go | 264 +- .../openshift/api/config/v1/types_network.go | 33 + .../api/config/v1/types_tlssecurityprofile.go | 122 +- .../api/config/v1/zz_generated.deepcopy.go | 443 +- ..._generated.featuregated-crd-manifests.yaml | 34 +- .../api/config/v1/zz_generated.model_name.go | 1566 +++ .../v1/zz_generated.swagger_doc_generated.go | 255 +- .../openshift/api/config/v1alpha1/doc.go | 1 + .../v1alpha1/types_cluster_monitoring.go | 907 +- .../config/v1alpha1/zz_generated.deepcopy.go | 418 +- .../v1alpha1/zz_generated.model_name.go | 461 + .../zz_generated.swagger_doc_generated.go | 240 +- .../openshift/api/config/v1alpha2/doc.go | 1 + .../v1alpha2/zz_generated.model_name.go | 61 + .../openshift/api/console/v1/doc.go | 1 + .../api/console/v1/types_console_plugin.go | 1 - ..._generated.featuregated-crd-manifests.yaml | 3 +- .../api/console/v1/zz_generated.model_name.go | 226 + .../github.com/openshift/api/etcd/v1/doc.go | 1 + .../api/etcd/v1/zz_generated.model_name.go | 41 + .../openshift/api/etcd/v1alpha1/doc.go | 1 + .../etcd/v1alpha1/zz_generated.model_name.go | 41 + vendor/github.com/openshift/api/features.md | 31 +- .../openshift/api/helm/v1beta1/doc.go | 1 + .../helm/v1beta1/zz_generated.model_name.go | 51 + .../openshift/api/image/.codegen.yaml | 5 + .../github.com/openshift/api/image/v1/doc.go | 1 + .../api/image/v1/zz_generated.model_name.go | 196 + .../openshift/api/imageregistry/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 141 + vendor/github.com/openshift/api/install.go | 6 - .../openshift/api/kubecontrolplane/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 76 + .../openshift/api/legacyconfig/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 406 + .../openshift/api/machine/v1/doc.go | 1 + .../api/machine/v1/zz_generated.model_name.go | 211 + .../openshift/api/machine/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 76 + .../openshift/api/machine/v1beta1/doc.go | 1 + .../api/machine/v1beta1/types_machineset.go | 8 + .../v1beta1/zz_generated.model_name.go | 376 + .../zz_generated.swagger_doc_generated.go | 1 + .../api/machineconfiguration/v1/doc.go | 1 + .../api/machineconfiguration/v1/register.go | 2 + .../api/machineconfiguration/v1/types.go | 7 + .../v1/types_machineconfignode.go | 4 +- .../v1/types_osimagestream.go | 162 + .../v1/zz_generated.deepcopy.go | 114 + ..._generated.featuregated-crd-manifests.yaml | 29 +- .../v1/zz_generated.model_name.go | 371 + .../v1/zz_generated.swagger_doc_generated.go | 51 +- .../openshift/api/monitoring/v1/doc.go | 1 + .../monitoring/v1/zz_generated.model_name.go | 66 + .../openshift/api/network/.codegen.yaml | 5 +- .../openshift/api/network/v1/doc.go | 1 + .../api/network/v1/zz_generated.model_name.go | 66 + .../openshift/api/network/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 36 + .../api/networkoperator/.codegen.yaml | 2 + .../openshift/api/networkoperator/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 56 + .../openshift/api/oauth/.codegen.yaml | 2 + .../github.com/openshift/api/oauth/v1/doc.go | 1 + .../api/oauth/v1/zz_generated.model_name.go | 76 + .../api/openshiftcontrolplane/v1/doc.go | 1 + .../v1/zz_generated.model_name.go | 131 + .../openshift/api/operator/v1/doc.go | 1 + .../api/operator/v1/types_authentication.go | 5 + .../operator/v1/types_csi_cluster_driver.go | 163 +- .../openshift/api/operator/v1/types_etcd.go | 4 +- ..._ingress.go => types_ingresscontroller.go} | 46 + .../api/operator/v1/types_kmsencryption.go | 80 + .../api/operator/v1/types_kubeapiserver.go | 5 + .../operator/v1/types_openshiftapiserver.go | 5 + .../api/operator/v1/zz_generated.deepcopy.go | 162 +- ..._generated.featuregated-crd-manifests.yaml | 8 +- .../operator/v1/zz_generated.model_name.go | 1226 +++ .../v1/zz_generated.swagger_doc_generated.go | 107 +- .../openshift/api/operator/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 191 + .../api/operatorcontrolplane/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 41 + .../github.com/openshift/api/osin/v1/doc.go | 1 + .../api/osin/v1/zz_generated.model_name.go | 121 + .../openshift/api/project/.codegen.yaml | 2 + .../openshift/api/project/v1/doc.go | 1 + .../api/project/v1/zz_generated.model_name.go | 31 + .../openshift/api/quota/.codegen.yaml | 2 + .../github.com/openshift/api/quota/v1/doc.go | 1 + .../api/quota/v1/zz_generated.model_name.go | 46 + .../openshift/api/route/.codegen.yaml | 2 + .../github.com/openshift/api/route/v1/doc.go | 1 + .../api/route/v1/zz_generated.model_name.go | 86 + .../openshift/api/samples/.codegen.yaml | 2 + .../openshift/api/samples/v1/doc.go | 1 + .../api/samples/v1/zz_generated.model_name.go | 31 + .../openshift/api/security/.codegen.yaml | 2 + .../openshift/api/security/v1/doc.go | 1 + .../openshift/api/security/v1/generated.proto | 5 +- .../openshift/api/security/v1/types.go | 6 +- ..._generated.featuregated-crd-manifests.yaml | 3 +- .../security/v1/zz_generated.model_name.go | 101 + .../v1/zz_generated.swagger_doc_generated.go | 4 +- .../api/servicecertsigner/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 26 + .../api/sharedresource/v1alpha1/doc.go | 1 + .../v1alpha1/zz_generated.model_name.go | 56 + .../openshift/api/template/.codegen.yaml | 2 + .../openshift/api/template/v1/doc.go | 1 + .../template/v1/zz_generated.model_name.go | 71 + .../openshift/api/user/.codegen.yaml | 2 + .../github.com/openshift/api/user/v1/doc.go | 1 + .../api/user/v1/zz_generated.model_name.go | 41 + .../config/v1/apiserverencryption.go | 4 +- .../config/v1/awskmsconfig.go | 42 - .../config/v1/clientcredentialconfig.go | 98 + .../config/v1/clientsecretsecretreference.go | 32 + .../config/v1/customtlsprofile.go | 10 + .../config/v1/externalclaimssource.go | 97 + .../config/v1/externalsourceauthentication.go | 57 + ...ecertificateauthorityconfigmapreference.go | 34 + .../config/v1/externalsourcepredicate.go | 43 + .../config/v1/externalsourcetls.go | 30 + .../config/v1/kmsconfig.go | 44 - .../config/v1/kmspluginconfig.go | 46 + .../config/v1/networkobservabilityspec.go | 33 + .../config/v1/networkspec.go | 12 + .../config/v1/oidcprovider.go | 34 + .../config/v1/registrysources.go | 18 + .../config/v1/sourcedclaimmapping.go | 51 + .../config/v1/sourceurl.go | 67 + .../config/v1/tlsprofilespec.go | 28 + .../config/v1/tlssecurityprofile.go | 36 +- .../config/v1/vaultapproleauthentication.go | 28 + .../config/v1/vaultauthentication.go | 43 + .../config/v1/vaultconfigmapreference.go | 28 + .../config/v1/vaultkmspluginconfig.go | 123 + .../config/v1/vaultsecretreference.go | 28 + .../config/v1/vaulttlsconfig.go | 58 + .../config/v1/vsphereplatformspec.go | 7 +- .../v1alpha1/alertmanagercustomconfig.go | 25 +- .../config/v1alpha1/clustermonitoringspec.go | 43 + .../config/v1alpha1/kubestatemetricsconfig.go | 145 + .../kubestatemetricsresourcelabels.go | 53 + .../config/v1alpha1/monitoringpluginconfig.go | 112 + .../nodeexportercollectorbuddyinfoconfig.go | 37 + .../v1alpha1/nodeexportercollectorconfig.go | 184 + .../nodeexportercollectorcpufreqconfig.go | 36 + .../nodeexportercollectorethtoolconfig.go | 36 + .../nodeexportercollectorksmdconfig.go | 37 + .../nodeexportercollectormountstatsconfig.go | 38 + ...eexportercollectornetclasscollectconfig.go | 36 + .../nodeexportercollectornetclassconfig.go | 53 + .../nodeexportercollectornetdevconfig.go | 37 + .../nodeexportercollectorprocessesconfig.go | 37 + .../nodeexportercollectorsoftirqsconfig.go | 37 + ...deexportercollectorsystemdcollectconfig.go | 40 + .../nodeexportercollectorsystemdconfig.go | 55 + .../nodeexportercollectortcpstatconfig.go | 36 + .../config/v1alpha1/nodeexporterconfig.go | 115 + .../config/v1alpha1/prometheusconfig.go | 2 +- .../config/v1alpha1/retention.go | 44 +- .../config/v1alpha1/thanosquerierconfig.go | 50 + .../thanosquerierrequestloggingconfig.go | 34 + .../applyconfigurations/internal/internal.go | 5228 +++++----- .../config/listers/config/v1alpha1/backup.go | 32 + .../config/v1alpha1/clustermonitoring.go | 32 + .../v1alpha1/criocredentialproviderconfig.go | 32 + .../config/v1alpha1/expansion_generated.go | 23 + .../config/v1alpha1/insightsdatagather.go | 32 + .../config/listers/config/v1alpha1/pki.go | 32 + .../applyconfigurations/internal/internal.go | 1381 +-- .../operator/v1/etcdspec.go | 2 +- .../operator/v1/kmsencryptionstatus.go | 31 + .../operator/v1/kmspluginhealthreport.go | 91 + .../operator/v1/kubeapiserverstatus.go | 10 + .../operator/v1/oauthapiserverstatus.go | 10 + .../operator/v1/openshiftapiserverstatus.go | 10 + .../applyconfigurations/internal/internal.go | 264 +- .../applyconfigurations/internal/internal.go | 226 +- .../cluster-authentication-operator/LICENSE | 201 + .../generation/oauthapiserver/generate.go | 1068 ++ ..._generated.featuregated-crd-manifests.yaml | 10 +- .../library-go/pkg/config/serving/server.go | 3 +- .../pkg/controller/controllercmd/builder.go | 11 +- .../pkg/controller/controllercmd/cmd.go | 15 +- .../library-go/pkg/crypto/cert_config.go | 225 + .../openshift/library-go/pkg/crypto/crypto.go | 92 +- .../openshift/library-go/pkg/crypto/keygen.go | 118 + .../library-go/pkg/crypto/options.go | 49 + .../library-go/pkg/crypto/tls_adherence.go | 23 + .../pkg/manifestclient/read_roundtripper.go | 7 + .../client_cert_rotation_controller.go | 6 +- .../pkg/operator/certrotation/signer.go | 80 +- .../pkg/operator/certrotation/target.go | 173 +- .../pkg/operator/events/recorder_in_memory.go | 8 +- .../operator/management/management_state.go | 2 +- .../pkg/operator/resource/retry/retry.go | 61 + .../pkg/operator/resource/retry/wait.go | 36 + .../pkg/operator/v1helpers/helpers.go | 11 + .../openshift/library-go/pkg/pki/profile.go | 114 + .../openshift/library-go/pkg/pki/provider.go | 75 + .../openshift/library-go/pkg/pki/resolve.go | 77 + .../openshift/library-go/pkg/pki/types.go | 23 + vendor/golang.org/x/crypto/blake2b/go125.go | 11 - .../chacha20poly1305_amd64.go | 6 +- .../chacha20poly1305/chacha20poly1305_amd64.s | 8664 ++++------------- vendor/golang.org/x/crypto/ssh/certs.go | 18 +- vendor/golang.org/x/crypto/ssh/channel.go | 65 +- vendor/golang.org/x/crypto/ssh/cipher.go | 2 +- vendor/golang.org/x/crypto/ssh/keys.go | 58 + vendor/golang.org/x/crypto/ssh/mux.go | 36 +- vendor/golang.org/x/crypto/ssh/server.go | 127 +- vendor/golang.org/x/net/html/entity.go | 5 +- vendor/golang.org/x/net/html/escape.go | 140 +- vendor/golang.org/x/net/html/parse.go | 38 +- vendor/golang.org/x/net/html/render.go | 35 +- vendor/golang.org/x/net/html/token.go | 37 +- vendor/golang.org/x/net/http2/server.go | 21 - .../golang.org/x/net/http2/server_common.go | 22 + vendor/golang.org/x/net/http2/server_wrap.go | 56 + vendor/golang.org/x/net/http2/transport.go | 34 - .../x/net/http2/transport_common.go | 34 + .../golang.org/x/net/http2/transport_wrap.go | 15 +- .../x/net/http2/writesched_common.go | 41 + .../net/http2/writesched_priority_rfc7540.go | 41 - vendor/golang.org/x/sys/cpu/cpu.go | 19 +- .../golang.org/x/sys/cpu/cpu_linux_riscv64.go | 2 + vendor/golang.org/x/sys/cpu/cpu_loong64.go | 16 +- vendor/golang.org/x/sys/cpu/cpu_riscv64.go | 1 + vendor/golang.org/x/sys/unix/mkerrors.sh | 3 + vendor/golang.org/x/sys/unix/readv_unix.go | 103 + .../golang.org/x/sys/unix/syscall_darwin.go | 89 - vendor/golang.org/x/sys/unix/syscall_linux.go | 106 +- .../golang.org/x/sys/unix/syscall_openbsd.go | 4 + vendor/golang.org/x/sys/unix/zerrors_linux.go | 61 +- .../x/sys/unix/zerrors_linux_386.go | 7 +- .../x/sys/unix/zerrors_linux_amd64.go | 7 +- .../x/sys/unix/zerrors_linux_arm.go | 7 +- .../x/sys/unix/zerrors_linux_arm64.go | 7 +- .../x/sys/unix/zerrors_linux_loong64.go | 7 +- .../x/sys/unix/zerrors_linux_mips.go | 7 +- .../x/sys/unix/zerrors_linux_mips64.go | 7 +- .../x/sys/unix/zerrors_linux_mips64le.go | 7 +- .../x/sys/unix/zerrors_linux_mipsle.go | 7 +- .../x/sys/unix/zerrors_linux_ppc.go | 7 +- .../x/sys/unix/zerrors_linux_ppc64.go | 7 +- .../x/sys/unix/zerrors_linux_ppc64le.go | 7 +- .../x/sys/unix/zerrors_linux_riscv64.go | 1114 +-- .../x/sys/unix/zerrors_linux_s390x.go | 7 +- .../x/sys/unix/zerrors_linux_sparc64.go | 7 +- .../golang.org/x/sys/unix/zsyscall_linux.go | 8 +- .../x/sys/unix/zsyscall_openbsd_386.go | 84 + .../x/sys/unix/zsyscall_openbsd_386.s | 20 + .../x/sys/unix/zsyscall_openbsd_amd64.go | 84 + .../x/sys/unix/zsyscall_openbsd_amd64.s | 20 + .../x/sys/unix/zsyscall_openbsd_arm.go | 84 + .../x/sys/unix/zsyscall_openbsd_arm.s | 20 + .../x/sys/unix/zsyscall_openbsd_arm64.go | 84 + .../x/sys/unix/zsyscall_openbsd_arm64.s | 20 + .../x/sys/unix/zsyscall_openbsd_mips64.go | 84 + .../x/sys/unix/zsyscall_openbsd_mips64.s | 20 + .../x/sys/unix/zsyscall_openbsd_ppc64.go | 84 + .../x/sys/unix/zsyscall_openbsd_ppc64.s | 24 + .../x/sys/unix/zsyscall_openbsd_riscv64.go | 84 + .../x/sys/unix/zsyscall_openbsd_riscv64.s | 20 + .../x/sys/unix/zsysnum_linux_386.go | 4 + .../x/sys/unix/zsysnum_linux_amd64.go | 5 + .../x/sys/unix/zsysnum_linux_arm.go | 4 + .../x/sys/unix/zsysnum_linux_arm64.go | 4 + .../x/sys/unix/zsysnum_linux_loong64.go | 5 + .../x/sys/unix/zsysnum_linux_mips.go | 4 + .../x/sys/unix/zsysnum_linux_mips64.go | 4 + .../x/sys/unix/zsysnum_linux_mips64le.go | 4 + .../x/sys/unix/zsysnum_linux_mipsle.go | 4 + .../x/sys/unix/zsysnum_linux_ppc.go | 4 + .../x/sys/unix/zsysnum_linux_ppc64.go | 4 + .../x/sys/unix/zsysnum_linux_ppc64le.go | 4 + .../x/sys/unix/zsysnum_linux_riscv64.go | 4 + .../x/sys/unix/zsysnum_linux_s390x.go | 4 + .../x/sys/unix/zsysnum_linux_sparc64.go | 5 + vendor/golang.org/x/sys/unix/ztypes_linux.go | 47 +- .../golang.org/x/sys/unix/ztypes_linux_386.go | 8 + .../x/sys/unix/ztypes_linux_amd64.go | 8 + .../golang.org/x/sys/unix/ztypes_linux_arm.go | 8 + .../x/sys/unix/ztypes_linux_arm64.go | 8 + .../x/sys/unix/ztypes_linux_loong64.go | 8 + .../x/sys/unix/ztypes_linux_mips.go | 8 + .../x/sys/unix/ztypes_linux_mips64.go | 8 + .../x/sys/unix/ztypes_linux_mips64le.go | 8 + .../x/sys/unix/ztypes_linux_mipsle.go | 8 + .../golang.org/x/sys/unix/ztypes_linux_ppc.go | 8 + .../x/sys/unix/ztypes_linux_ppc64.go | 8 + .../x/sys/unix/ztypes_linux_ppc64le.go | 8 + .../x/sys/unix/ztypes_linux_riscv64.go | 8 + .../x/sys/unix/ztypes_linux_s390x.go | 8 + .../x/sys/unix/ztypes_linux_sparc64.go | 8 + .../x/sys/windows/syscall_windows.go | 3 + .../golang.org/x/sys/windows/types_windows.go | 4 +- .../x/sys/windows/zsyscall_windows.go | 35 + vendor/k8s.io/klog/v2/README.md | 2 - .../klog/v2/internal/serialize/keyvalues.go | 232 +- .../internal/serialize/keyvalues_no_slog.go | 10 +- .../v2/internal/serialize/keyvalues_slog.go | 12 +- vendor/k8s.io/klog/v2/klog.go | 87 +- vendor/k8s.io/klog/v2/klogr.go | 4 +- vendor/k8s.io/klog/v2/klogr_slog.go | 11 +- vendor/k8s.io/klog/v2/textlogger/options.go | 18 + .../k8s.io/klog/v2/textlogger/textlogger.go | 53 +- .../kube-openapi/pkg/builder/openapi.go | 5 +- .../kube-openapi/pkg/builder3/openapi.go | 5 +- .../pkg/internal/serialization.go | 2 +- .../go-json-experiment/json/README.md | 246 +- .../go-json-experiment/json/alias.go | 967 ++ .../go-json-experiment/json/arshal.go | 523 +- .../go-json-experiment/json/arshal_any.go | 283 +- .../go-json-experiment/json/arshal_default.go | 1469 ++- .../go-json-experiment/json/arshal_funcs.go | 209 +- .../go-json-experiment/json/arshal_inlined.go | 123 +- .../go-json-experiment/json/arshal_methods.go | 328 +- .../go-json-experiment/json/arshal_time.go | 846 +- .../go-json-experiment/json/decode.go | 1655 ---- .../go-json-experiment/json/doc.go | 228 +- .../go-json-experiment/json/encode.go | 1170 --- .../go-json-experiment/json/errors.go | 409 +- .../go-json-experiment/json/fields.go | 503 +- .../go-json-experiment/json/fold.go | 2 + .../go-json-experiment/json/intern.go | 8 +- .../json/internal/internal.go | 42 + .../json/internal/jsonflags/flags.go | 215 + .../json/internal/jsonopts/options.go | 202 + .../json/internal/jsonwire/decode.go | 629 ++ .../json/internal/jsonwire/encode.go | 290 + .../json/internal/jsonwire/wire.go | 217 + .../go-json-experiment/json/jsontext/alias.go | 536 + .../json/jsontext/decode.go | 1179 +++ .../go-json-experiment/json/jsontext/doc.go | 111 + .../json/jsontext/encode.go | 977 ++ .../json/jsontext/errors.go | 182 + .../json/jsontext/export.go | 77 + .../json/jsontext/options.go | 304 + .../json/{ => jsontext}/pools.go | 92 +- .../go-json-experiment/json/jsontext/quote.go | 41 + .../json/{ => jsontext}/state.go | 447 +- .../json/{ => jsontext}/token.go | 87 +- .../go-json-experiment/json/jsontext/value.go | 395 + .../go-json-experiment/json/migrate.sh | 48 + .../go-json-experiment/json/options.go | 289 + .../go-json-experiment/json/value.go | 381 - .../kube-openapi/pkg/schemaconv/openapi.go | 6 +- .../pkg/schemaconv/proto_models.go | 10 +- .../k8s.io/kube-openapi/pkg/spec3/encoding.go | 13 +- .../k8s.io/kube-openapi/pkg/spec3/example.go | 13 +- .../pkg/spec3/external_documentation.go | 13 +- .../k8s.io/kube-openapi/pkg/spec3/header.go | 13 +- .../kube-openapi/pkg/spec3/media_type.go | 13 +- .../kube-openapi/pkg/spec3/operation.go | 13 +- .../kube-openapi/pkg/spec3/parameter.go | 13 +- vendor/k8s.io/kube-openapi/pkg/spec3/path.go | 25 +- .../kube-openapi/pkg/spec3/request_body.go | 13 +- .../k8s.io/kube-openapi/pkg/spec3/response.go | 47 +- .../kube-openapi/pkg/spec3/security_scheme.go | 7 +- .../k8s.io/kube-openapi/pkg/spec3/server.go | 25 +- vendor/k8s.io/kube-openapi/pkg/spec3/spec.go | 5 +- .../pkg/validation/spec/header.go | 13 +- .../kube-openapi/pkg/validation/spec/info.go | 13 +- .../kube-openapi/pkg/validation/spec/items.go | 13 +- .../pkg/validation/spec/operation.go | 13 +- .../pkg/validation/spec/parameter.go | 13 +- .../pkg/validation/spec/path_item.go | 15 +- .../kube-openapi/pkg/validation/spec/paths.go | 11 +- .../pkg/validation/spec/response.go | 15 +- .../pkg/validation/spec/responses.go | 17 +- .../pkg/validation/spec/schema.go | 13 +- .../pkg/validation/spec/security_scheme.go | 13 +- .../pkg/validation/spec/swagger.go | 59 +- .../kube-openapi/pkg/validation/spec/tag.go | 13 +- vendor/modules.txt | 58 +- .../v6/value/reflectcache.go | 4 + 488 files changed, 93577 insertions(+), 17904 deletions(-) create mode 100644 api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml create mode 100644 api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/KMSEncryption.yaml rename api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/{KMSEncryptionProvider.yaml => NetworkObservabilityInstall.yaml} (97%) create mode 100644 api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/TLSGroupPreferences.yaml create mode 100644 api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml create mode 100644 api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/KMSEncryption.yaml rename api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/{KMSEncryptionProvider.yaml => NetworkObservabilityInstall.yaml} (97%) create mode 100644 api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedcontrolplanes.hypershift.openshift.io/TLSGroupPreferences.yaml create mode 100644 api/vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.go create mode 100644 api/vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go rename api/vendor/github.com/openshift/api/operator/v1/{types_ingress.go => types_ingresscontroller.go} (98%) create mode 100644 api/vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go create mode 100644 api/vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/apiextensions/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/apiserver/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/apps/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/apps/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/authorization/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/authorization/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/build/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/build/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/cloudnetwork/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/config/v1/types_crio_credential_provider_config.go create mode 100644 vendor/github.com/openshift/api/config/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/config/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/config/v1alpha2/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/console/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/etcd/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/etcd/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/helm/v1beta1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/image/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/imageregistry/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/kubecontrolplane/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/legacyconfig/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/machine/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/machine/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/machine/v1beta1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/machineconfiguration/v1/types_osimagestream.go create mode 100644 vendor/github.com/openshift/api/machineconfiguration/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/monitoring/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/network/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/network/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/networkoperator/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/oauth/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/openshiftcontrolplane/v1/zz_generated.model_name.go rename vendor/github.com/openshift/api/operator/v1/{types_ingress.go => types_ingresscontroller.go} (98%) create mode 100644 vendor/github.com/openshift/api/operator/v1/types_kmsencryption.go create mode 100644 vendor/github.com/openshift/api/operator/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/operator/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/operatorcontrolplane/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/osin/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/project/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/project/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/quota/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/quota/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/route/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/samples/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/security/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/security/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/servicecertsigner/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/sharedresource/v1alpha1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/template/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/template/v1/zz_generated.model_name.go create mode 100644 vendor/github.com/openshift/api/user/.codegen.yaml create mode 100644 vendor/github.com/openshift/api/user/v1/zz_generated.model_name.go delete mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/awskmsconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientcredentialconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/clientsecretsecretreference.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalclaimssource.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourceauthentication.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcecertificateauthorityconfigmapreference.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcepredicate.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/externalsourcetls.go delete mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmsconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/kmspluginconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/networkobservabilityspec.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourcedclaimmapping.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/sourceurl.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultapproleauthentication.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultauthentication.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultconfigmapreference.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultkmspluginconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaultsecretreference.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1/vaulttlsconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/kubestatemetricsconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/kubestatemetricsresourcelabels.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/monitoringpluginconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorbuddyinfoconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorcpufreqconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorethtoolconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorksmdconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectormountstatsconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclasscollectconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetclassconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectornetdevconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorprocessesconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsoftirqsconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdcollectconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectorsystemdconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexportercollectortcpstatconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/nodeexporterconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/applyconfigurations/config/v1alpha1/thanosquerierrequestloggingconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/backup.go create mode 100644 vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/clustermonitoring.go create mode 100644 vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/criocredentialproviderconfig.go create mode 100644 vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/expansion_generated.go create mode 100644 vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/insightsdatagather.go create mode 100644 vendor/github.com/openshift/client-go/config/listers/config/v1alpha1/pki.go create mode 100644 vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmsencryptionstatus.go create mode 100644 vendor/github.com/openshift/client-go/operator/applyconfigurations/operator/v1/kmspluginhealthreport.go create mode 100644 vendor/github.com/openshift/cluster-authentication-operator/LICENSE create mode 100644 vendor/github.com/openshift/cluster-authentication-operator/pkg/controllers/externaloidc/generation/oauthapiserver/generate.go create mode 100644 vendor/github.com/openshift/library-go/pkg/crypto/cert_config.go create mode 100644 vendor/github.com/openshift/library-go/pkg/crypto/keygen.go create mode 100644 vendor/github.com/openshift/library-go/pkg/crypto/options.go create mode 100644 vendor/github.com/openshift/library-go/pkg/crypto/tls_adherence.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/resource/retry/retry.go create mode 100644 vendor/github.com/openshift/library-go/pkg/operator/resource/retry/wait.go create mode 100644 vendor/github.com/openshift/library-go/pkg/pki/profile.go create mode 100644 vendor/github.com/openshift/library-go/pkg/pki/provider.go create mode 100644 vendor/github.com/openshift/library-go/pkg/pki/resolve.go create mode 100644 vendor/github.com/openshift/library-go/pkg/pki/types.go delete mode 100644 vendor/golang.org/x/crypto/blake2b/go125.go create mode 100644 vendor/golang.org/x/sys/unix/readv_unix.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/alias.go delete mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/decode.go delete mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/encode.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/internal.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonflags/flags.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonopts/options.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/decode.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/encode.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/internal/jsonwire/wire.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/alias.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/decode.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/doc.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/encode.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/errors.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/export.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/options.go rename vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/{ => jsontext}/pools.go (64%) create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/quote.go rename vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/{ => jsontext}/state.go (63%) rename vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/{ => jsontext}/token.go (87%) create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/jsontext/value.go create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/migrate.sh create mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/options.go delete mode 100644 vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/value.go diff --git a/api/go.mod b/api/go.mod index 30bd39d6ba5e..72f9bba54e85 100644 --- a/api/go.mod +++ b/api/go.mod @@ -3,10 +3,10 @@ module github.com/openshift/hypershift/api go 1.25.7 require ( - github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 + github.com/openshift/api v0.0.0-20260701125932-bfd28b0f0ba1 k8s.io/api v0.35.1 k8s.io/apimachinery v0.35.1 - k8s.io/utils v0.0.0-20260108192941-914a6e750570 + k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 ) require ( @@ -17,15 +17,14 @@ require ( github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect - github.com/spf13/pflag v1.0.10 // indirect github.com/x448/float16 v0.8.4 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect golang.org/x/net v0.54.0 // indirect golang.org/x/text v0.37.0 // indirect gopkg.in/inf.v0 v0.9.1 // indirect - k8s.io/klog/v2 v2.130.1 // indirect - k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect + k8s.io/klog/v2 v2.140.0 // indirect + k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect - sigs.k8s.io/structured-merge-diff/v6 v6.3.1 // indirect + sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect ) diff --git a/api/go.sum b/api/go.sum index 5fa55bcb822c..bad82d4f05f6 100644 --- a/api/go.sum +++ b/api/go.sum @@ -22,8 +22,8 @@ github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= -github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80 h1:r0S/yoZAI0iWo1JvoIijaIgWGWf/izg4WiV7Wrtz16k= -github.com/openshift/api v0.0.0-20260416105050-3c6b218b8a80/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo= +github.com/openshift/api v0.0.0-20260701125932-bfd28b0f0ba1 h1:QCjKwQQX0VpdkzrM2Xz4d+sJHb74+hyIs+9wRkMzfwE= +github.com/openshift/api v0.0.0-20260701125932-bfd28b0f0ba1/go.mod h1:7WJ3IPaK6nmWT8bDcaNooHqd0H5WepjVqV/10VlkMEM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= @@ -54,17 +54,17 @@ k8s.io/api v0.35.1 h1:0PO/1FhlK/EQNVK5+txc4FuhQibV25VLSdLMmGpDE/Q= k8s.io/api v0.35.1/go.mod h1:28uR9xlXWml9eT0uaGo6y71xK86JBELShLy4wR1XtxM= k8s.io/apimachinery v0.35.1 h1:yxO6gV555P1YV0SANtnTjXYfiivaTPvCTKX6w6qdDsU= k8s.io/apimachinery v0.35.1/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns= -k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk= -k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE= -k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e h1:iW9ChlU0cU16w8MpVYjXk12dqQ4BPFBEgif+ap7/hqQ= -k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ= -k8s.io/utils v0.0.0-20260108192941-914a6e750570 h1:JT4W8lsdrGENg9W+YwwdLJxklIuKWdRm+BC+xt33FOY= -k8s.io/utils v0.0.0-20260108192941-914a6e750570/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= +k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= +k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288 h1:A7Lby6ekC6nv+6oO38huCMFBRP0Os+tIeq1GkwxOQes= +k8s.io/kube-openapi v0.0.0-20260519202549-bbf5c5577288/go.mod h1:V/QaCUYDa+0QpcHhVVc5l99Uz56wEMEXBSj9oCDkNDY= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= -sigs.k8s.io/structured-merge-diff/v6 v6.3.1 h1:JrhdFMqOd/+3ByqlP2I45kTOZmTRLBUm5pvRjeheg7E= -sigs.k8s.io/structured-merge-diff/v6 v6.3.1/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= +sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8= +sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml index ae4043f97aa0..f777e991913a 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests.yaml @@ -207,15 +207,18 @@ hostedclusters.hypershift.openshift.io: - ClusterUpdateAcceptRisks - ClusterVersionOperatorConfiguration - ExternalOIDC + - ExternalOIDCExternalClaimsSourcing - ExternalOIDCWithUIDAndExtraClaimMappings - ExternalOIDCWithUpstreamParity - GCPPlatform - HCPEtcdBackup - HyperShiftOnlyDynamicResourceAllocation - ImageStreamImportMode - - KMSEncryptionProvider + - KMSEncryption + - NetworkObservabilityInstall - OpenStack - TLSAdherence + - TLSGroupPreferences FilenameOperatorName: "" FilenameOperatorOrdering: "" FilenameRunLevel: "" @@ -280,15 +283,18 @@ hostedcontrolplanes.hypershift.openshift.io: - ClusterUpdateAcceptRisks - ClusterVersionOperatorConfiguration - ExternalOIDC + - ExternalOIDCExternalClaimsSourcing - ExternalOIDCWithUIDAndExtraClaimMappings - ExternalOIDCWithUpstreamParity - GCPPlatform - HCPEtcdBackup - HyperShiftOnlyDynamicResourceAllocation - ImageStreamImportMode - - KMSEncryptionProvider + - KMSEncryption + - NetworkObservabilityInstall - OpenStack - TLSAdherence + - TLSGroupPreferences FilenameOperatorName: "" FilenameOperatorOrdering: "" FilenameRunLevel: "" diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml index 1c41742b57a1..5f1f36fd0914 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/AAA_ungated.yaml @@ -716,8 +716,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -762,6 +765,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -780,7 +787,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -794,6 +803,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -810,11 +823,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -825,10 +841,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1077,19 +1099,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1104,11 +1152,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -3613,6 +3673,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml index 039f5cf6393d..be05dd90dbf4 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterUpdateAcceptRisks.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1068,19 +1090,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1095,11 +1143,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -3604,6 +3664,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml index 3acebef0f14e..211ea50e83f8 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ClusterVersionOperatorConfiguration.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1068,19 +1090,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1095,11 +1143,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -3624,6 +3684,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml index 4daf2de45fe9..543258c26a71 100644 --- a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDC.yaml @@ -711,8 +711,11 @@ spec: custom: description: |- custom is a user-defined TLS security profile. Be extremely careful using a custom - profile as invalid configurations can be catastrophic. An example custom profile - looks like this: + profile as invalid configurations can be catastrophic. + + The supported groups list for this profile is empty by default. + + An example custom profile looks like this: minTLSVersion: VersionTLS11 ciphers: @@ -757,6 +760,10 @@ spec: legacy clients and want to remain highly secure while being compatible with most clients currently in use. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS12 ciphers: @@ -775,7 +782,9 @@ spec: description: |- modern is a TLS security profile for use with clients that support TLS 1.3 and do not need backward compatibility for older clients. - + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS13 ciphers: @@ -789,6 +798,10 @@ spec: old is a TLS profile for use when services need to be accessed by very old clients or libraries and should be used only as a last resort. + The supported groups list includes by default the following groups + in suggested preference order (ordering may not be honored by all implementations): + X25519MLKEM768, X25519, secp256r1, secp384r1. + This profile is equivalent to a Custom profile specified as: minTLSVersion: VersionTLS10 ciphers: @@ -805,11 +818,14 @@ spec: - ECDHE-RSA-AES128-SHA256 - ECDHE-ECDSA-AES128-SHA - ECDHE-RSA-AES128-SHA + - ECDHE-ECDSA-AES256-SHA384 + - ECDHE-RSA-AES256-SHA384 - ECDHE-ECDSA-AES256-SHA - ECDHE-RSA-AES256-SHA - AES128-GCM-SHA256 - AES256-GCM-SHA384 - AES128-SHA256 + - AES256-SHA256 - AES128-SHA - AES256-SHA - DES-CBC3-SHA @@ -820,10 +836,16 @@ spec: type is one of Old, Intermediate, Modern or Custom. Custom provides the ability to specify individual TLS security profile parameters. - The profiles are based on version 5.7 of the Mozilla Server Side TLS - configuration guidelines. The cipher lists consist of the configuration's - "ciphersuites" followed by the Go-specific "ciphers" from the guidelines. - See: https://ssl-config.mozilla.org/guidelines/5.7.json + The cipher and groups lists in these profiles are based on version 5.8 of the + Mozilla Server Side TLS configuration guidelines. + See: https://ssl-config.mozilla.org/guidelines/5.8.json + + The groups are listed in suggested preference order, with the most preferred group first. + Note that not all platform components honor the ordering: Go-based components use Go's + internal preference order and treat this list as a filter of allowed groups rather than + an ordered preference. + Note that X25519MLKEM768 is a post-quantum hybrid group that is not + FIPS-approved and should be ignored by components running in FIPS mode. The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers are found to be insecure. Depending on @@ -1400,19 +1422,45 @@ spec: allowedRegistries: description: |- allowedRegistries are the only registries permitted for image pull and push actions. All other registries are denied. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic blockedRegistries: description: |- blockedRegistries cannot be used for image pull and push actions. All other registries are permitted. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. Only one of BlockedRegistries or AllowedRegistries may be set. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic containerRuntimeSearchRegistries: @@ -1427,11 +1475,23 @@ spec: type: array x-kubernetes-list-type: set insecureRegistries: - description: insecureRegistries are registries which do - not have a valid TLS certificates or only support HTTP - connections. + description: |- + insecureRegistries are registries which do not have a valid TLS certificates or only support HTTP connections. + Each entry must be a valid registry scope in the format hostname[:port][/path], + optionally prefixed with "*." for wildcard subdomains (e.g., "*.example.com"). + The hostname must consist of valid DNS labels separated by dots, where each label + contains only alphanumeric characters and hyphens and does not start or end with a hyphen. + Entries must not be empty, must not include tags (e.g., ":latest") or digests (e.g., "@sha256:..."), + and must be at most 256 characters in length. The list may contain at most 1024 entries. items: + maxLength: 256 + minLength: 1 type: string + x-kubernetes-validations: + - message: each registry must be a valid hostname[:port][/path] + or wildcard *.hostname format without tags or digests + rule: self.matches('^\\*(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+$|^((?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))+)?(?::[0-9]+)?)(?:(?:/[a-z0-9]+(?:(?:(?:[._]|__|[-]*)[a-z0-9]+)+)?)+)?$') + maxItems: 1024 type: array x-kubernetes-list-type: atomic type: object @@ -3936,6 +3996,38 @@ spec: duplicates rule: self.all(x, self.exists_one(y, x == y)) + protocol: + description: |- + protocol specifies whether the Network Load Balancer uses PROXY + protocol to forward connections to the IngressController. + + When set to "TCP", the NLB uses AWS's native client IP preservation. + This may cause hairpin connection failures for internal load + balancers when connections are made from pods to router pods on + the same node. + + When set to "PROXY", the NLB disables native client IP preservation + and uses PROXY protocol v2. The IngressController enables PROXY + protocol on HAProxy so that it can parse PROXY protocol headers to + obtain the original client IP. This avoids hairpin connection + failures. + + The following values are valid for this field: + + * "TCP". + * "PROXY". + + When omitted, this means the user has no opinion and the value is + left to the platform to choose a reasonable default, which is subject to + change over time. The current default is "PROXY". + + Note that changing this field may cause brief connection failures + during the transition as the NLB attribute change and router rollout + occur independently. + enum: + - TCP + - PROXY + type: string subnets: description: |- subnets specifies the subnets to which the load balancer will diff --git a/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml new file mode 100644 index 000000000000..22911541bce8 --- /dev/null +++ b/api/hypershift/v1beta1/zz_generated.featuregated-crd-manifests/hostedclusters.hypershift.openshift.io/ExternalOIDCExternalClaimsSourcing.yaml @@ -0,0 +1,8184 @@ +apiVersion: apiextensions.k8s.io/v1 +kind: CustomResourceDefinition +metadata: + annotations: + feature-gate.release.openshift.io/ExternalOIDCExternalClaimsSourcing: "true" + name: hostedclusters.hypershift.openshift.io +spec: + group: hypershift.openshift.io + names: + kind: HostedCluster + listKind: HostedClusterList + plural: hostedclusters + shortNames: + - hc + - hcs + singular: hostedcluster + scope: Namespaced + versions: + - additionalPrinterColumns: + - description: Version + jsonPath: .status.version.history[?(@.state=="Completed")].version + name: Version + type: string + - description: Control Plane Version + jsonPath: .status.controlPlaneVersion.history[?(@.state=="Completed")].version + name: CP Version + type: string + - description: KubeConfig Secret + jsonPath: .status.kubeconfig.name + name: KubeConfig + type: string + - description: Progress + jsonPath: .status.version.history[?(@.state!="")].state + name: Progress + type: string + - description: Available + jsonPath: .status.conditions[?(@.type=="Available")].status + name: Available + type: string + - description: Progressing + jsonPath: .status.conditions[?(@.type=="Progressing")].status + name: Progressing + type: string + - description: Message + jsonPath: .status.conditions[?(@.type=="Available")].message + name: Message + type: string + - description: Control Plane Progress + jsonPath: .status.controlPlaneVersion.history[0].state + name: CP Progress + priority: 1 + type: string + - description: Data Plane Progress + jsonPath: .status.version.history[0].state + name: DP Progress + priority: 1 + type: string + name: v1beta1 + schema: + openAPIV3Schema: + description: |- + HostedCluster is the primary representation of a HyperShift cluster and encapsulates + the control plane and common data plane configuration. Creating a HostedCluster + results in a fully functional OpenShift control plane with no attached nodes. + To support workloads (e.g. pods), a HostedCluster may have one or more associated + NodePool resources. + properties: + apiVersion: + description: |- + APIVersion defines the versioned schema of this representation of an object. + Servers should convert recognized schemas to the latest internal value, and + may reject unrecognized values. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources + type: string + kind: + description: |- + Kind is a string value representing the REST resource this object represents. + Servers may infer this from the endpoint the client submits requests to. + Cannot be updated. + In CamelCase. + More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds + type: string + metadata: + type: object + spec: + description: spec is the desired behavior of the HostedCluster. + properties: + additionalTrustBundle: + description: |- + additionalTrustBundle is a local reference to a ConfigMap that must have a "ca-bundle.crt" key + whose content must be a PEM-encoded X.509 certificate bundle that will be added to the hosted controlplane and nodes + If the reference is set but none of the above requirements are met, the HostedCluster will enter a degraded state. + This will be part of every payload generated by the controllers for any NodePool of the HostedCluster. + Changing this value will trigger a rollout for all existing NodePools in the cluster. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + auditWebhook: + description: |- + auditWebhook contains metadata for configuring an audit webhook endpoint + for a cluster to process cluster audit events. It references a secret that + contains the webhook information for the audit webhook endpoint. It is a + secret because if the endpoint has mTLS the kubeconfig will contain client + keys. The kubeconfig needs to be stored in the secret with a secret key + name that corresponds to the constant AuditWebhookKubeconfigKey. + properties: + name: + default: "" + description: |- + Name of the referent. + This field is effectively required, but due to backwards compatibility is + allowed to be empty. Instances of this type with an empty value here are + almost certainly wrong. + More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names + type: string + type: object + x-kubernetes-map-type: atomic + autoNode: + description: |- + autoNode specifies the configuration for automatic node provisioning and lifecycle management. + When set, the provisioner(e.g. Karpenter) will be used to provision nodes for targeted workloads. + properties: + provisionerConfig: + description: provisionerConfig specifies the provisioner used + for automatic node management. + properties: + karpenter: + description: karpenter specifies the configuration for the + Karpenter provisioner. + properties: + aws: + description: aws specifies the AWS-specific configuration + for Karpenter. + properties: + roleARN: + description: "roleARN specifies the ARN of the IAM + role that Karpenter assumes to provision\nand manage + EC2 instances in the hosted cluster's AWS account.\n\nThe + referenced role must have a trust relationship that + allows it to be assumed\nby the karpenter service + account in the hosted cluster via OIDC.\nExample:\n{\n\t\"Version\": + \"2012-10-17\",\n\t\"Statement\": [\n\t\t{\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Principal\": {\n\t\t\t\t\"Federated\": + \"\"\n\t\t\t},\n\t\t\t\"Action\": + \"sts:AssumeRoleWithWebIdentity\",\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringEquals\": {\n\t\t\t\t\t\":sub\": + \"system:serviceaccount:kube-system:karpenter\"\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t]\n}\n\nThe + following is an example of the policy document for + this role.\n\n{\n\t\"Version\": \"2012-10-17\",\n\t\"Statement\": + [\n\t\t{\n\t\t\t\"Sid\": \"AllowScopedEC2InstanceAccessActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": [\n\t\t\t\t\"arn:*:ec2:*::image/*\",\n\t\t\t\t\"arn:*:ec2:*::snapshot/*\",\n\t\t\t\t\"arn:*:ec2:*:*:security-group/*\",\n\t\t\t\t\"arn:*:ec2:*:*:subnet/*\"\n\t\t\t],\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:RunInstances\",\n\t\t\t\t\"ec2:CreateFleet\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedEC2LaunchTemplateAccessActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:ec2:*:*:launch-template/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:RunInstances\",\n\t\t\t\t\"ec2:CreateFleet\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedEC2InstanceActionsWithTags\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": [\n\t\t\t\t\"arn:*:ec2:*:*:fleet/*\",\n\t\t\t\t\"arn:*:ec2:*:*:instance/*\",\n\t\t\t\t\"arn:*:ec2:*:*:volume/*\",\n\t\t\t\t\"arn:*:ec2:*:*:network-interface/*\",\n\t\t\t\t\"arn:*:ec2:*:*:launch-template/*\",\n\t\t\t\t\"arn:*:ec2:*:*:spot-instances-request/*\"\n\t\t\t],\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:RunInstances\",\n\t\t\t\t\"ec2:CreateFleet\",\n\t\t\t\t\"ec2:CreateLaunchTemplate\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:RequestTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedResourceCreationTagging\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": [\n\t\t\t\t\"arn:*:ec2:*:*:fleet/*\",\n\t\t\t\t\"arn:*:ec2:*:*:instance/*\",\n\t\t\t\t\"arn:*:ec2:*:*:volume/*\",\n\t\t\t\t\"arn:*:ec2:*:*:network-interface/*\",\n\t\t\t\t\"arn:*:ec2:*:*:launch-template/*\",\n\t\t\t\t\"arn:*:ec2:*:*:spot-instances-request/*\"\n\t\t\t],\n\t\t\t\"Action\": + \"ec2:CreateTags\",\n\t\t\t\"Condition\": {\n\t\t\t\t\"StringEquals\": + {\n\t\t\t\t\t\"ec2:CreateAction\": [\n\t\t\t\t\t\t\"RunInstances\",\n\t\t\t\t\t\t\"CreateFleet\",\n\t\t\t\t\t\t\"CreateLaunchTemplate\"\n\t\t\t\t\t]\n\t\t\t\t},\n\t\t\t\t\"StringLike\": + {\n\t\t\t\t\t\"aws:RequestTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedResourceTagging\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:ec2:*:*:instance/*\",\n\t\t\t\"Action\": + \"ec2:CreateTags\",\n\t\t\t\"Condition\": {\n\t\t\t\t\"StringLike\": + {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedDeletion\",\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Resource\": + [\n\t\t\t\t\"arn:*:ec2:*:*:instance/*\",\n\t\t\t\t\"arn:*:ec2:*:*:launch-template/*\"\n\t\t\t],\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:TerminateInstances\",\n\t\t\t\t\"ec2:DeleteLaunchTemplate\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.sh/nodepool\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowRegionalReadActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"ec2:DescribeImages\",\n\t\t\t\t\"ec2:DescribeInstances\",\n\t\t\t\t\"ec2:DescribeInstanceTypeOfferings\",\n\t\t\t\t\"ec2:DescribeInstanceTypes\",\n\t\t\t\t\"ec2:DescribeLaunchTemplates\",\n\t\t\t\t\"ec2:DescribeSecurityGroups\",\n\t\t\t\t\"ec2:DescribeSpotPriceHistory\",\n\t\t\t\t\"ec2:DescribeSubnets\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowSSMReadActions\",\n\t\t\t\"Effect\": \"Allow\",\n\t\t\t\"Resource\": + \"arn:*:ssm:*::parameter/aws/service/*\",\n\t\t\t\"Action\": + \"ssm:GetParameter\"\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowPricingReadActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + \"pricing:GetProducts\"\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowInterruptionQueueActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"sqs:DeleteMessage\",\n\t\t\t\t\"sqs:GetQueueUrl\",\n\t\t\t\t\"sqs:ReceiveMessage\"\n\t\t\t]\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowPassingInstanceRole\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:role/*\",\n\t\t\t\"Action\": + \"iam:PassRole\",\n\t\t\t\"Condition\": {\n\t\t\t\t\"StringEquals\": + {\n\t\t\t\t\t\"iam:PassedToService\": [\n\t\t\t\t\t\t\"ec2.amazonaws.com\",\n\t\t\t\t\t\t\"ec2.amazonaws.com.cn\"\n\t\t\t\t\t]\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedInstanceProfileCreationActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"iam:CreateInstanceProfile\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:RequestTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedInstanceProfileTagActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"iam:TagInstanceProfile\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\",\n\t\t\t\t\t\"aws:RequestTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowScopedInstanceProfileActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + [\n\t\t\t\t\"iam:AddRoleToInstanceProfile\",\n\t\t\t\t\"iam:RemoveRoleFromInstanceProfile\",\n\t\t\t\t\"iam:DeleteInstanceProfile\"\n\t\t\t],\n\t\t\t\"Condition\": + {\n\t\t\t\t\"StringLike\": {\n\t\t\t\t\t\"aws:ResourceTag/karpenter.k8s.aws/ec2nodeclass\": + \"*\"\n\t\t\t\t}\n\t\t\t}\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowInstanceProfileReadActions\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"arn:*:iam::*:instance-profile/*\",\n\t\t\t\"Action\": + \"iam:GetInstanceProfile\"\n\t\t},\n\t\t{\n\t\t\t\"Sid\": + \"AllowUnscopedInstanceProfileListAction\",\n\t\t\t\"Effect\": + \"Allow\",\n\t\t\t\"Resource\": \"*\",\n\t\t\t\"Action\": + \"iam:ListInstanceProfiles\"\n\t\t}\n\t]\n}" + maxLength: 2048 + type: string + x-kubernetes-validations: + - message: roleARN must be a valid AWS IAM role ARN + (e.g. arn:aws:iam::123456789012:role/MyRole) + rule: self.matches('^arn:(aws|aws-cn|aws-us-gov):iam::[0-9]{12}:role/.+$') + required: + - roleARN + type: object + platform: + description: platform specifies the infrastructure platform + that Karpenter should provision nodes on. + enum: + - AWS + maxLength: 100 + type: string + required: + - platform + type: object + x-kubernetes-validations: + - message: aws is required when platform is AWS, and forbidden + otherwise + rule: 'self.platform == ''AWS'' ? has(self.aws) : !has(self.aws)' + name: + description: name specifies the name of the provisioner to + use for automatic node management. + enum: + - Karpenter + type: string + required: + - name + type: object + x-kubernetes-validations: + - message: karpenter is required when name is Karpenter, and forbidden + otherwise + rule: 'self.name == ''Karpenter'' ? has(self.karpenter) : !has(self.karpenter)' + required: + - provisionerConfig + type: object + autoscaling: + description: |- + autoscaling specifies auto-scaling behavior that applies to all NodePools + associated with this HostedCluster. + properties: + balancingIgnoredLabels: + description: |- + balancingIgnoredLabels sets "--balancing-ignore-label