OCPBUGS-109578: fix oc darwin client hcp login when insecure tls flag is used

[ehearne-redhat]

This fix fixes an issue seen when oc client is used to login to a HCP cluster on macOS. It falls back to kubeconfig CA when a string based x509 error is observed on the macOS platform.

See https://github.com/golang/go/blob/master/src/crypto/x509/root_darwin.go#L74 for reference.

Summary by CodeRabbit

• Bug Fixes
  • Improved macOS authentication reliability by falling back to the configured certificate authority when system certificate validation encounters an unexpected error.

[openshift-ci-robot]

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-109578, which is invalid:

• expected the bug to target the "5.1.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

This fix fixes an issue seen when oc client is used to login to a HCP cluster on macOS. It falls back to kubeconfig CA when a string based x509 error is observed on the macOS platform.

See https://github.com/golang/go/blob/master/src/crypto/x509/root_darwin.go#L74 for reference.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 98576c81-4d8b-4fa3-83d4-f73045ef9b62

📥 Commits

Reviewing files that changed from the base of the PR and between 93ac920 and 9cc4cf4.

📒 Files selected for processing (1)

• pkg/oauth/tokenrequest/request_token.go

Included review availability: Your plan provides up to 12 included reviews per hour; 11 remain after this review.

---

Walkthrough

The OAuth token request transport now detects Darwin systems and falls back to the kubeconfig CA transport for generic errors beginning with x509:. Existing certificate and I/O fallback paths remain unchanged.

Changes

OAuth transport fallback

Layer / File(s)	Summary
Darwin x509 fallback pkg/oauth/tokenrequest/request_token.go	The transport uses runtime for operating-system detection. On Darwin, generic x509: errors now use the kubeconfig CA transport. Other unknown errors still fail.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 9cc4c

This is a localized macOS login behavior fix, and no actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The commit changes only pkg/oauth/tokenrequest/request_token.go and adds no test files or Ginkgo test titles. The added lines implement Darwin fallback logic in transportWithSystemRoots; the…
Test Structure And Quality	✅ Passed	PASS. The pull request changes only pkg/oauth/tokenrequest/request_token.go (+8 lines) and adds no Ginkgo test code. The nearby tests use Go's standard testing package, and the change introduces n…
Microshift Test Compatibility	✅ Passed	PASS: The pull request changes only pkg/oauth/tokenrequest/request_token.go and adds no Ginkgo e2e tests. The changed file contains no It, Describe, Context, or When declarations. Therefore,…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS: The pull request changes only pkg/oauth/tokenrequest/request_token.go. The diff adds a Darwin-specific transport fallback and does not add any Ginkgo e2e tests (It, Describe, Context, or…
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request modifies only pkg/oauth/tokenrequest/request_token.go. The diff adds the runtime import and Darwin-specific x509 fallback logic in transportWithSystemRoots. It does not ad…
Ote Binary Stdout Contract	✅ Passed	PASS. The patch changes only pkg/oauth/tokenrequest/request_token.go: it adds the runtime import and a Darwin fallback inside the ordinary transportWithSystemRoots function. It adds no main, `…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS: The pull request changes only pkg/oauth/tokenrequest/request_token.go. It adds Darwin-specific error handling and the runtime import. The diff adds no Ginkgo e2e tests or other test files, s…
No-Weak-Crypto	✅ Passed	PASS. The pull request adds only Darwin-specific handling for generic x509: errors and a runtime import in transportWithSystemRoots. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB …
Container-Privileges	✅ Passed	PASS. The commit diff contains one changed file: pkg/oauth/tokenrequest/request_token.go. The added code only checks runtime.GOOS and falls back to the kubeconfig CA transport for Darwin x509: e…
No-Sensitive-Data-In-Logs	✅ Passed	The change adds one V(4) log for a Darwin certificate-verification fallback. It logs only the verification error (err) from verifyServerCertChain; it does not log tokens, passwords, headers, kubec…
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies the macOS HCP login fix and the insecure TLS flag. It matches the main change in the pull request.

Full details: Stable And Deterministic Test Names

Explanation

PASS. The commit changes only pkg/oauth/tokenrequest/request_token.go and adds no test files or Ginkgo test titles. The added lines implement Darwin fallback logic in transportWithSystemRoots; they do not introduce dynamic test-name data or overly specific test titles.

Full details: Test Structure And Quality

Explanation

PASS. The pull request changes only pkg/oauth/tokenrequest/request_token.go (+8 lines) and adds no Ginkgo test code. The nearby tests use Go's standard testing package, and the change introduces no cluster resource creation, waits, or Eventually/Consistently calls to assess under this check.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request changes only pkg/oauth/tokenrequest/request_token.go and adds no Ginkgo e2e tests. The changed file contains no It, Describe, Context, or When declarations. Therefore, the MicroShift test compatibility check does not apply.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS: The pull request changes only pkg/oauth/tokenrequest/request_token.go. The diff adds a Darwin-specific transport fallback and does not add any Ginkgo e2e tests (It, Describe, Context, or When). Therefore, the SNO multi-node compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request modifies only pkg/oauth/tokenrequest/request_token.go. The diff adds the runtime import and Darwin-specific x509 fallback logic in transportWithSystemRoots. It does not add or modify deployment manifests, operators, controllers, replicas, affinity, topology spread constraints, node selectors, tolerations, or PDBs. The topology-aware scheduling check is therefore not applicable.

Full details: Ote Binary Stdout Contract

Explanation

PASS. The patch changes only pkg/oauth/tokenrequest/request_token.go: it adds the runtime import and a Darwin fallback inside the ordinary transportWithSystemRoots function. It adds no main, init, TestMain, suite setup, or direct stdout write. The added klog.V(4).Infof call is library-function logging, not process-level OTE setup.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS: The pull request changes only pkg/oauth/tokenrequest/request_token.go. It adds Darwin-specific error handling and the runtime import. The diff adds no Ginkgo e2e tests or other test files, so the IPv4 and external-connectivity conditions do not apply.

Full details: No-Weak-Crypto

Explanation

PASS. The pull request adds only Darwin-specific handling for generic x509: errors and a runtime import in transportWithSystemRoots. The diff adds no MD5, SHA1, DES, RC4, 3DES, Blowfish, or ECB usage, custom cryptography, or non-constant-time secret comparison. Existing TLS and x509 verification code is unchanged.

Full details: Container-Privileges

Explanation

PASS. The commit diff contains one changed file: pkg/oauth/tokenrequest/request_token.go. The added code only checks runtime.GOOS and falls back to the kubeconfig CA transport for Darwin x509: errors. It adds no container or Kubernetes manifest privilege settings. Existing privileged and root-running fixtures are outside the changed paths and are not caused or modified by this pull request.

Full details: No-Sensitive-Data-In-Logs

Explanation

The change adds one V(4) log for a Darwin certificate-verification fallback. It logs only the verification error (err) from verifyServerCertChain; it does not log tokens, passwords, headers, kubeconfig CA data, or OAuth URLs. The referenced Go implementation creates this generic error from the macOS Security framework description. No sensitive-data logging condition is introduced.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[ehearne-redhat]

/jira refresh

[openshift-ci-robot]

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-109578, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@ehearne-redhat: This pull request references Jira Issue OCPBUGS-109578, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (5.1.0) matches configured target version for branch (5.1.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Details

In response to this:

This fix fixes an issue seen when oc client is used to login to a HCP cluster on macOS. It falls back to kubeconfig CA when a string based x509 error is observed on the macOS platform.

See https://github.com/golang/go/blob/master/src/crypto/x509/root_darwin.go#L74 for reference.

Summary by CodeRabbit

• Bug Fixes
• Improved macOS authentication reliability by falling back to the configured certificate authority when system certificate validation encounters an unexpected error.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: ehearne-redhat
Once this PR has been reviewed and has the lgtm label, please assign bertinatto for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@ehearne-redhat: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.