WIP: CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate

[tchap]

This feature gate gates component-scoped proxy support for the External OIDC authentication stack.

[openshift-ci]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci-robot]

@tchap: This pull request references CNTRLPLANE-4394 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.1.0" version, but no target version was set.

Details

In response to this:

This feature gate gates component-scoped proxy support for the External OIDC authentication stack.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

Hello @tchap! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: e168c951-8e0a-4269-a298-4e24d363a75f

📥 Commits

Reviewing files that changed from the base of the PR and between e64c296 and fe5dbd1.

📒 Files selected for processing (10)

• features.md
• features/features.go
• payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-TechPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-DevPreviewNoUpgrade.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-TechPreviewNoUpgrade.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

📝 Walkthrough

Walkthrough

The change registers AuthenticationComponentProxyExternalOIDC and DRADeviceTaintRules, and updates SELinuxMount defaults. It adds AuthenticationComponentProxyExternalOIDC to the feature matrix. HyperShift and SelfManagedHA manifests enable the appropriate preview gates and disable them in Default and OKD configurations. DRADeviceTaintRules is enabled in selected preview configurations and disabled in Default and OKD configurations.

Suggested reviewers: vr4manta

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to fe5db

The feature-gate changes have no confirmed merge-blocking behavior or configuration mismatch.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: adding the AuthenticationComponentProxyExternalOIDC feature gate.
Description check	✅ Passed	The description directly explains what the new feature gate controls and matches the pull request changes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The reviewed range changes one documentation table, one feature-gate registry, and eight JSON feature-gate manifests. The added content contains only the static identifier `AuthenticationComponentProx…
Test Structure And Quality	✅ Passed	PASS: The reviewed range changes only feature registration, feature-gate manifests, and documentation. It adds no Ginkgo test file, test block, cluster operation, wait, or assertion. Therefore the lis…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only feature documentation, feature-gate registration, and feature-gate YAML manifests. The authoritative diff adds no Ginkgo tests or other test files, so the MicroShif…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The scoped pull-request diff changes only feature-gate declarations, the feature matrix, and feature-gate manifests. It adds no Ginkgo e2e tests or test declarations, so the SNO test-compatibility che…
Topology-Aware Scheduling Compatibility	✅ Passed	The pull request changes only feature metadata and FeatureGate payload manifests. The new Go declaration registers AuthenticationComponentProxyExternalOIDC and enables it for preview feature sets. T…
Ote Binary Stdout Contract	✅ Passed	PASS. The reviewed diff changes one Go top-level feature-gate initializer and feature-gate manifests/documentation. It does not add or modify main(), init(), TestMain(), Ginkgo suite setup, or RunSpec…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The pull request adds no Ginkgo or other e2e test. The review-scoped diff changes only features.md, features/features.go, and feature-gate YAML manifests. No added It(), Describe(), `Context()…
No-Weak-Crypto	✅ Passed	PASS: The reviewed diff adds only a feature-gate declaration, documentation, and JSON manifest entries. The added Go code registers metadata and enablement; it does not implement cryptography, secret …
Container-Privileges	✅ Passed	The pull request adds one feature-gate declaration, documentation, and entries to eight FeatureGate status manifests. The changed YAML objects are kind: FeatureGate and contain no container security…
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The pull request adds only feature-gate metadata, documentation, and manifest entries. The authoritative diff contains no logging calls, log messages, credentials, tokens, PII, hostnames, or cus…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tchap]

/retest

[everettraven]

The changes here LGTM.

Before merging this into the TPNU feature-set, lets get the EP reviewed, agreed upon, and merged.

If we want to merge this gate sooner than that, we can merge this under DPNU only once we have some general agreement from stakeholders that the direction in the EP is reasonable.

[openshift-ci]

@tchap: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[tchap]

/retitle WIP: CNTRLPLANE-4394: Add AuthenticationComponentProxyExternalOIDC feature gate