Skip to content

Commit 1fa3639

Browse files
ShazaAldawamnehShazaAldawamneh
committed
fixing tests
Signed-off-by: Shaza Aldawamneh <[email protected]>
1 parent 8e0ef94 commit 1fa3639

File tree

22 files changed

+650
-301
lines changed

22 files changed

+650
-301
lines changed

‎config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithNewAuthConfigFields.yaml‎

Lines changed: 164 additions & 136 deletions
Large diffs are not rendered by default.

‎config/v1/types_authentication.go‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -249,7 +249,6 @@ type OIDCProvider struct {
249249
// These rules determine whether a token subject is considered valid based on its claims.
250250
// Each rule is evaluated independently.
251251
// See the TokenUserValidationRule type for more information on rule structure.
252-
253252
// +listType=atomic
254253
// +kubebuilder:validation:MaxItems=64
255254
// +optional
@@ -785,19 +784,28 @@ const (
785784
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'RequiredClaim' ? has(self.requiredClaim) : !has(self.requiredClaim)",message="requiredClaim must be set when type is 'RequiredClaim', and forbidden otherwise"
786785
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithNewAuthConfigFields,rule="has(self.type) && self.type == 'Expression' ? has(self.expressionRule) : !has(self.expressionRule)",message="expressionRule must be set when type is 'Expression', and forbidden otherwise"
787786

787+
// TokenClaimValidationRule represents a validation rule based on token claims.
788+
// If type is RequiredClaim, requiredClaim must be set.
789+
// If type is Expression, expressionRule must be set.
790+
//
791+
// +kubebuilder:validation:XValidation:rule="has(self.type) && self.type == 'RequiredClaim' ? has(self.requiredClaim) : !has(self.requiredClaim)",message="requiredClaim must be set when type is 'RequiredClaim', and forbidden otherwise"
792+
// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithNewAuthConfigFields,rule="has(self.type) && self.type == 'Expression' ? has(self.expressionRule) : !has(self.expressionRule)",message="expressionRule must be set when type is 'Expression', and forbidden otherwise"
788793
type TokenClaimValidationRule struct {
789794
// type is an optional field that configures the type of the validation rule.
790795
//
791-
// Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
796+
// Allowed values are "RequiredClaim" and "Expression".
797+
//
798+
// When set to 'RequiredClaim', the Kubernetes API server will be configured
799+
// to validate that the incoming JWT contains the required claim and that its
800+
// value matches the required value.
792801
//
793-
// When set to 'RequiredClaim', the Kubernetes API server
794-
// will be configured to validate that the incoming JWT
795-
// contains the required claim and that its value matches
796-
// the required value.
802+
// When set to 'Expression', the Kubernetes API server will be configured
803+
// to validate the incoming JWT against the configured CEL expression.
797804
//
798-
// Defaults to 'RequiredClaim'.
805+
// Defaults to "RequiredClaim".
799806
//
800807
// +kubebuilder:default="RequiredClaim"
808+
// +kubebuilder:validation:Enum=RequiredClaim;Expression
801809
Type TokenValidationRuleType `json:"type"`
802810

803811
// requiredClaim allows configuring a required claim name and its expected value.

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-CustomNoUpgrade.crd.yaml‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -347,6 +347,10 @@ spec:
347347
348348
Validation rules are joined via an AND operation.
349349
items:
350+
description: |-
351+
TokenClaimValidationRule represents a validation rule based on token claims.
352+
If type is RequiredClaim, requiredClaim must be set.
353+
If type is Expression, expressionRule must be set.
350354
properties:
351355
expressionRule:
352356
description: |-
@@ -397,28 +401,38 @@ spec:
397401
- requiredValue
398402
type: object
399403
type:
404+
allOf:
405+
- enum:
406+
- RequiredClaim
407+
- Expression
408+
- enum:
409+
- RequiredClaim
410+
- Expression
400411
default: RequiredClaim
401412
description: |-
402413
type is an optional field that configures the type of the validation rule.
403414
404-
Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
415+
Allowed values are "RequiredClaim" and "Expression".
405416
406-
When set to 'RequiredClaim', the Kubernetes API server
407-
will be configured to validate that the incoming JWT
408-
contains the required claim and that its value matches
409-
the required value.
417+
When set to 'RequiredClaim', the Kubernetes API server will be configured
418+
to validate that the incoming JWT contains the required claim and that its
419+
value matches the required value.
410420
411-
Defaults to 'RequiredClaim'.
412-
enum:
413-
- RequiredClaim
414-
- Expression
421+
When set to 'Expression', the Kubernetes API server will be configured
422+
to validate the incoming JWT against the configured CEL expression.
423+
424+
Defaults to "RequiredClaim".
415425
type: string
416426
type: object
417427
x-kubernetes-validations:
418428
- message: requiredClaim must be set when type is 'RequiredClaim',
419429
and forbidden otherwise
420430
rule: 'has(self.type) && self.type == ''RequiredClaim''
421431
? has(self.requiredClaim) : !has(self.requiredClaim)'
432+
- message: requiredClaim must be set when type is 'RequiredClaim',
433+
and forbidden otherwise
434+
rule: 'has(self.type) && self.type == ''RequiredClaim''
435+
? has(self.requiredClaim) : !has(self.requiredClaim)'
422436
type: array
423437
x-kubernetes-list-type: atomic
424438
issuer:
@@ -627,6 +641,11 @@ spec:
627641
- componentName
628642
x-kubernetes-list-type: map
629643
userValidationRules:
644+
description: |-
645+
userValidationRules defines the set of rules used to validate claims in a user’s token.
646+
These rules determine whether a token subject is considered valid based on its claims.
647+
Each rule is evaluated independently.
648+
See the TokenUserValidationRule type for more information on rule structure.
630649
items:
631650
description: |-
632651
TokenUserValidationRule provides a CEL-based rule used to validate a token subject.

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-Default.crd.yaml‎

Lines changed: 23 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -196,6 +196,10 @@ spec:
196196
197197
Validation rules are joined via an AND operation.
198198
items:
199+
description: |-
200+
TokenClaimValidationRule represents a validation rule based on token claims.
201+
If type is RequiredClaim, requiredClaim must be set.
202+
If type is Expression, expressionRule must be set.
199203
properties:
200204
expressionRule:
201205
description: |-
@@ -227,28 +231,38 @@ spec:
227231
- requiredValue
228232
type: object
229233
type:
234+
allOf:
235+
- enum:
236+
- RequiredClaim
237+
- Expression
238+
- enum:
239+
- RequiredClaim
240+
- Expression
230241
default: RequiredClaim
231242
description: |-
232243
type is an optional field that configures the type of the validation rule.
233244
234-
Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
245+
Allowed values are "RequiredClaim" and "Expression".
235246
236-
When set to 'RequiredClaim', the Kubernetes API server
237-
will be configured to validate that the incoming JWT
238-
contains the required claim and that its value matches
239-
the required value.
247+
When set to 'RequiredClaim', the Kubernetes API server will be configured
248+
to validate that the incoming JWT contains the required claim and that its
249+
value matches the required value.
240250
241-
Defaults to 'RequiredClaim'.
242-
enum:
243-
- RequiredClaim
244-
- Expression
251+
When set to 'Expression', the Kubernetes API server will be configured
252+
to validate the incoming JWT against the configured CEL expression.
253+
254+
Defaults to "RequiredClaim".
245255
type: string
246256
type: object
247257
x-kubernetes-validations:
248258
- message: requiredClaim must be set when type is 'RequiredClaim',
249259
and forbidden otherwise
250260
rule: 'has(self.type) && self.type == ''RequiredClaim''
251261
? has(self.requiredClaim) : !has(self.requiredClaim)'
262+
- message: requiredClaim must be set when type is 'RequiredClaim',
263+
and forbidden otherwise
264+
rule: 'has(self.type) && self.type == ''RequiredClaim''
265+
? has(self.requiredClaim) : !has(self.requiredClaim)'
252266
type: array
253267
x-kubernetes-list-type: atomic
254268
issuer:

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -347,6 +347,10 @@ spec:
347347
348348
Validation rules are joined via an AND operation.
349349
items:
350+
description: |-
351+
TokenClaimValidationRule represents a validation rule based on token claims.
352+
If type is RequiredClaim, requiredClaim must be set.
353+
If type is Expression, expressionRule must be set.
350354
properties:
351355
expressionRule:
352356
description: |-
@@ -397,28 +401,38 @@ spec:
397401
- requiredValue
398402
type: object
399403
type:
404+
allOf:
405+
- enum:
406+
- RequiredClaim
407+
- Expression
408+
- enum:
409+
- RequiredClaim
410+
- Expression
400411
default: RequiredClaim
401412
description: |-
402413
type is an optional field that configures the type of the validation rule.
403414
404-
Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
415+
Allowed values are "RequiredClaim" and "Expression".
405416
406-
When set to 'RequiredClaim', the Kubernetes API server
407-
will be configured to validate that the incoming JWT
408-
contains the required claim and that its value matches
409-
the required value.
417+
When set to 'RequiredClaim', the Kubernetes API server will be configured
418+
to validate that the incoming JWT contains the required claim and that its
419+
value matches the required value.
410420
411-
Defaults to 'RequiredClaim'.
412-
enum:
413-
- RequiredClaim
414-
- Expression
421+
When set to 'Expression', the Kubernetes API server will be configured
422+
to validate the incoming JWT against the configured CEL expression.
423+
424+
Defaults to "RequiredClaim".
415425
type: string
416426
type: object
417427
x-kubernetes-validations:
418428
- message: requiredClaim must be set when type is 'RequiredClaim',
419429
and forbidden otherwise
420430
rule: 'has(self.type) && self.type == ''RequiredClaim''
421431
? has(self.requiredClaim) : !has(self.requiredClaim)'
432+
- message: requiredClaim must be set when type is 'RequiredClaim',
433+
and forbidden otherwise
434+
rule: 'has(self.type) && self.type == ''RequiredClaim''
435+
? has(self.requiredClaim) : !has(self.requiredClaim)'
422436
type: array
423437
x-kubernetes-list-type: atomic
424438
issuer:
@@ -627,6 +641,11 @@ spec:
627641
- componentName
628642
x-kubernetes-list-type: map
629643
userValidationRules:
644+
description: |-
645+
userValidationRules defines the set of rules used to validate claims in a user’s token.
646+
These rules determine whether a token subject is considered valid based on its claims.
647+
Each rule is evaluated independently.
648+
See the TokenUserValidationRule type for more information on rule structure.
630649
items:
631650
description: |-
632651
TokenUserValidationRule provides a CEL-based rule used to validate a token subject.

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-Hypershift-TechPreviewNoUpgrade.crd.yaml‎

Lines changed: 28 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -347,6 +347,10 @@ spec:
347347
348348
Validation rules are joined via an AND operation.
349349
items:
350+
description: |-
351+
TokenClaimValidationRule represents a validation rule based on token claims.
352+
If type is RequiredClaim, requiredClaim must be set.
353+
If type is Expression, expressionRule must be set.
350354
properties:
351355
expressionRule:
352356
description: |-
@@ -397,28 +401,38 @@ spec:
397401
- requiredValue
398402
type: object
399403
type:
404+
allOf:
405+
- enum:
406+
- RequiredClaim
407+
- Expression
408+
- enum:
409+
- RequiredClaim
410+
- Expression
400411
default: RequiredClaim
401412
description: |-
402413
type is an optional field that configures the type of the validation rule.
403414
404-
Allowed values are 'RequiredClaim' and omitted (not provided or an empty string).
415+
Allowed values are "RequiredClaim" and "Expression".
405416
406-
When set to 'RequiredClaim', the Kubernetes API server
407-
will be configured to validate that the incoming JWT
408-
contains the required claim and that its value matches
409-
the required value.
417+
When set to 'RequiredClaim', the Kubernetes API server will be configured
418+
to validate that the incoming JWT contains the required claim and that its
419+
value matches the required value.
410420
411-
Defaults to 'RequiredClaim'.
412-
enum:
413-
- RequiredClaim
414-
- Expression
421+
When set to 'Expression', the Kubernetes API server will be configured
422+
to validate the incoming JWT against the configured CEL expression.
423+
424+
Defaults to "RequiredClaim".
415425
type: string
416426
type: object
417427
x-kubernetes-validations:
418428
- message: requiredClaim must be set when type is 'RequiredClaim',
419429
and forbidden otherwise
420430
rule: 'has(self.type) && self.type == ''RequiredClaim''
421431
? has(self.requiredClaim) : !has(self.requiredClaim)'
432+
- message: requiredClaim must be set when type is 'RequiredClaim',
433+
and forbidden otherwise
434+
rule: 'has(self.type) && self.type == ''RequiredClaim''
435+
? has(self.requiredClaim) : !has(self.requiredClaim)'
422436
type: array
423437
x-kubernetes-list-type: atomic
424438
issuer:
@@ -627,6 +641,11 @@ spec:
627641
- componentName
628642
x-kubernetes-list-type: map
629643
userValidationRules:
644+
description: |-
645+
userValidationRules defines the set of rules used to validate claims in a user’s token.
646+
These rules determine whether a token subject is considered valid based on its claims.
647+
Each rule is evaluated independently.
648+
See the TokenUserValidationRule type for more information on rule structure.
630649
items:
631650
description: |-
632651
TokenUserValidationRule provides a CEL-based rule used to validate a token subject.

0 commit comments

Comments
 (0)