CNTRLPLANE-3010: Add API-side validation to enforce prefixPolicy is not set when username expression is used

config/v1/tests/authentications.config.openshift.io/ExternalOIDCWithUpstreamParity.yaml

@@ -617,6 +617,54 @@ tests:
                 claim: "preferred_username"
               groups:
                 claim: ""
+    - name: Cannot set prefixPolicy to Prefix when using username expression
+      initial: |
+        apiVersion: config.openshift.io/v1
+        kind: Authentication
+        spec:
+          type: OIDC
+          oidcProviders:
+          - name: myoidc
+            issuer:
+              issuerURL: https://meh.tld
+              audiences: ['openshift-aud']
+            claimMappings:
+              username:
+                expression: "claims.sub"
+                prefixPolicy: Prefix
+                prefix:
+                  prefixString: "myoidc:"
+      expectedError: "prefixPolicy must not be set to 'Prefix' when expression is set"
+
+    - name: Can set prefixPolicy to NoPrefix when using username expression
+      initial: |
+        apiVersion: config.openshift.io/v1
+        kind: Authentication
+        spec:
+          type: OIDC
+          oidcProviders:
+          - name: myoidc
+            issuer:
+              issuerURL: https://meh.tld
+              audiences: ['openshift-aud']
+            claimMappings:
+              username:
+                expression: "claims.sub"
+                prefixPolicy: NoPrefix
+      expected: |
+        apiVersion: config.openshift.io/v1
+        kind: Authentication
+        spec:
+          type: OIDC
+          oidcProviders:
+          - name: myoidc
+            issuer:
+              issuerURL: https://meh.tld
+              audiences: ['openshift-aud']
+            claimMappings:
+              username:
+                expression: "claims.sub"
+                prefixPolicy: NoPrefix
   onUpdate:
     - name: Should allow updating other fields if existing username claim mapping is longer than 256 characters
       initialCRDPatches:

config/v1/types_authentication.go

@@ -618,6 +618,7 @@ type OIDCClientReference struct {
 // +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDC,rule="has(self.claim)",message="claim is required"
 // +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUIDAndExtraClaimMappings,rule="has(self.claim)",message="claim is required"
 // +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.claim) ? !has(self.expression) : has(self.expression)",message="precisely one of claim or expression must be set"
+// +openshift:validation:FeatureGateAwareXValidation:featureGate=ExternalOIDCWithUpstreamParity,rule="has(self.expression) && size(self.expression) > 0 ? !has(self.prefixPolicy) || self.prefixPolicy != 'Prefix' : true",message="prefixPolicy must not be set to 'Prefix' when expression is set"
 type UsernameClaimMapping struct {
 	// claim is an optional field that configures the JWT token claim whose value is assigned to the cluster identity field associated with this mapping.
 	// claim is required when the ExternalOIDCWithUpstreamParity feature gate is not enabled.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-CustomNoUpgrade.crd.yaml

@@ -341,6 +341,11 @@ spec:
                           - message: precisely one of claim or expression must be
                               set
                             rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+                          - message: prefixPolicy must not be set to 'Prefix' when
+                              expression is set
+                            rule: 'has(self.expression) && size(self.expression) >
+                              0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+                              ''Prefix'' : true'
                           - message: prefix must be set if prefixPolicy is 'Prefix',
                               but must remain unset otherwise
                             rule: 'has(self.prefixPolicy) && self.prefixPolicy ==

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-DevPreviewNoUpgrade.crd.yaml

@@ -341,6 +341,11 @@ spec:
                           - message: precisely one of claim or expression must be
                               set
                             rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+                          - message: prefixPolicy must not be set to 'Prefix' when
+                              expression is set
+                            rule: 'has(self.expression) && size(self.expression) >
+                              0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+                              ''Prefix'' : true'
                           - message: prefix must be set if prefixPolicy is 'Prefix',
                               but must remain unset otherwise
                             rule: 'has(self.prefixPolicy) && self.prefixPolicy ==

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_authentications-TechPreviewNoUpgrade.crd.yaml

@@ -341,6 +341,11 @@ spec:
                           - message: precisely one of claim or expression must be
                               set
                             rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+                          - message: prefixPolicy must not be set to 'Prefix' when
+                              expression is set
+                            rule: 'has(self.expression) && size(self.expression) >
+                              0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+                              ''Prefix'' : true'
                           - message: prefix must be set if prefixPolicy is 'Prefix',
                               but must remain unset otherwise
                             rule: 'has(self.prefixPolicy) && self.prefixPolicy ==

config/v1/zz_generated.featuregated-crd-manifests/authentications.config.openshift.io/ExternalOIDCWithUpstreamParity.yaml

@@ -204,6 +204,11 @@ spec:
                           - message: precisely one of claim or expression must be
                               set
                             rule: 'has(self.claim) ? !has(self.expression) : has(self.expression)'
+                          - message: prefixPolicy must not be set to 'Prefix' when
+                              expression is set
+                            rule: 'has(self.expression) && size(self.expression) >
+                              0 ? !has(self.prefixPolicy) || self.prefixPolicy !=
+                              ''Prefix'' : true'
                           - message: prefix must be set if prefixPolicy is 'Prefix',
                               but must remain unset otherwise
                             rule: 'has(self.prefixPolicy) && self.prefixPolicy ==