Skip to content

[release-4.22][OCPBUGS-88312] cherry-pick use in-cluster service for oauth-server - #9127

Open
Tamas-Biro1 wants to merge 3 commits into
openshift:release-4.22from
Tamas-Biro1:incluster-service-for-auth-server
Open

[release-4.22][OCPBUGS-88312] cherry-pick use in-cluster service for oauth-server#9127
Tamas-Biro1 wants to merge 3 commits into
openshift:release-4.22from
Tamas-Biro1:incluster-service-for-auth-server

Conversation

@Tamas-Biro1

Copy link
Copy Markdown
Contributor

What this PR does / why we need it:

When a user clicks “Display Token”, the oauth-openshift service attempts to call itself using the cluster’s API endpoint.
This self-call fails depending on whether the oauth-server is configured a public or private service URL as MasterURL.

In case of a public URL and control plane outbound connecitivty is restricted, the call fails.
In case a private URL, it can happen that the DNS is also a private one, and DNS resolution fails.

Which issue(s) this PR fixes:

Fixes OCPBUGS-88312

Special notes for your reviewer:

Checklist:

  • Subject and description added to both, commit and PR.
  • Relevant issues have been referenced.
  • This change includes docs.
  • This change includes unit tests.

oauth-openshift performs a self-call using the MasterURL when users click 'Display Token'.
This can fail depending on whether the URL is public or private.

Public URL: fails when outbound connectivity is restricted.
Private URL: may fail due to private DNS resolution issues.

Use the in-cluster service URL to ensure reliable self-calls.
use constants from the same package instead of creating new consts
@openshift-merge-bot

Copy link
Copy Markdown
Contributor

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

@openshift-ci openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 27, 2026
@coderabbitai

coderabbitai Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: cf8ce982-cebf-407b-97e5-bc69f462d94b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@Tamas-Biro1 Tamas-Biro1 changed the title Incluster service for auth server [release-4.22][OCPBUGS-88312] cherry-pick use in-cluster service for oauth-server Jul 27, 2026
@openshift-ci

openshift-ci Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: Tamas-Biro1
Once this PR has been reviewed and has the lgtm label, please assign bryan-cox for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci openshift-ci Bot added needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release labels Jul 27, 2026
@openshift-ci

openshift-ci Bot commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

Hi @Tamas-Biro1. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@Tamas-Biro1
Tamas-Biro1 marked this pull request as ready for review July 27, 2026 16:56
@openshift-ci openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jul 27, 2026
@openshift-ci
openshift-ci Bot requested review from muraee and sjenning July 27, 2026 16:57
@Tamas-Biro1
Tamas-Biro1 force-pushed the incluster-service-for-auth-server branch 2 times, most recently from 1fcc34c to b01983b Compare July 28, 2026 13:17
@openshift-ci openshift-ci Bot added the area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release label Jul 28, 2026
Fix package conflicts when cherry-picking to 4.22
@Tamas-Biro1
Tamas-Biro1 force-pushed the incluster-service-for-auth-server branch from b01983b to f0f25a3 Compare July 28, 2026 13:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release area/hypershift-operator Indicates the PR includes changes for the hypershift operator and API - outside an OCP release needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants