CNTRLPLANE-78: Move Group informer configuration to RestrictSubjectBindings plugin initialization

[everettraven]

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR moves the configuration of the Group informer to the authorization.openshift.io/RestrictSubjectBindings admission plugin initialization process. This is necessary to prevent the startup of an informer for the Group API when the plugin is disabled, which will happen when the OpenShift OAuth stack is intentionally removed from the cluster based on the Authentication configuration.

See openshift/enhancements#1726 for additional information.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: everettraven
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 65cb731|fmt: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 65cb731|fmt: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message
• f66cb4c|remove authncache test: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 476016e|fmt: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 65cb731|fmt: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message
• f66cb4c|remove authncache test: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 476016e|fmt: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 5bcbdbb|handle case where plugin is configured to think the oauth apiserver is not present but is still enabled: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 65cb731|fmt: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message
• f66cb4c|remove authncache test: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 476016e|fmt: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 5bcbdbb|handle case where plugin is configured to think the oauth apiserver is not present but is still enabled: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 65cb731|fmt: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 90d07d9|fixup: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message
• f66cb4c|remove authncache test: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 19b0da7|go fmt: does not specify an upstream backport in the commit message
• 276310a|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 2ed95e1|skip oauth-apiserver conection check if authentication mode is OIDC: does not specify an upstream backport in the commit message
• 3114152|formatting: does not specify an upstream backport in the commit message
• 476016e|fmt: does not specify an upstream backport in the commit message
• 4b215ac|new approach: does not specify an upstream backport in the commit message
• 5bcbdbb|handle case where plugin is configured to think the oauth apiserver is not present but is still enabled: does not specify an upstream backport in the commit message
• 61014ac|better early termination of reachability check: does not specify an upstream backport in the commit message
• 65cb731|fmt: does not specify an upstream backport in the commit message
• 705dcdb|remove OIDC checks from restrictusers admission plugin since it will be disabled: does not specify an upstream backport in the commit message
• 7a3a6aa|WIP: poc: OIDC patch for restrictusers: does not specify an upstream backport in the commit message
• 80e26cb|register internal version: does not specify an upstream backport in the commit message
• 90d07d9|fixup: does not specify an upstream backport in the commit message
• 9a06f9d|go fmt: does not specify an upstream backport in the commit message
• f66cb4c|remove authncache test: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• e933af2|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• edf1675|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 8800674|just disable the plugin on configuration: does not specify an upstream backport in the commit message
• edf1675|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 2750c09|more cleanup: does not specify an upstream backport in the commit message
• 8800674|just disable the plugin on configuration: does not specify an upstream backport in the commit message
• edf1675|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 2750c09|more cleanup: does not specify an upstream backport in the commit message
• 8800674|just disable the plugin on configuration: does not specify an upstream backport in the commit message
• 9ff52f3|separate plugin configuration function and add tests: does not specify an upstream backport in the commit message
• edf1675|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 2750c09|more cleanup: does not specify an upstream backport in the commit message
• 5e5552d|minor updates: does not specify an upstream backport in the commit message
• 8800674|just disable the plugin on configuration: does not specify an upstream backport in the commit message
• 9ff52f3|separate plugin configuration function and add tests: does not specify an upstream backport in the commit message
• edf1675|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• e25f667|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• b7800b2|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: This pull request references CNTRLPLANE-78 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

What type of PR is this?

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@everettraven: This pull request references CNTRLPLANE-78 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR introduces a new configuration option to the authorization.openshift.io/RestrictSubjectBindings admission plugin to allow users and/or other OpenShift components to specify whether or not the OpenShift OAuth stack is desired on the cluster. When not desired, the admission plugin will be disabled as it relies on the OpenShift OAuth stack being present. When desired, the admission plugin will continue to initialize and operate as expected.

We need this change because taking down the OAuth stack without properly configuring this admission plugin can result in blocking permission management of namespaces using RoleBindings.

As the enablement of an external OIDC provider will result in bringing down the OAuth stack, this is important to support the introduction of this feature.

See openshift/enhancements#1726 for additional information.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• b7800b2|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message
• f37feca|update: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• b2baf27|update: does not specify an upstream backport in the commit message
• b7800b2|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message
• f37feca|update: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 2eb96f0|update: does not specify an upstream backport in the commit message
• b2baf27|update: does not specify an upstream backport in the commit message
• b7800b2|UPSTREAM: : Add configuration to RestrictSubjectBindings admission plugin: does not specify an upstream backport in the commit message
• f37feca|update: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: the contents of this pull request could not be automatically validated.

The following commits could not be validated and must be approved by a top-level approver:

• 03e0545|UPSTREAM: : Move Group informer configuration into RestrictSubjectBindings: does not specify an upstream backport in the commit message

Comment /validate-backports to re-evaluate validity of the upstream PRs, for example when they are merged upstream.

[openshift-ci-robot]

@everettraven: This pull request references CNTRLPLANE-78 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.19.0" version, but no target version was set.

In response to this:

What type of PR is this?

/kind bug

What this PR does / why we need it:

This PR moves the configuration of the Group informer to the authorization.openshift.io/RestrictSubjectBindings admission plugin initialization process. This is necessary to prevent the startup of an informer for the Group API when the plugin is disabled, which will happen when the OpenShift OAuth stack is intentionally removed from the cluster based on the Authentication configuration.

See openshift/enhancements#1726 for additional information.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[everettraven]

/retest

[everettraven]

/retest-required

[openshift-ci]

@everettraven: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-runc	03e0545	link	true	/test e2e-aws-ovn-runc
ci/prow/okd-scos-e2e-aws-ovn	03e0545	link	false	/test okd-scos-e2e-aws-ovn
ci/prow/e2e-aws-ovn-cgroupsv2	03e0545	link	true	/test e2e-aws-ovn-cgroupsv2
ci/prow/e2e-aws-ovn-serial	03e0545	link	true	/test e2e-aws-ovn-serial

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.