feat(auth): auth config single source of truth

[Zaggy21]

Summary

• Replace mergeAuthenticationConfigurations with a verbatim overwrite of the garden-cluster auth ConfigMap from the Greenhouse CM — shoot-grafter is now the sole owner of that CM's content, so issuer removals propagate correctly.
• Label the garden-cluster auth CM with shoot-grafter.cloudoperators.dev/careinstruction=<careInstructionName> to record ownership.
• Add shoot-grafter.cloudoperators.dev/auth-configured-by=<careInstructionName> label to each Shoot that receives OIDC configuration.
• Add a Watches(&corev1.ConfigMap{}) in ShootController.SetupWithManager filtered by CareInstructionLabel + data-changed predicate, so a change to the garden-cluster auth CM triggers re-reconciliation of all Shoots in the namespace.
• Annotate the garden-cluster auth CM with shoot-grafter.cloudoperators.dev/managed-by to signal it is maintained by automation and should not be edited by hand.
• Replace mergeAuthenticationConfigurations unit tests with ConfigureOIDCAuthentication fake-client tests covering: first encounter, default naming, overwrite of existing CM, content change, and CI AuthenticationConfigMapName rename.

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR changes Shoot OIDC authentication handling to overwrite the Garden authentication ConfigMap with the Greenhouse source-of-truth content, adds ownership/traceability labels, and updates controller behavior to react to relevant ConfigMap changes.

Changes:

• Switch OIDC auth sync from “merge” semantics to verbatim overwrite of Garden CM config.yaml from the Greenhouse CM.
• Add labeling/annotation to track which CareInstruction configured a Shoot and which CM is managed.
• Extend the Shoot controller to watch labeled ConfigMaps and enqueue reconciliations; update/replace tests accordingly.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
controller/shoot/shoot_controller_test.go	Updates integration tests to assert overwrite semantics and new labels.
controller/shoot/shoot_controller.go	Adds a ConfigMap watch and a mapper function to enqueue Shoot reconciles on CM changes.
controller/shoot/auth_test.go	Replaces merge-focused unit tests with overwrite-focused tests using fake clients.
controller/shoot/auth.go	Implements overwrite behavior, adds “configured-by” label on Shoots, and annotates/labels managed Garden CMs.
api/v1alpha1/careinstruction_types.go	Introduces a constant for the Shoot “auth-configured-by” label key.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Suppressed comments (2)

controller/shoot/shoot_controller.go:130

• This watch handler performs a List on every qualifying ConfigMap event. If r.GardenClient is not the controller-runtime cached client backing the watch, this can turn into frequent API-server list calls under churn. Prefer using the manager’s cached client for the list (or ensure GardenClient is the cache-backed client) and consider adding a field/label index for ShootAuthConfiguredByLabel so lookups scale better with the number of Shoots.

// EnqueueShoots maps a ConfigMap change to reconcile requests for Shoots that were configured by the same CareInstruction.
func (r *ShootController) EnqueueShoots(ctx context.Context, obj client.Object) []ctrl.Request {
	ciName := obj.GetLabels()[v1alpha1.CareInstructionLabel]
	var shoots gardenerv1beta1.ShootList
	if err := r.GardenClient.List(ctx, &shoots,
		client.InNamespace(obj.GetNamespace()),
		client.MatchingLabels{v1alpha1.ShootAuthConfiguredByLabel: ciName},
	); err != nil {
		r.Error(err, "failed to list Shoots for ConfigMap watch")
		return nil
	}

controller/shoot/auth.go:22

• authConfigMapManagedBy is used as an annotation key later, but the name doesn’t indicate it’s an annotation (and the key itself ends with /managed-by, which is commonly a label convention). To reduce confusion, consider renaming the constant to something explicit like authConfigMapManagedByAnnotation (or switch to a conventional managed-by label if that’s the intent).

const (
	authConfigMapKey       = "config.yaml"
	authConfigMapManagedBy = "shoot-grafter.cloudoperators.dev/managed-by"
)

[github-actions]

Merging this branch changes the coverage (1 decrease, 1 increase)

Impacted Packages	Coverage Δ	🤖
shoot-grafter/api/v1alpha1	59.22% (ø)
shoot-grafter/controller/careinstruction	82.14% (-0.27%)	👎
shoot-grafter/controller/shoot	78.73% (+0.44%)	👍

---

Coverage by file

Changed files (no unit tests)

Changed File	Coverage Δ	Total	Covered	Missed	🤖
shoot-grafter/api/v1alpha1/careinstruction_types.go	85.00% (ø)	20	17	3
shoot-grafter/controller/careinstruction/careinstruction_controller.go	81.39% (-0.34%)	317 (+5)	258 (+3)	59 (+2)	👎
shoot-grafter/controller/shoot/auth.go	87.93% (+1.68%)	58 (-22)	51 (-18)	7 (-4)	👍
shoot-grafter/controller/shoot/shoot_controller.go	83.75% (+0.97%)	160 (+9)	134 (+9)	26	👍

Please note that the "Total", "Covered", and "Missed" counts above refer to code statements instead of lines of code. The value in brackets refers to the test coverage of that file in the old version of the code.

Changed unit test files

• shoot-grafter/controller/shoot/auth_test.go
• shoot-grafter/controller/shoot/shoot_controller_test.go

[uwe-mayer]

This looks good! 🚀
one minor comment about the label. Should we make it more generic?

[uwe-mayer]

On a second thought I think we can use the more generic shoot-grafter.cloudoperators.dev/careinstruction label, to not reduce the information to auth only?
WDYT?

[uwe-mayer]

Why are we changing this?