[WIP] CNTRLPLANE-3851: Oauth proxy config e2e

go.mod

@@ -1,6 +1,6 @@
 module github.com/openshift/origin
 
-go 1.25.0
+go 1.26.0
 
 require (
 	cloud.google.com/go/storage v1.56.0
@@ -65,7 +65,7 @@ require (
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818
 	github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f
-	github.com/openshift/api v0.0.0-20260629123346-784126000268
+	github.com/openshift/api v0.0.0-20260715165912-72066cc9718b
 	github.com/openshift/apiserver-library-go v0.0.0-20260303173613-cd3676268d31
 	github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
 	github.com/openshift/client-go v0.0.0-20260629081241-b769428f4111
@@ -106,9 +106,9 @@ require (
 	gopkg.in/src-d/go-git.v4 v4.13.1
 	gopkg.in/yaml.v2 v2.4.0
 	gopkg.in/yaml.v3 v3.0.1
-	k8s.io/api v0.35.1
+	k8s.io/api v0.36.2
 	k8s.io/apiextensions-apiserver v0.35.1
-	k8s.io/apimachinery v0.35.1
+	k8s.io/apimachinery v0.36.2
 	k8s.io/apiserver v0.35.1
 	k8s.io/cli-runtime v0.33.4
 	k8s.io/client-go v0.35.1
@@ -407,7 +407,7 @@ require (
 	google.golang.org/genproto v0.0.0-20250603155806-513f23925822 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250818200422-3122310a409c // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250826171959-ef028d996bc1 // indirect
-	google.golang.org/protobuf v1.36.8 // indirect
+	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/go-jose/go-jose.v2 v2.6.3 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect

go.sum

@@ -903,8 +903,8 @@ github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b8
 github.com/openshift-eng/openshift-tests-extension v0.0.0-20260127124016-0fed2b824818/go.mod h1:6gkP5f2HL0meusT0Aim8icAspcD1cG055xxBZ9yC68M=
 github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f h1:E72Zoc+JImPehBrXkgaCbIDbSFuItvyX6RCaZ0FQE5k=
 github.com/openshift-kni/commatrix v0.0.5-0.20251111204857-e5a931eff73f/go.mod h1:cDVdp0eda7EHE6tLuSeo4IqPWdAX/KJK+ogBirIGtsI=
-github.com/openshift/api v0.0.0-20260629123346-784126000268 h1:s2Z/n/ihnmPddz89PnLMkcOgjoe28VlkuDOMUu7y3uI=
-github.com/openshift/api v0.0.0-20260629123346-784126000268/go.mod h1:Jm45pE7O6/G0tYYhiLzNyZykTjmf9BfhsKYuGfLLwTE=
+github.com/openshift/api v0.0.0-20260715165912-72066cc9718b h1:gN3SihCYEwoIksD+f24wHhwiEgvaV0RxNjgmkDvBBeg=
+github.com/openshift/api v0.0.0-20260715165912-72066cc9718b/go.mod h1:k6qH5QOVa5GDln2VVm8Jz4NV3Z7R2SATHFLwGS6Wh3M=
 github.com/openshift/apiserver-library-go v0.0.0-20260303173613-cd3676268d31 h1:oYPQMrkzyk002L5aN8I2tkUHTEu9lsVrc1qiJmHJdXU=
 github.com/openshift/apiserver-library-go v0.0.0-20260303173613-cd3676268d31/go.mod h1:mnTsMMTtXSPBQzqBp5HXBjLvliveKenRADFQy9m5jc0=
 github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee h1:+Sp5GGnjHDhT/a/nQ1xdp43UscBMr7G5wxsYotyhzJ4=
@@ -1623,8 +1623,8 @@ google.golang.org/protobuf v1.24.0/go.mod h1:r/3tXBNzIEhYS9I1OUVjXDlt8tc493IdKGj
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.8 h1:xHScyCOEuuwZEc6UtSOvPbAT4zRh0xcNRYekJwfqyMc=
-google.golang.org/protobuf v1.36.8/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
+google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

test/extended/authentication/keycloak_client.go

@@ -12,7 +12,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-type keycloakClient struct {
+type KeycloakClient struct {
 	realm    string
 	client   *http.Client
 	adminURL *url.URL
@@ -21,7 +21,7 @@ type keycloakClient struct {
 	idToken     string
 }
 
-func keycloakClientFor(keycloakURL string) (*keycloakClient, error) {
+func KeycloakClientFor(keycloakURL string) (*KeycloakClient, error) {
 	baseURL, err := url.Parse(keycloakURL)
 	if err != nil {
 		return nil, fmt.Errorf("parsing url: %w", err)
@@ -34,7 +34,7 @@ func keycloakClientFor(keycloakURL string) (*keycloakClient, error) {
 		Proxy: http.ProxyFromEnvironment,
 	}
 
-	return &keycloakClient{
+	return &KeycloakClient{
 		realm: "master",
 		client: &http.Client{
 			Transport: transport,
@@ -47,7 +47,7 @@ type group struct {
 	Name string `json:"name"`
 }
 
-func (kc *keycloakClient) CreateGroup(name string) error {
+func (kc *KeycloakClient) CreateGroup(name string) error {
 	groupURL := kc.adminURL.JoinPath("groups")
 
 	group := group{
@@ -95,11 +95,11 @@ const (
 	credentialTypePassword credentialType = "password"
 )
 
-func (kc *keycloakClient) CreateUser(username, password string, groups ...string) error {
+func (kc *KeycloakClient) CreateUser(username, password string, groups ...string) error {
 	return kc.CreateUserWithEmail(username, fmt.Sprintf("%s@payload.openshift.io", username), password, groups...)
 }
 
-func (kc *keycloakClient) CreateUserWithEmail(username, email, password string, groups ...string) error {
+func (kc *KeycloakClient) CreateUserWithEmail(username, email, password string, groups ...string) error {
 	userURL := kc.adminURL.JoinPath("users")
 
 	user := user{
@@ -143,7 +143,7 @@ type authenticationResponse struct {
 	ErrorDescription string `json:"error_description,omitempty"`
 }
 
-func (kc *keycloakClient) Authenticate(clientID, username, password string) error {
+func (kc *KeycloakClient) Authenticate(clientID, username, password string) error {
 	data := url.Values{}
 	data.Set("username", username)
 	data.Set("password", password)
@@ -177,7 +177,7 @@ func (kc *keycloakClient) Authenticate(clientID, username, password string) erro
 	return nil
 }
 
-func (kc *keycloakClient) DoRequest(method, url, contentType string, authenticated bool, body io.Reader) (*http.Response, error) {
+func (kc *KeycloakClient) DoRequest(method, url, contentType string, authenticated bool, body io.Reader) (*http.Response, error) {
 	if len(kc.accessToken) == 0 && authenticated {
 		panic("must authenticate before calling keycloakClient.DoRequest")
 	}
@@ -194,15 +194,15 @@ func (kc *keycloakClient) DoRequest(method, url, contentType string, authenticat
 	return kc.client.Do(req)
 }
 
-func (kc *keycloakClient) AccessToken() string {
+func (kc *KeycloakClient) AccessToken() string {
 	return kc.accessToken
 }
 
-func (kc *keycloakClient) IdToken() string {
+func (kc *KeycloakClient) IdToken() string {
 	return kc.idToken
 }
 
-func (kc *keycloakClient) ConfigureClient(clientId string) error {
+func (kc *KeycloakClient) ConfigureClient(clientId string) error {
 	client, err := kc.GetClientByClientID(clientId)
 	if err != nil {
 		return fmt.Errorf("getting client %q: %w", clientId, err)
@@ -254,7 +254,7 @@ const (
 	booleanStringFalse booleanString = "false"
 )
 
-func (kc *keycloakClient) CreateClientGroupMapper(clientId, name, claim string) error {
+func (kc *KeycloakClient) CreateClientGroupMapper(clientId, name, claim string) error {
 	mappersURL := *kc.adminURL
 	mappersURL.Path += fmt.Sprintf("/clients/%s/protocol-mappers/models", clientId)
 
@@ -307,7 +307,7 @@ type audienceMapperConfig struct {
 	LightweightClaim        booleanString `json:"lightweight.claim"`
 }
 
-func (kc *keycloakClient) CreateClientAudienceMapper(clientId, name string) error {
+func (kc *KeycloakClient) CreateClientAudienceMapper(clientId, name string) error {
 	mappersURL := *kc.adminURL
 	mappersURL.Path += fmt.Sprintf("/clients/%s/protocol-mappers/models", clientId)
 
@@ -350,7 +350,7 @@ type client struct {
 }
 
 // ListClients retrieves all clients
-func (kc *keycloakClient) ListClients() ([]client, error) {
+func (kc *KeycloakClient) ListClients() ([]client, error) {
 	clientsURL := *kc.adminURL
 	clientsURL.Path += "/clients"
 
@@ -373,7 +373,7 @@ func (kc *keycloakClient) ListClients() ([]client, error) {
 	return clients, err
 }
 
-func (kc *keycloakClient) GetClientByClientID(clientID string) (*client, error) {
+func (kc *KeycloakClient) GetClientByClientID(clientID string) (*client, error) {
 	clients, err := kc.ListClients()
 	if err != nil {
 		return nil, err

test/extended/authentication/keycloak_helpers.go

@@ -24,24 +24,24 @@ import (
 )
 
 const (
-	keycloakResourceName          = "keycloak"
+	KeycloakResourceName          = "keycloak"
 	keycloakServingCertSecretName = "keycloak-serving-cert"
 	keycloakLabelKey              = "app"
 	keycloakLabelValue            = "keycloak"
 	keycloakHTTPSPort             = 8443
 
 	// TODO: should this be an openshift image?
 	keycloakImage          = "quay.io/keycloak/keycloak:25.0"
-	keycloakAdminUsername  = "admin"
-	keycloakAdminPassword  = "password"
+	KeycloakAdminUsername  = "admin"
+	KeycloakAdminPassword  = "password"
 	keycloakCertVolumeName = "certkeypair"
 	keycloakCertMountPath  = "/etc/x509/https"
 	keycloakCertFile       = "tls.crt"
 	keycloakKeyFile        = "tls.key"
 )
 
-func deployKeycloak(ctx context.Context, client *exutil.CLI, namespace string, logger logr.Logger) ([]removalFunc, error) {
-	cleanups := []removalFunc{}
+func DeployKeycloak(ctx context.Context, client *exutil.CLI, namespace string, logger logr.Logger) ([]RemovalFunc, error) {
+	cleanups := []RemovalFunc{}
 
 	corev1Client := client.AdminKubeClient().CoreV1()
 
@@ -84,7 +84,7 @@ func deployKeycloak(ctx context.Context, client *exutil.CLI, namespace string, l
 	return cleanups, waitForKeycloakAvailable(ctx, client, namespace, logger)
 }
 
-func createKeycloakNamespace(ctx context.Context, client typedcorev1.NamespaceInterface, namespace string) (removalFunc, error) {
+func createKeycloakNamespace(ctx context.Context, client typedcorev1.NamespaceInterface, namespace string) (RemovalFunc, error) {
 	ns := &corev1.Namespace{
 		ObjectMeta: metav1.ObjectMeta{
 			Name: namespace,
@@ -101,10 +101,10 @@ func createKeycloakNamespace(ctx context.Context, client typedcorev1.NamespaceIn
 	}, nil
 }
 
-func createKeycloakServiceAccount(ctx context.Context, client typedcorev1.ServiceAccountInterface) (removalFunc, error) {
+func createKeycloakServiceAccount(ctx context.Context, client typedcorev1.ServiceAccountInterface) (RemovalFunc, error) {
 	sa := &corev1.ServiceAccount{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: keycloakResourceName,
+			Name: KeycloakResourceName,
 		},
 	}
 	sa.SetGroupVersionKind(corev1.SchemeGroupVersion.WithKind("ServiceAccount"))
@@ -119,10 +119,10 @@ func createKeycloakServiceAccount(ctx context.Context, client typedcorev1.Servic
 	}, nil
 }
 
-func createKeycloakService(ctx context.Context, client typedcorev1.ServiceInterface) (*corev1.Service, removalFunc, error) {
+func createKeycloakService(ctx context.Context, client typedcorev1.ServiceInterface) (*corev1.Service, RemovalFunc, error) {
 	service := &corev1.Service{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: keycloakResourceName,
+			Name: KeycloakResourceName,
 			Annotations: map[string]string{
 				"service.beta.openshift.io/serving-cert-secret-name": keycloakServingCertSecretName,
 			},
@@ -149,7 +149,7 @@ func createKeycloakService(ctx context.Context, client typedcorev1.ServiceInterf
 	}, nil
 }
 
-func createKeycloakCAConfigMap(ctx context.Context, client typedcorev1.ConfigMapsGetter) (removalFunc, error) {
+func createKeycloakCAConfigMap(ctx context.Context, client typedcorev1.ConfigMapsGetter) (RemovalFunc, error) {
 	defaultIngressCACM, err := client.ConfigMaps("openshift-config-managed").Get(ctx, "default-ingress-cert", metav1.GetOptions{})
 	if err != nil {
 		return nil, fmt.Errorf("getting configmap openshift-config-managed/default-ingress-cert: %w", err)
@@ -159,7 +159,7 @@ func createKeycloakCAConfigMap(ctx context.Context, client typedcorev1.ConfigMap
 
 	keycloakCACM := &corev1.ConfigMap{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: fmt.Sprintf("%s-ca", keycloakResourceName),
+			Name: fmt.Sprintf("%s-ca", KeycloakResourceName),
 		},
 		Data: map[string]string{
 			"ca-bundle.crt": data,
@@ -177,10 +177,10 @@ func createKeycloakCAConfigMap(ctx context.Context, client typedcorev1.ConfigMap
 	}, nil
 }
 
-func createKeycloakDeployment(ctx context.Context, client typedappsv1.DeploymentInterface) (removalFunc, error) {
+func createKeycloakDeployment(ctx context.Context, client typedappsv1.DeploymentInterface) (RemovalFunc, error) {
 	deployment := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:   keycloakResourceName,
+			Name:   KeycloakResourceName,
 			Labels: keycloakLabels(),
 		},
 		Spec: appsv1.DeploymentSpec{
@@ -190,7 +190,7 @@ func createKeycloakDeployment(ctx context.Context, client typedappsv1.Deployment
 			Replicas: ptr.To(int32(1)),
 			Template: corev1.PodTemplateSpec{
 				ObjectMeta: metav1.ObjectMeta{
-					Name:   keycloakResourceName,
+					Name:   KeycloakResourceName,
 					Labels: keycloakLabels(),
 				},
 				Spec: corev1.PodSpec{
@@ -262,11 +262,11 @@ func keycloakEnvVars() []corev1.EnvVar {
 	return []corev1.EnvVar{
 		{
 			Name:  "KEYCLOAK_ADMIN",
-			Value: keycloakAdminUsername,
+			Value: KeycloakAdminUsername,
 		},
 		{
 			Name:  "KEYCLOAK_ADMIN_PASSWORD",
-			Value: keycloakAdminPassword,
+			Value: KeycloakAdminPassword,
 		},
 		{
 			Name:  "KC_HEALTH_ENABLED",
@@ -337,10 +337,10 @@ func keycloakContainers() []corev1.Container {
 	}
 }
 
-func createKeycloakRoute(ctx context.Context, service *corev1.Service, client typedroutev1.RouteInterface) (removalFunc, error) {
+func createKeycloakRoute(ctx context.Context, service *corev1.Service, client typedroutev1.RouteInterface) (RemovalFunc, error) {
 	route := &routev1.Route{
 		ObjectMeta: metav1.ObjectMeta{
-			Name: keycloakResourceName,
+			Name: KeycloakResourceName,
 		},
 		Spec: routev1.RouteSpec{
 			TLS: &routev1.TLSConfig{
@@ -381,7 +381,7 @@ func waitForKeycloakAvailable(ctx context.Context, client *exutil.CLI, namespace
 	timeoutCtx, cancel := context.WithDeadline(ctx, time.Now().Add(10*time.Minute))
 	defer cancel()
 	err := wait.PollUntilContextCancel(timeoutCtx, 10*time.Second, true, func(ctx context.Context) (done bool, err error) {
-		deploy, err := client.AdminKubeClient().AppsV1().Deployments(namespace).Get(ctx, keycloakResourceName, metav1.GetOptions{})
+		deploy, err := client.AdminKubeClient().AppsV1().Deployments(namespace).Get(ctx, KeycloakResourceName, metav1.GetOptions{})
 		if err != nil {
 			logger.Error(err, "getting keycloak deployment")
 			return false, nil