API-1835: test/oauth-server-payloadConfigController: adds a test to show which input resources are required to run the operator and the payloadConfigController #786
+1,729
−66
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| apiVersion: v1 | ||
| count: 1 | ||
| eventTime: null | ||
| firstTimestamp: "2024-10-14T22:38:20Z" | ||
| involvedObject: | ||
| kind: Deployment | ||
| name: authentication-operator | ||
| namespace: openshift-authentication-operator | ||
| kind: Event | ||
| lastTimestamp: "2024-10-14T22:38:20Z" | ||
| message: 'Writing updated section ("oauthServer") of observed config: "\u00a0\u00a0map[string]any(\n-\u00a0\tnil,\n+\u00a0\t{\n+\u00a0\t\t\"corsAllowedOrigins\": | ||
| []any{string(`//127\\.0\\.0\\.1(:|$)`), string(\"//localhost(:|$)\")},\n+\u00a0\t\t\"oauthConfig\": | ||
| map[string]any{\n+\u00a0\t\t\t\"loginURL\": string(\"https://api.ostest.test.metalkube.org:6443\"),\n+\u00a0\t\t\t\"tokenConfig\": | ||
| map[string]any{\n+\u00a0\t\t\t\t\"accessTokenMaxAgeSeconds\": float64(86400),\n+\u00a0\t\t\t\t\"authorizeTokenMaxAgeSeconds\": | ||
| float64(300),\n+\u00a0\t\t\t},\n+\u00a0\t\t},\n+\u00a0\t\t\"serverArguments\": map[string]any{\n+\u00a0\t\t\t\"audit-log-format\": []any{string(\"json\")},\n+\u00a0\t\t\t\"audit-log-maxbackup\": | ||
| []any{string(\"10\")},\n+\u00a0\t\t\t\"audit-log-maxsize\": []any{string(\"100\")},\n+\u00a0\t\t\t\"audit-log-path\": []any{string(\"/var/log/oauth-server/audit.log\")},\n+\u00a0\t\t\t\"audit-policy-file\": []any{string(\"/var/run/configmaps/audit/audit.\"...)},\n+\u00a0\t\t},\n+\u00a0\t\t\"servingInfo\": | ||
| map[string]any{\n+\u00a0\t\t\t\"cipherSuites\": []any{\n+\u00a0\t\t\t\tstring(\"TLS_AES_128_GCM_SHA256\"), | ||
| string(\"TLS_AES_256_GCM_SHA384\"),\n+\u00a0\t\t\t\tstring(\"TLS_CHACHA20_POLY1305_SHA256\"),\n+\u00a0\t\t\t\tstring(\"TLS_ECDHE_ECDSA_WITH_AES_128_GCM\"...), | ||
| ...,\n+\u00a0\t\t\t},\n+\u00a0\t\t\t\"minTLSVersion\": string(\"VersionTLS12\"),\n+\u00a0\t\t},\n+\u00a0\t},\n\u00a0\u00a0)\n"' | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: authentication-operator.17fe72c59b829800.b2cdb588 | ||
| namespace: openshift-authentication-operator | ||
| reason: ObservedConfigChanged | ||
| reportingComponent: "" | ||
| reportingInstance: "" | ||
| source: | ||
| component: cluster-authentication-operator-run-once-sync-context | ||
| type: Normal |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| apiVersion: v1 | ||
| count: 1 | ||
| eventTime: null | ||
| firstTimestamp: "2024-10-14T22:38:20Z" | ||
| involvedObject: | ||
| kind: Deployment | ||
| name: authentication-operator | ||
| namespace: openshift-authentication-operator | ||
| kind: Event | ||
| lastTimestamp: "2024-10-14T22:38:20Z" | ||
| message: 'Writing updated section ("oauthAPIServer") of observed config: "\u00a0\u00a0map[string]any(\n-\u00a0\tnil,\n+\u00a0\t{\n+\u00a0\t\t\"apiServerArguments\": | ||
| map[string]any{\n+\u00a0\t\t\t\"api-audiences\": []any{string(\"https://kubernetes.default.svc\")},\n+\u00a0\t\t\t\"cors-allowed-origins\": | ||
| []any{string(`//127\\.0\\.0\\.1(:|$)`), string(\"//localhost(:|$)\")},\n+\u00a0\t\t\t\"feature-gates\": []any{},\n+\u00a0\t\t\t\"tls-cipher-suites\": | ||
| []any{\n+\u00a0\t\t\t\tstring(\"TLS_AES_128_GCM_SHA256\"), string(\"TLS_AES_256_GCM_SHA384\"),\n+\u00a0\t\t\t\tstring(\"TLS_CHACHA20_POLY1305_SHA256\"),\n+\u00a0\t\t\t\tstring(\"TLS_ECDHE_ECDSA_WITH_AES_128_GCM\"...), | ||
| ...,\n+\u00a0\t\t\t},\n+\u00a0\t\t\t\"tls-min-version\": string(\"VersionTLS12\"),\n+\u00a0\t\t},\n+\u00a0\t},\n\u00a0\u00a0)\n"' | ||
| metadata: | ||
| creationTimestamp: null | ||
| name: authentication-operator.17fe72c59b829800.5aa4f723 | ||
| namespace: openshift-authentication-operator | ||
| reason: ObservedConfigChanged | ||
| reportingComponent: "" | ||
| reportingInstance: "" | ||
| source: | ||
| component: cluster-authentication-operator-run-once-sync-context | ||
| type: Normal |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| @@ -0,0 +1,22 @@ | ||||||||||
| apiVersion: v1 | ||||||||||
| count: 1 | ||||||||||
| eventTime: null | ||||||||||
| firstTimestamp: "2025-08-07T22:38:20Z" | ||||||||||
| involvedObject: | ||||||||||
| kind: Deployment | ||||||||||
| name: authentication-operator | ||||||||||
| namespace: openshift-authentication-operator | ||||||||||
| kind: Event | ||||||||||
| lastTimestamp: "2025-08-07T22:38:20Z" | ||||||||||
| message: Created ConfigMap/v4-0-config-system-cliconfig -n openshift-authentication | ||||||||||
| because it was missing | ||||||||||
|
Comment on lines
+11
to
+12
There was a problem hiding this comment. Fix multi-line message (newline will not match expected string) The message spans two YAML lines, producing an embedded newline. Use a folded scalar to keep it a single line. -message: Created ConfigMap/v4-0-config-system-cliconfig -n openshift-authentication
- because it was missing
+message: >-
+ Created ConfigMap/v4-0-config-system-cliconfig -n openshift-authentication because it was missing📝 Committable suggestion
Suggested change
🤖 Prompt for AI Agents |
||||||||||
| metadata: | ||||||||||
| creationTimestamp: null | ||||||||||
| name: authentication-operator.18599d2230299800.18b41977 | ||||||||||
| namespace: openshift-authentication-operator | ||||||||||
| reason: ConfigMapCreated | ||||||||||
| reportingComponent: "" | ||||||||||
| reportingInstance: "" | ||||||||||
| source: | ||||||||||
| component: cluster-authentication-operator-run-once-sync-context | ||||||||||
| type: Normal | ||||||||||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| action: Create | ||
| controllerInstanceName: "" | ||
| generateName: "" | ||
| name: authentication-operator.18599d2230299800.18b41977 | ||
| namespace: openshift-authentication-operator | ||
| resourceType: | ||
| Group: "" | ||
| Resource: events | ||
| Version: v1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,10 @@ | ||
| apiVersion: v1 | ||
| data: | ||
| v4-0-config-system-cliconfig: '{"admission":{},"apiVersion":"osin.config.openshift.io/v1","auditConfig":{"auditFilePath":"","enabled":false,"logFormat":"","maximumFileRetentionDays":0,"maximumFileSizeMegabytes":0,"maximumRetainedFiles":0,"policyConfiguration":null,"policyFile":"","webHookKubeConfig":"","webHookMode":""},"corsAllowedOrigins":["//127\\.0\\.0\\.1(:|$)","//localhost(:|$)"],"kind":"OsinServerConfig","kubeClientConfig":{"connectionOverrides":{"acceptContentTypes":"","burst":400,"contentType":"","qps":400},"kubeConfig":""},"oauthConfig":{"alwaysShowProviderSelection":false,"assetPublicURL":"https://console-openshift-console.apps.ci-op-gn2pz6q7-69aee.XXXXXXXXXXXXXXXXXXXXXX","grantConfig":{"method":"deny","serviceAccountMethod":"prompt"},"identityProviders":null,"loginURL":"https://api.ci-op-gn2pz6q7-69aee.XXXXXXXXXXXXXXXXXXXXXX:6443","masterCA":"/var/config/system/configmaps/v4-0-config-system-service-ca/service-ca.crt","masterPublicURL":"https://oauth-openshift.apps.ci-op-gn2pz6q7-69aee.XXXXXXXXXXXXXXXXXXXXXX","masterURL":"https://oauth-openshift.openshift-authentication.svc","sessionConfig":{"sessionMaxAgeSeconds":300,"sessionName":"ssn","sessionSecretsFile":"/var/config/system/secrets/v4-0-config-system-session/v4-0-config-system-session"},"templates":{"error":"/var/config/system/secrets/v4-0-config-system-ocp-branding-template/errors.html","login":"/var/config/system/secrets/v4-0-config-system-ocp-branding-template/login.html","providerSelection":"/var/config/system/secrets/v4-0-config-system-ocp-branding-template/providers.html"},"tokenConfig":{"accessTokenMaxAgeSeconds":86400,"authorizeTokenMaxAgeSeconds":300}},"servingInfo":{"bindAddress":"0.0.0.0:6443","bindNetwork":"tcp","certFile":"/var/config/system/secrets/v4-0-config-system-serving-cert/tls.crt","cipherSuites":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256","TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"],"keyFile":"/var/config/system/secrets/v4-0-config-system-serving-cert/tls.key","maxRequestsInFlight":1000,"minTLSVersion":"VersionTLS12","namedCertificates":[{"certFile":"/var/config/system/secrets/v4-0-config-system-router-certs/apps.ci-op-gn2pz6q7-69aee.XXXXXXXXXXXXXXXXXXXXXX","keyFile":"/var/config/system/secrets/v4-0-config-system-router-certs/apps.ci-op-gn2pz6q7-69aee.XXXXXXXXXXXXXXXXXXXXXX","names":["*.apps.ci-op-gn2pz6q7-69aee.XXXXXXXXXXXXXXXXXXXXXX"]}],"requestTimeoutSeconds":300},"storageConfig":{"ca":"","certFile":"","keyFile":"","storagePrefix":""}}' | ||
| kind: ConfigMap | ||
| metadata: | ||
| creationTimestamp: null | ||
| labels: | ||
| app: oauth-openshift | ||
| name: v4-0-config-system-cliconfig | ||
| namespace: openshift-authentication |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,9 @@ | ||
| action: Create | ||
| controllerInstanceName: TODO-payloadConfigController | ||
| generateName: "" | ||
| name: v4-0-config-system-cliconfig | ||
| namespace: openshift-authentication | ||
| resourceType: | ||
| Group: "" | ||
| Resource: configmaps | ||
| Version: v1 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| controllerResults: | ||
| - controllerName: APIServerStaticResources-StaticResources | ||
| status: Skipped | ||
| - controllerName: NamespaceFinalizerController_openshift-oauth-apiserver | ||
| status: Skipped | ||
| - controllerName: OAuthAPIServerController-WorkloadWorkloadController | ||
| status: Skipped | ||
| - controllerName: RevisionController | ||
| status: Skipped | ||
| - controllerName: SecretRevisionPruneController | ||
| status: Skipped | ||
| - controllerName: TODO-authRouteCheckController | ||
| status: Skipped | ||
| - controllerName: TODO-authServiceCheckController | ||
| status: Skipped | ||
| - controllerName: TODO-authServiceEndpointCheckController | ||
| status: Skipped | ||
| - controllerName: TODO-authenticatorCertRequester | ||
| status: Skipped | ||
| - controllerName: TODO-configObserver | ||
| status: Skipped | ||
| - controllerName: TODO-configOverridesController | ||
| status: Skipped | ||
| - controllerName: TODO-customRouteController | ||
| status: Skipped | ||
| - controllerName: TODO-deploymentController | ||
| status: Skipped | ||
| - controllerName: TODO-ingressStateController | ||
| status: Skipped | ||
| - controllerName: TODO-logLevelController | ||
| status: Skipped | ||
| - controllerName: TODO-managementStateController | ||
| status: Skipped | ||
| - controllerName: TODO-metadataController | ||
| status: Skipped | ||
| - controllerName: TODO-oauthClientsSwitchedController | ||
| status: Skipped | ||
| - controllerName: TODO-other-configObserver | ||
| status: Skipped | ||
| - controllerName: TODO-other-externalOIDCController | ||
| status: Skipped | ||
| - controllerName: TODO-payloadConfigController | ||
| status: Succeeded | ||
| - controllerName: TODO-proxyConfigController | ||
| status: Skipped | ||
| - controllerName: TODO-resourceSyncer | ||
| status: Skipped | ||
| - controllerName: TODO-routerCertsController | ||
| status: Skipped | ||
| - controllerName: TODO-serviceCAController | ||
| status: Skipped | ||
| - controllerName: TODO-staleConditions | ||
| status: Skipped | ||
| - controllerName: TODO-staticResourceController | ||
| status: Skipped | ||
| - controllerName: TODO-trustDistributionController | ||
| status: Skipped | ||
| - controllerName: TODO-webhookAuthController | ||
| status: Skipped | ||
| - controllerName: TODO-webhookCertsApprover | ||
| status: Skipped | ||
| - controllerName: TODO-wellKnownReadyController | ||
| status: Skipped | ||
| - controllerName: TODO-workersAvailableController | ||
| status: Skipped | ||
| - controllerName: auditPolicyController | ||
| status: Skipped | ||
| - controllerName: authentication | ||
| status: Skipped | ||
| - controllerName: openshift-apiserver-APIService | ||
| status: Skipped | ||
| - controllerName: openshift-oauth-apiserver-EncryptionCondition | ||
| status: Skipped | ||
| - controllerName: openshift-oauth-apiserver-EncryptionKey | ||
| status: Skipped | ||
| - controllerName: openshift-oauth-apiserver-EncryptionMigration | ||
| status: Skipped | ||
| - controllerName: openshift-oauth-apiserver-EncryptionPrune | ||
| status: Skipped | ||
| - controllerName: openshift-oauth-apiserver-EncryptionState | ||
| status: Skipped |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| --- | ||
| apiVersion: config.openshift.io/v1 | ||
| items: | ||
| - apiVersion: config.openshift.io/v1 | ||
| kind: Authentication | ||
| metadata: | ||
| annotations: | ||
| include.release.openshift.io/ibm-cloud-managed: "true" | ||
| include.release.openshift.io/self-managed-high-availability: "true" | ||
| release.openshift.io/create-only: "true" | ||
| creationTimestamp: "2025-08-01T18:29:45Z" | ||
| generation: 2 | ||
| managedFields: | ||
| - apiVersion: config.openshift.io/v1 | ||
| fieldsType: FieldsV1 | ||
| fieldsV1: | ||
| f:metadata: | ||
| f:annotations: | ||
| .: {} | ||
| f:include.release.openshift.io/ibm-cloud-managed: {} | ||
| f:include.release.openshift.io/self-managed-high-availability: {} | ||
| f:release.openshift.io/create-only: {} | ||
| f:ownerReferences: | ||
| .: {} | ||
| k:{"uid":"fd412cff-9592-4cb6-b0e9-97a5c376f29e"}: {} | ||
| f:spec: {} | ||
| manager: cluster-version-operator | ||
| operation: Update | ||
| time: "2025-08-01T18:29:45Z" | ||
| - apiVersion: config.openshift.io/v1 | ||
| fieldsType: FieldsV1 | ||
| fieldsV1: | ||
| f:spec: | ||
| f:oauthMetadata: | ||
| .: {} | ||
| f:name: {} | ||
| f:serviceAccountIssuer: {} | ||
| f:type: {} | ||
| f:webhookTokenAuthenticator: | ||
| .: {} | ||
| f:kubeConfig: | ||
| .: {} | ||
| f:name: {} | ||
| manager: authentication-operator | ||
| operation: Update | ||
| time: "2025-08-01T18:35:35Z" | ||
| - apiVersion: config.openshift.io/v1 | ||
| fieldsType: FieldsV1 | ||
| fieldsV1: | ||
| f:status: | ||
| .: {} | ||
| f:integratedOAuthMetadata: | ||
| .: {} | ||
| f:name: {} | ||
| manager: authentication-operator | ||
| operation: Update | ||
| subresource: status | ||
| time: "2025-08-01T18:44:36Z" | ||
| name: cluster | ||
| ownerReferences: | ||
| - apiVersion: config.openshift.io/v1 | ||
| kind: ClusterVersion | ||
| name: version | ||
| uid: fd412cff-9592-4cb6-b0e9-97a5c376f29e | ||
| resourceVersion: "20310" | ||
| uid: 7adc5a7e-47eb-41c7-af2e-9faa138dccc5 | ||
| spec: | ||
| oauthMetadata: | ||
| name: "" | ||
| serviceAccountIssuer: "" | ||
| type: "" | ||
| webhookTokenAuthenticator: | ||
| kubeConfig: | ||
| name: webhook-authentication-integrated-oauth | ||
| status: | ||
| integratedOAuthMetadata: | ||
| name: oauth-openshift | ||
| kind: AuthenticationList | ||
| metadata: | ||
| continue: "" | ||
| resourceVersion: "269028" |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
💡 Verification agent
🧩 Analysis chain
Intended replacement not fully applied (old ConfigMaps still listed).
PR summary says “replace” audit and trusted-ca-bundle with cliconfig, but both old entries remain. Remove them to match intent and tests.
libraryoutputresources.ExactNamespace("openshift-oauth-apiserver"), - libraryoutputresources.ExactConfigMap("openshift-authentication", "audit"), - libraryoutputresources.ExactConfigMap("openshift-authentication", "v4-0-config-system-trusted-ca-bundle"), libraryoutputresources.ExactConfigMap("openshift-authentication", "v4-0-config-system-cliconfig"),Run to double-check for lingering references:
🏁 Script executed:
Length of output: 655
Remove obsolete ConfigMap entries from input and output commands
to match the PR summary and associated tests.
🤖 Prompt for AI Agents