OCPBUGS-56908: validate identity provider names as annotation keys

[agawai]

Summary

• Close the oauth-server sanitization approach (openshift/oauth-server#252 is closed). Identity provider names that cannot be used as Kubernetes annotation keys are now rejected on the OAuth CRD instead.
• Add CEL on spec.identityProviders so name matches the annotation name-part used by oauth-server (oauth.openshift.io/idp.<name>): alphanumeric, -, _, ., start and end alphanumeric, at most 59 characters. This is the OCPBUGS-56908 failure (Microsoft Entra ID, AIF - Keycloak).
• Ratchet with optionalOldSelf so existing clusters that already have those names can still update the OAuth object until the name is changed. New names with spaces are rejected at admission.

Test plan

• CRD integration tests in config/v1/tests/oauths.config.openshift.io/AAA_ungated.yaml cover valid names, names with spaces, adding a new invalid IdP, and renaming to a valid name
• CI verify / integration tests for oauths.config.openshift.io
• Review with @liouk and @everettraven (agreed approach on OCPBUGS-56908)

Made with Cursor

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@agawai: This pull request references Jira Issue OCPBUGS-56908, which is invalid:

• expected the bug to target either version "5.1.0." or "openshift-5.1.0.", but it targets "5.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Summary

• Close the oauth-server sanitization approach (openshift/oauth-server#252 is closed). Identity provider names that cannot be used as Kubernetes annotation keys are now rejected on the OAuth CRD instead.
• Add CEL on spec.identityProviders so name matches the annotation name-part used by oauth-server (oauth.openshift.io/idp.<name>): alphanumeric, -, _, ., start and end alphanumeric, at most 59 characters. This is the OCPBUGS-56908 failure (Microsoft Entra ID, AIF - Keycloak).
• Ratchet with optionalOldSelf so existing clusters that already have those names can still update the OAuth object until the name is changed. New names with spaces are rejected at admission.

Test plan

• CRD integration tests in config/v1/tests/oauths.config.openshift.io/AAA_ungated.yaml cover valid names, names with spaces, adding a new invalid IdP, and renaming to a valid name
• CI verify / integration tests for oauths.config.openshift.io
• Review with @liouk and @everettraven (agreed approach on OCPBUGS-56908)

Made with Cursor

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Team

Run ID: ed6d53fa-31a9-4785-82a0-43fbab9bc9db

📥 Commits

Reviewing files that changed from the base of the PR and between 8127870 and c4a1197.

⛔ Files ignored due to path filters (3)

• config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_oauths.crd.yaml is excluded by !**/zz_generated.crd-manifests/*
• config/v1/zz_generated.featuregated-crd-manifests/oauths.config.openshift.io/AAA_ungated.yaml is excluded by !**/zz_generated.featuregated-crd-manifests/**
• config/v1/zz_generated.swagger_doc_generated.go is excluded by !**/zz_generated*

📒 Files selected for processing (3)

• config/v1/tests/oauths.config.openshift.io/AAA_ungated.yaml
• config/v1/types_oauth.go
• payload-manifests/crds/0000_10_config-operator_01_oauths.crd.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The OAuth API now validates identity provider names against the Kubernetes annotation name-part pattern. Existing unchanged invalid names remain allowed through the grandfather clause. The generated CRD includes the same validation and documentation. Tests cover valid names, names containing spaces, provider field updates, invalid provider additions, and valid provider renames.

Merge Risk: ⚪ Minimal · up to c4a11

OAuth identity provider names now reject annotation-incompatible new values while allowing unchanged legacy names to be updated. The validation, published schema, and covered update behavior are aligned, with no remaining merge-blocking risk identified.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: validating identity provider names as Kubernetes annotation keys.
Description check	✅ Passed	The description directly explains the CEL validation, grandfathering behavior, affected invalid names, and test coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS: The pull request adds seven literal OAuth table-entry titles. The test generator passes each YAML name directly to Ginkgo Entry; none uses interpolation, timestamps, UUIDs, node or namespace…
Test Structure And Quality	✅ Passed	PASS — The pull request adds declarative API test cases, not new hand-written Ginkgo blocks. Each case checks one identity-provider behavior and includes a descriptive table name or expected error. Th…
Microshift Test Compatibility	✅ Passed	The pull request adds declarative CRD test cases in config/v1/tests/oauths.config.openshift.io/AAA_ungated.yaml. It does not add Ginkgo e2e tests or use It(), Describe(), Context(), or `When()…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS. The pull request adds declarative CRD admission cases in config/v1/tests/oauths.config.openshift.io/AAA_ungated.yaml, not Ginkgo e2e tests. The cases only create and update OAuth API objects. …
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only OAuth API validation/documentation, generated CRD and Swagger files, and CRD integration tests. The changed paths contain no Deployment, controller, pod template, a…
Ote Binary Stdout Contract	✅ Passed	PASS. The pull request changes OAuth API comments/validation, generated CRD YAML, and YAML integration tests. The only changed Go files are config/v1/types_oauth.go and generated Swagger documentati…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS. The pull request adds declarative OAuth API integration cases in YAML, not tests that connect to network endpoints. The harness creates and updates unstructured objects against an envtest API se…
No-Weak-Crypto	✅ Passed	The pull request adds only OAuth schema validation, documentation, generated CRD text, and YAML test fixtures. The Go diff contains comments and a CEL regex; it adds no crypto imports, weak algorithms…
Container-Privileges	✅ Passed	PASS: The pull request changes OAuth test data, Go API comments/validation, generated Swagger text, and CRD schemas. The changed YAML objects are an OAuth test fixture or CustomResourceDefinition, not…
No-Sensitive-Data-In-Logs	✅ Passed	The pull request adds CEL validation, CRD documentation, generated schema updates, and test fixtures. It adds no logging calls or log messages. The test fixtures use placeholder secret references such…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

Hello @agawai! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[openshift-ci]

Hi @agawai. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.