OCPBUGS-76867: remove anonymous-auth from apiserver

[pacevedom]

Summary by CodeRabbit

Release Notes

• Bug Fixes

  • Improved API server authentication configuration by properly utilizing kubeconfig for credential and certificate authority handling.

• Security

  • Anonymous authentication is now explicitly disabled at the API server level for enhanced security.

[openshift-ci-robot]

@pacevedom: This pull request references Jira Issue OCPBUGS-76867, which is invalid:

• expected the bug to target the "4.22.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pacevedom

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [pacevedom]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

Modified the KubeAPIServer controller to use kubeconfig-based authentication configuration. Added a kubeconfigPath field, initialized it from config, passed it to REST client construction, removed manual CA file assignment, and explicitly disabled anonymous authentication via API server arguments.

Changes

Cohort / File(s)	Summary
Kubeconfig and Authentication Configuration pkg/controllers/kube-apiserver.go	Added kubeconfigPath struct field initialized in configure method; updated Run method to use kubeconfig path in clientcmd.BuildConfigFromFlags() instead of empty string; removed manual CA file assignment; added "anonymous-auth": {"false"} to API server arguments to disable anonymous authentication.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title references removing anonymous-auth, but the changes actually add anonymous-auth set to false, representing a configuration change rather than a removal.	Update the title to reflect the actual change, such as 'OCPBUGS-76867: disable anonymous-auth in apiserver' or 'OCPBUGS-76867: configure anonymous-auth to false'.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Merge Conflict Detection	✅ Passed	✅ No merge conflicts detected when merging into main

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing touches

• 📝 Generate docstrings

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment

---

No actionable comments were generated in the recent review. 🎉

🧹 Recent nitpick comments

pkg/controllers/kube-apiserver.go (1)

82-86: Remove unused servingCAPath field.

The field is declared (line 83) and assigned (line 117) but never referenced anywhere in the codebase. It was likely used before restConfig.CAFile = s.servingCAPath was removed.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[pacevedom]

/jira refresh

[openshift-ci-robot]

@pacevedom: This pull request references Jira Issue OCPBUGS-76867, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jogeo

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@pacevedom: This pull request references Jira Issue OCPBUGS-76867, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @jogeo

Details

In response to this:

Summary by CodeRabbit

Release Notes

• Bug Fixes

• Improved API server authentication configuration by properly utilizing kubeconfig for credential and certificate authority handling.

• Security

• Anonymous authentication is now explicitly disabled at the API server level for enhanced security.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@pacevedom: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/ocp-full-conformance-serial-rhel-eus	9a7c0a3	link	true	/test ocp-full-conformance-serial-rhel-eus
ci/prow/e2e-aws-tests-bootc-arm	9a7c0a3	link	true	/test e2e-aws-tests-bootc-arm
ci/prow/ocp-full-conformance-rhel-eus	9a7c0a3	link	true	/test ocp-full-conformance-rhel-eus

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[pacevedom]

/test e2e-aws-tests-bootc-arm