CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate

[tchap]

This feature gate gates component-scoped proxy support for the External OIDC authentication stack.

[openshift-ci]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@tchap: This pull request references CNTRLPLANE-4394 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

This feature gate gates component-scoped proxy support for the External OIDC authentication stack.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @tchap! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: f2105bd6-fc10-46e8-8b23-e9f77d932a09

📥 Commits

Reviewing files that changed from the base of the PR and between 8335301 and e64c296.

📒 Files selected for processing (10)

• features.md
• features/features.go
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds and registers the AuthenticationComponentProxyExternalOIDC feature gate. It adds the gate to the feature matrix. HyperShift and SelfManagedHA manifests enable it for TechPreviewNoUpgrade. HyperShift also enables it for DevPreviewNoUpgrade. Default and OKD manifests keep it disabled.

Suggested reviewers: vr4manta

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to e64c2

The feature gate definition, matrix entry, and profile settings are consistent, so the change is mergeable with normal checks.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the addition of the AuthenticationComponentProxyExternalOIDC feature gate and matches the main changeset.
Description check	✅ Passed	The description explains that the feature gate controls component-scoped proxy support for the External OIDC authentication stack, which matches the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The review range changes only feature metadata, feature-gate declarations, manifests, and documentation. It adds no Ginkgo test files or test declarations. Searches of the changed Go file found no It,…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only feature metadata and JSON/YAML feature-gate manifests. The authoritative diff contains no Ginkgo test files or test constructs such as It, BeforeEach, AfterEach, Ev…
Microshift Test Compatibility	✅ Passed	The pull request changes only the feature matrix, feature-gate registration, and feature-gate manifests. The authoritative diff contains no new Ginkgo tests or test constructs such as It(), Describe()…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR adds a feature declaration, documentation, and feature-gate manifest entries only. The authoritative diff contains no new or changed Ginkgo e2e tests, and no added It(), Describe(), `Contex…
Topology-Aware Scheduling Compatibility	✅ Passed	The check is not applicable to this pull request. The authoritative diff changes only feature metadata and eight kind: FeatureGate objects. It adds no Deployment, controller, operator, or workload s…
Ote Binary Stdout Contract	✅ Passed	PASS. The PR changes only feature-gate registration, feature metadata, manifests, and documentation. The added Go code is a declarative feature-gate initializer. The diff adds no main(), init(), TestM…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only feature documentation, Go feature-gate registration, and YAML feature-gate manifests. The authoritative diff adds no Ginkgo tests or test code, so it introduces no …
No-Weak-Crypto	✅ Passed	The pull request adds one feature-gate declaration, feature-matrix metadata, and manifest entries. The added lines contain no MD5, SHA1, DES, RC4, 3DES, Blowfish, ECB, custom crypto, or secret/token c…
Container-Privileges	✅ Passed	The pull request changes only feature declarations, documentation, and config.openshift.io/v1 FeatureGate manifests. The added manifest entries only name AuthenticationComponentProxyExternalOIDC…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request adds one feature declaration, feature-matrix documentation, and feature-gate manifest entries. The added lines contain no logging calls, log messages, credentials, tokens, passw…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tchap]

/retest

[openshift-ci]

@tchap: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.