CNTRLPLANE-3772: promote ExternalOIDCWithUpstreamParity to Default

[ShazaAldawamneh]

feat: Promote ExternalOIDCWithUpstreamParity to Default feature set Promote the ExternalOIDCWithUpstreamParity feature gate from TechPreviewNoUpgrade to the Default feature set, enabling upstream parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR #2915 and allows the feature to be available in the default feature set once the API changes are merged.

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Summary by CodeRabbit

• New Features
  • Expanded availability of an OIDC-related feature so it is enabled in both default and tech preview feature sets, making it accessible to more users.

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@ShazaAldawamneh: This pull request references CNTRLPLANE-3772 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

feat: Promote ExternalOIDCWithUpstreamParity to Default feature set Promote the ExternalOIDCWithUpstreamParity feature gate from TechPreviewNoUpgrade to the Default feature set, enabling upstream parity authentication configuration by default.

This change aligns with the openshift/api promotion in PR #2915 and allows the feature to be available in the default feature set once the API changes are merged.

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes

Special notes for your reviewer:

Checklist:

• Subject and description added to both, commit and PR.
• Relevant issues have been referenced.
• This change includes docs.
• This change includes unit tests.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ShazaAldawamneh
Once this PR has been reviewed and has the lgtm label, please assign enxebre for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

This change updates the feature-gate configuration for externalOIDCWithUpstreamParityFeature in featuregates.go. The WithEnableForFeatureSets setting now includes both configv1.TechPreviewNoUpgrade and configv1.Default, whereas previously it was enabled only for configv1.TechPreviewNoUpgrade.

Possibly related PRs

• openshift/hypershift#8287: Modifies the same externalOIDCWithUpstreamParity feature-gate wiring, directly affecting when related gated auth/e2e test logic executes.

🚥 Pre-merge checks | ✅ 11

✅ Passed checks (11 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	Only featuregates.go changed; no Ginkgo tests or test titles were added or modified, so there are no dynamic names to flag.
Test Structure And Quality	✅ Passed	Only a feature-gate config line changed; no Ginkgo tests were added or modified, so this check is not applicable.
Topology-Aware Scheduling Compatibility	✅ Passed	The change only updates feature-gate enablement; no manifests, replicas, affinity, node selectors, PDBs, or topology-based scheduling logic were added.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only feature-gate config changed; no It/Describe/Context/When tests, IPv4 literals, or external connectivity were added.
No-Weak-Crypto	✅ Passed	Only a feature-gate enablement changed; no MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret comparisons found.
Container-Privileges	✅ Passed	Only feature-gate config changed; no container/K8s manifests or privileged settings were added or modified.
No-Sensitive-Data-In-Logs	✅ Passed	Changed file only updates feature-gate enablement; no logging calls or sensitive-data handling appear in the file or diff.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately summarizes the main change: promoting ExternalOIDCWithUpstreamParity to the Default feature set.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

@ShazaAldawamneh: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[everettraven]

LGTM, but needs to be held until the feature has been promoted in openshift/api first.

/hold

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.45%. Comparing base (dda6055) to head (6b946b3).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #8952   +/-   ##
=======================================
  Coverage   43.45%   43.45%           
=======================================
  Files         771      771           
  Lines       95718    95718           
=======================================
  Hits        41597    41597           
  Misses      51234    51234           
  Partials     2887     2887           

Flag	Coverage Δ
cmd-support	37.12% <ø> (ø)
cpo-other	45.10% <ø> (ø)
hypershift-operator	53.65% <ø> (ø)
other	32.08% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[hypershift-jira-solve-ci]

I now have all the evidence I need. The root cause is completely clear. Here's my final report:

Test Failure Analysis Complete

Job Information

• Prow Job: test / Unit Tests (cpo-hostedcontrolplane)
• Build ID: 28868204594 / job 85721309553
• PR: CNTRLPLANE-3772: promote ExternalOIDCWithUpstreamParity to Default #8952 — CNTRLPLANE-3772: promote ExternalOIDCWithUpstreamParity to Default
• Test: TestGenerateAuthConfig/When_valid_OIDC_provider_is_provided,_it_should_generate_valid_authentication_configuration
• Package: github.com/openshift/hypershift/control-plane-operator/controllers/hostedcontrolplane/v2/kas

Test Failure Analysis

Error

auth_test.go:269: actual authentication configuration does not match expected (-want +got):
      &kas.AuthenticationConfiguration{
          ...
          ClaimMappings:        {Username: {Claim: "email", Prefix: &""}, Groups: {Prefix: &""}, UID: {Claim: "sub"}, Extra: {}},
      -   UserValidationRules:  nil,
      +   UserValidationRules:  []kas.UserValidationRule{},
          ...
      }

Summary

The PR promotes the ExternalOIDCWithUpstreamParity feature gate to the Default feature set. This causes a previously-skipped code path in generateJWTForProvider (auth.go:102-108) to now execute during unit tests, which populates UserValidationRules with an empty slice []UserValidationRule{} instead of leaving it as the zero-value nil. The test expectation in auth_test.go does not include UserValidationRules in its expected struct literal, so it expects nil. The cmp.Diff comparison catches this nil-vs-empty-slice difference and the test fails.

Root Cause

The failure is a test expectation that was not updated to account for the behavioral change introduced by promoting the feature gate.

Here is the complete chain of causation:

1. Feature gate initialization: control-plane-operator/featuregates/featuregates.go line 30 calls ConfigureFeatureSet(string(configv1.Default)) in init(), meaning all unit tests run with the Default feature set active unless explicitly overridden.

2. The PR change (single line at featuregates.go:22): Adds configv1.Default to ExternalOIDCWithUpstreamParity's enabled feature sets:

   // Before:
   featuregates.WithEnableForFeatureSets(configv1.TechPreviewNoUpgrade)
   // After:
   featuregates.WithEnableForFeatureSets(configv1.TechPreviewNoUpgrade, configv1.Default)

3. Newly-activated code path (auth.go:102-108): When ExternalOIDCWithUpstreamParity is enabled, generateJWTForProvider now executes this block:

   if featuregates.Gate().Enabled(featuregates.ExternalOIDCWithUpstreamParity) {
       userValidationRules, err := generateUserValidationRules(provider.UserValidationRules...)
       out.UserValidationRules = userValidationRules
   }

4. Empty-slice initialization (auth.go:416): generateUserValidationRules initializes its return value as out := []UserValidationRule{} (an empty, non-nil slice). When called with no input rules (the test's OIDC provider has no UserValidationRules), the loop body never executes, and the function returns this empty slice.

5. Test expectation mismatch (auth_test.go:118-141): The test case "When valid OIDC provider is provided..." builds its expected JWTAuthenticator struct but omits the UserValidationRules field entirely. In Go, an omitted slice field in a struct literal defaults to nil. Since cmp.Diff distinguishes nil from []UserValidationRule{}, the test fails.

This is purely a test update issue — the production behavior change is correct and intentional.

Recommendations

Option 1 (Preferred): Update the test expectation — Add UserValidationRules: []UserValidationRule{} to the expected JWTAuthenticator in the failing test case at auth_test.go line ~141, consistent with how the code now behaves with the feature gate enabled by default:

ClaimValidationRules: []ClaimValidationRule{},
UserValidationRules:  []UserValidationRule{},  // ← add this line

Option 2 (Alternative): Fix the production code to return nil for empty input — Change generateUserValidationRules at auth.go line 416 from out := []UserValidationRule{} to var out []UserValidationRule. This would make the function return nil when called with no rules. However, this could affect JSON serialization behavior (null vs [] with omitempty tag), so Option 1 is safer.

Evidence

Evidence	Detail
Failing test	TestGenerateAuthConfig/When_valid_OIDC_provider_is_provided... in auth_test.go:269
Diff output	UserValidationRules: nil (expected) vs []kas.UserValidationRule{} (actual)
PR change	featuregates.go:22 — adds configv1.Default to ExternalOIDCWithUpstreamParity enabled feature sets
Feature gate init	featuregates.go:30 — init() configures Default feature set, so all tests run with it
Activated code path	auth.go:102-108 — gate-protected block now executes, calling generateUserValidationRules
Empty slice source	auth.go:416 — out := []UserValidationRule{} returns non-nil empty slice when no rules are provided
Missing test field	auth_test.go:118-141 — expected struct omits UserValidationRules, defaulting to nil
Feature gate warning	Logs show Setting GA feature gate ExternalOIDCWithUpstreamParity=true. It will be removed in a future release. — confirms gate is now active
Single failing package	Only github.com/openshift/hypershift/.../v2/kas failed (2.951s); all other packages passed

---

[jparrill]

Dropped some comments. Thanks!

CI is red — Unit Tests (cpo-hostedcontrolplane) fails in TestGenerateAuthConfig/When_valid_OIDC_provider_is_provided at auth_test.go:269. The test expected UserValidationRules: nil but after the promotion the parity code path runs by default and produces UserValidationRules: []kas.UserValidationRule{}. The test expectation needs updating for the new default behavior.

/hold

Please hold until openshift/api#2915 merges and we do the vendor bump.

[jparrill]

The upstream openshift/api PR #2915 that promotes this gate to Default hasn't merged yet. The vendored CRDs in this repo (hostedclusters-Hypershift-Default.crd.yaml) don't include the gated fields (discoveryURL, userValidationRules, expression) in the Default schema — so this promotion has no functional effect until that vendor bump lands.

Could you add a note in the PR description marking openshift/api#2915 as a dependency? That way the ordering is explicit for anyone tracking it.