konflux-ui: dynamic dex SA token for production (ring-1) by mshaposhnik · Pull Request #13042 · redhat-appstudio/infra-deployments

mshaposhnik · 2026-07-15T08:42:58Z

What

Add `production/base/dex-dynamic/` with new dex image `quay.io/konflux-ci/dex:5b89b24eddaa40d485de6db29d9e8815e82de06f` and `run-dex.sh` entrypoint
Move `dex` resource out of `production/base/kustomization.yaml`; ring 2/3 clusters explicitly reference `../base/dex` (behaviorally unchanged)
Ring 1 clusters reference `../base/dex-dynamic` for the new projected SA token approach
Update dex connector `clientID` to `$OPENSHIFT_OAUTH_CLIENT_ID` in ring 1 dex-configs
Redirect `set-redirect-uri` patch to target the `dex` SA in ring 1 clusters
Remove obsolete `dex-client` SA and static token Secret from ring 1 clusters via `$patch: delete`
Update `hack/new-cluster/templates` to use `$OPENSHIFT_OAUTH_CLIENT_ID` and target `dex` SA

Clusters affected: stone-prod-p01, stone-prod-p02, kflux-prd-rh02, kflux-prd-rh03

Why

Replace static long-lived `dex-client` SA token with an auto-rotating projected SA token (600s TTL). Eliminates manual secret rotation; token refresh and dex restart are handled automatically by `run-dex.sh`.

Validation

`kustomize build --enable-helm` passes for all 4 ring 1 overlays and all 5 ring 2/3 overlays
Ring 1 clusters render `quay.io/konflux-ci/dex:5b89b24e...` and `clientID: $OPENSHIFT_OAUTH_CLIENT_ID`; `dex-client` absent from output
Ring 2/3 clusters unchanged (still `ghcr.io/dexidp/dex:v2.32.0`, `dex-client` present)
Staging validation: konflux-ui: replace static dex-client SA token with dynamic projected SA token (staging-p01 only) #12694 (stone-stage-p01), konflux-ui: promote dynamic dex SA token to both staging clusters #13008 (both staging clusters)

Risk Assessment

Risk Level: Low
What could go wrong: If the projected SA token is not accepted as a valid OpenShift OAuth client secret for the `dex` SA, dex will fail to authenticate with OpenShift and users won't be able to log in. Mitigated by staging validation across two clusters.
Rollback: Revert PR. dex will restart with the old static token within one ArgoCD sync cycle.
Blast radius: 4 production clusters (ring 1). Ring 2/3 clusters unaffected.

Made with Cursor

…1, stone-prod-p02, kflux-prd-rh02, kflux-prd-rh03) Promote the projected SA token approach (validated in staging via redhat-appstudio#12694 and redhat-appstudio#13008) to production ring 1. Introduces production/base/dex-dynamic/ with the new dex image and run-dex.sh; ring 1 clusters reference it while ring 2/3 clusters continue using the existing production/base/dex/ unchanged. Changes: - Add production/base/dex-dynamic/ with quay.io/konflux-ci/dex:5b89b24e image, run-dex.sh entrypoint, projected SA token (600s TTL) - Remove dex from production/base/kustomization.yaml; ring 2/3 clusters explicitly reference ../base/dex (no-op for them) - Ring 1 clusters: reference ../base/dex-dynamic, update dex connector clientID to $OPENSHIFT_OAUTH_CLIENT_ID, redirect set-redirect-uri patch to dex SA, remove obsolete dex-client SA and static token Secret - Update hack/new-cluster/templates to use $OPENSHIFT_OAUTH_CLIENT_ID and target dex SA for oauth-redirecturi Authored-by: Claude Sonnet 4.6 (Cursor) Co-authored-by: Cursor <cursoragent@cursor.com>

openshift-ci · 2026-07-15T08:43:01Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

github-actions · 2026-07-15T08:43:32Z

Kustomize Render Diff

Comparing 85d321b1c → a4cc18064

Component	Environment	Changes
`components/konflux-ui/production/kflux-prd-rh02`	production	+55 -26
`components/konflux-ui/production/kflux-prd-rh03`	production	+56 -27
`components/konflux-ui/production/stone-prod-p01`	production	+55 -26
`components/konflux-ui/production/stone-prod-p02`	production	+55 -26

Total: 4 components, +221 -105 lines

📋 Full diff available in the workflow summary and as a downloadable artifact.

codecov · 2026-07-15T08:46:21Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.11%. Comparing base (85d321b) to head (49d112e).
⚠️ Report is 8 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #13042   +/-   ##
=======================================
  Coverage   57.11%   57.11%           
=======================================
  Files          23       23           
  Lines        1455     1455           
=======================================
  Hits          831      831           
  Misses        548      548           
  Partials       76       76

Flag	Coverage Δ
go	`57.11% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

qodo-for-redhat-appstudio · 2026-07-15T08:57:29Z

Code Review by Qodo

Sorry, something went wrong

We weren't able to complete the code review on our side. Please try again

qodo-for-redhat-appstudio · 2026-07-15T09:04:09Z

PR Summary by Qodo

konflux-ui: use projected SA token for Dex OAuth in production ring-1

✨ Enhancement ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Introduce a new Dex base overlay that uses a projected, auto-rotating ServiceAccount token.
• Switch ring-1 production clusters to the new Dex base and remove the legacy dex-client SA/Secret.
• Keep ring-2/3 behavior unchanged by explicitly referencing the existing Dex base in their
 overlays.

Diagram

graph TD
  Ring1["Ring-1 overlays"] --> DexDyn["dex-dynamic base"] --> DexDeploy["Dex Deployment"] --> Token[("Projected SA token")]
  Token --> OCP{{"OpenShift OAuth"}}
  Ring23["Ring-2/3 overlays"] --> DexBase["dex base"] --> DexDeploy --> Static[("Static token Secret")]
  Static --> OCP

  subgraph Legend
    direction LR
    _ov["Overlay"] ~~~ _base["Kustomize base"] ~~~ _cred[("Credential")]
    _cred ~~~ _ext{{"External"}}
  end

High-Level Assessment

The following are alternative approaches to this PR:

1. Use a reconciled Secret instead of restarting Dex

➕ Avoids deliberate Dex restarts on token rotation (potentially smoother UX).
➕ Keeps configuration closer to the traditional 'secret-backed' model.
➖ Still requires a controller/job to refresh the Secret from TokenRequest/projection.
➖ Adds operational moving parts and failure modes versus a self-contained entrypoint loop.

2. Sidecar token watcher that SIGHUPs/reloads Dex

➕ Separates token-watching logic from the Dex container entrypoint.
➕ Could reload without full process exit if Dex supports safe live reload semantics.
➖ Dex typically consumes clientSecret from env at startup; signal-based reload may not update credentials reliably.
➖ Extra container, coordination, and securityContext considerations.

3. Keep static SA token and rotate via GitOps

➕ Simpler runtime behavior; no token-watching logic needed.
➖ Reintroduces manual/operational rotation burden and long-lived credential risk.
➖ Higher chance of outages during rotation windows.

Recommendation: Proceed with the PR’s approach: projected SA token + run-dex.sh restart loop is the most self-contained way to ensure Dex actually picks up rotated credentials (given startup-time env consumption). The main review focus should be validating that OpenShift accepts the projected SA token as the OAuth client secret for the Dex SA, and that the ring-1 overlays fully remove the legacy dex-client objects to prevent accidental fallback.

Files changed (27) +357 / -11

Enhancement (1) +87 / -0

run-dex.shAdd run-dex entrypoint to restart Dex on token rotation +87/-0

Add run-dex entrypoint to restart Dex on token rotation
• Adds a bash entrypoint that copies the current projected token, starts Dex with OPENSHIFT_OAUTH_CLIENT_SECRET from that token, then waits for kubelet token refresh and gracefully restarts Dex with jitter. Also forwards SIGTERM/SIGINT for graceful shutdown.
components/konflux-ui/production/base/dex-dynamic/run-dex.sh

Other (26) +270 / -11

dex.yamlAdd Dex deployment using projected SA token volume +164/-0

Add Dex deployment using projected SA token volume

• Introduces a new Dex Deployment/Service/SA/RBAC bundle that mounts a projected serviceAccountToken (600s TTL) and runs Dex via a custom /usr/local/bin/run-dex.sh entrypoint. The token is mounted at a dedicated path and intended to be used as the OpenShift OAuth client secret.

components/konflux-ui/production/base/dex-dynamic/dex.yaml

kustomization.yamlCreate dex-dynamic kustomization with pinned konflux Dex image +15/-0

Create dex-dynamic kustomization with pinned konflux Dex image
• Adds a new Kustomize base that deploys dex.yaml, pins quay.io/konflux-ci/dex to a specific commit tag, and generates the run-dex ConfigMap containing run-dex.sh.
components/konflux-ui/production/base/dex-dynamic/kustomization.yaml

kustomization.yamlStop implicitly including Dex from production base +0/-1

Stop implicitly including Dex from production base
• Removes the dex resource from the shared production/base kustomization so clusters must explicitly reference the desired Dex base (static or dynamic).
components/konflux-ui/production/base/kustomization.yaml

kustomization.yamlExplicitly include the existing Dex base for this cluster overlay +1/-0

Explicitly include the existing Dex base for this cluster overlay
• Adds ../base/dex to resources to preserve prior behavior after Dex was removed from the shared production base.
components/konflux-ui/production/kflux-fedora-01/kustomization.yaml

kustomization.yamlExplicitly include the existing Dex base for this cluster overlay +1/-0

Explicitly include the existing Dex base for this cluster overlay
• Adds ../base/dex to resources to preserve prior behavior after Dex was removed from the shared production base.
components/konflux-ui/production/kflux-ocp-p01/kustomization.yaml

kustomization.yamlExplicitly include the existing Dex base for this cluster overlay +1/-0

Explicitly include the existing Dex base for this cluster overlay
• Adds ../base/dex to resources to preserve prior behavior after Dex was removed from the shared production base.
components/konflux-ui/production/kflux-osp-p01/kustomization.yaml

dex-config.yamlSwitch Dex OpenShift connector clientID to env var +1/-1

Switch Dex OpenShift connector clientID to env var
• Updates the OpenShift connector configuration to use $OPENSHIFT_OAUTH_CLIENT_ID instead of hard-coding the dex-client serviceaccount identity.
components/konflux-ui/production/kflux-prd-rh02/dex-config.yaml

kustomization.yamlMove ring-1 cluster to dex-dynamic and delete legacy dex-client objects +10/-1

Move ring-1 cluster to dex-dynamic and delete legacy dex-client objects
• Switches this ring-1 overlay to reference ../base/dex-dynamic, retargets the redirect-uri patch to the dex ServiceAccount, and adds delete patches for the old dex-client ServiceAccount and Secret.
components/konflux-ui/production/kflux-prd-rh02/kustomization.yaml

remove-dex-client-secret.yamlDelete legacy dex-client Secret via kustomize patch +5/-0

Delete legacy dex-client Secret via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client Secret is removed from this ring-1 cluster.
components/konflux-ui/production/kflux-prd-rh02/remove-dex-client-secret.yaml

remove-dex-client.yamlDelete legacy dex-client ServiceAccount via kustomize patch +5/-0

Delete legacy dex-client ServiceAccount via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client ServiceAccount is removed from this ring-1 cluster.
components/konflux-ui/production/kflux-prd-rh02/remove-dex-client.yaml

dex-config.yamlSwitch Dex OpenShift connector clientID to env var +1/-1

Switch Dex OpenShift connector clientID to env var
• Updates the OpenShift connector configuration to use $OPENSHIFT_OAUTH_CLIENT_ID instead of hard-coding the dex-client serviceaccount identity.
components/konflux-ui/production/kflux-prd-rh03/dex-config.yaml

kustomization.yamlMove ring-1 cluster to dex-dynamic and delete legacy dex-client objects +10/-1

Move ring-1 cluster to dex-dynamic and delete legacy dex-client objects
• Switches this ring-1 overlay to reference ../base/dex-dynamic, retargets the redirect-uri patch to the dex ServiceAccount, and adds delete patches for the old dex-client ServiceAccount and Secret.
components/konflux-ui/production/kflux-prd-rh03/kustomization.yaml

remove-dex-client-secret.yamlDelete legacy dex-client Secret via kustomize patch +5/-0

Delete legacy dex-client Secret via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client Secret is removed from this ring-1 cluster.
components/konflux-ui/production/kflux-prd-rh03/remove-dex-client-secret.yaml

remove-dex-client.yamlDelete legacy dex-client ServiceAccount via kustomize patch +5/-0

Delete legacy dex-client ServiceAccount via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client ServiceAccount is removed from this ring-1 cluster.
components/konflux-ui/production/kflux-prd-rh03/remove-dex-client.yaml

kustomization.yamlExplicitly include the existing Dex base for this cluster overlay +1/-0

Explicitly include the existing Dex base for this cluster overlay
• Adds ../base/dex to resources to preserve prior behavior after Dex was removed from the shared production base.
components/konflux-ui/production/kflux-rhel-p01/kustomization.yaml

kustomization.yamlExplicitly include the existing Dex base for this cluster overlay +1/-0

Explicitly include the existing Dex base for this cluster overlay
• Adds ../base/dex to resources to preserve prior behavior after Dex was removed from the shared production base.
components/konflux-ui/production/stone-prd-rh01/kustomization.yaml

dex-config.yamlSwitch Dex OpenShift connector clientID to env var +1/-1

Switch Dex OpenShift connector clientID to env var
• Updates the OpenShift connector configuration to use $OPENSHIFT_OAUTH_CLIENT_ID instead of hard-coding the dex-client serviceaccount identity.
components/konflux-ui/production/stone-prod-p01/dex-config.yaml

kustomization.yamlMove ring-1 cluster to dex-dynamic and delete legacy dex-client objects +10/-1

Move ring-1 cluster to dex-dynamic and delete legacy dex-client objects
• Switches this ring-1 overlay to reference ../base/dex-dynamic, retargets the redirect-uri patch to the dex ServiceAccount, and adds delete patches for the old dex-client ServiceAccount and Secret.
components/konflux-ui/production/stone-prod-p01/kustomization.yaml

remove-dex-client-secret.yamlDelete legacy dex-client Secret via kustomize patch +5/-0

Delete legacy dex-client Secret via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client Secret is removed from this ring-1 cluster.
components/konflux-ui/production/stone-prod-p01/remove-dex-client-secret.yaml

remove-dex-client.yamlDelete legacy dex-client ServiceAccount via kustomize patch +5/-0

Delete legacy dex-client ServiceAccount via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client ServiceAccount is removed from this ring-1 cluster.
components/konflux-ui/production/stone-prod-p01/remove-dex-client.yaml

dex-config.yamlSwitch Dex OpenShift connector clientID to env var +1/-1

Switch Dex OpenShift connector clientID to env var
• Updates the OpenShift connector configuration to use $OPENSHIFT_OAUTH_CLIENT_ID instead of hard-coding the dex-client serviceaccount identity.
components/konflux-ui/production/stone-prod-p02/dex-config.yaml

kustomization.yamlMove ring-1 cluster to dex-dynamic and delete legacy dex-client objects +10/-1

Move ring-1 cluster to dex-dynamic and delete legacy dex-client objects
• Switches this ring-1 overlay to reference ../base/dex-dynamic, retargets the redirect-uri patch to the dex ServiceAccount, and adds delete patches for the old dex-client ServiceAccount and Secret.
components/konflux-ui/production/stone-prod-p02/kustomization.yaml

remove-dex-client-secret.yamlDelete legacy dex-client Secret via kustomize patch +5/-0

Delete legacy dex-client Secret via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client Secret is removed from this ring-1 cluster.
components/konflux-ui/production/stone-prod-p02/remove-dex-client-secret.yaml

remove-dex-client.yamlDelete legacy dex-client ServiceAccount via kustomize patch +5/-0

Delete legacy dex-client ServiceAccount via kustomize patch
• Adds a $patch: delete manifest to ensure the old dex-client ServiceAccount is removed from this ring-1 cluster.
components/konflux-ui/production/stone-prod-p02/remove-dex-client.yaml

dex-config.yamlUpdate new-cluster Dex template to use $OPENSHIFT_OAUTH_CLIENT_ID +1/-1

Update new-cluster Dex template to use $OPENSHIFT_OAUTH_CLIENT_ID
• Updates the dex-config template to use an environment-provided OpenShift OAuth clientID rather than a hard-coded dex-client identity.
hack/new-cluster/templates/konflux-ui/dex-config.yaml

kustomization.yamlTarget redirect-uri patch at dex SA in new-cluster template +1/-1

Target redirect-uri patch at dex SA in new-cluster template
• Changes the set-redirect-uri patch target ServiceAccount name from dex-client to dex to match the new approach.
hack/new-cluster/templates/konflux-ui/kustomization.yaml

filariow · 2026-07-15T13:48:08Z

/lgtm
/approve

openshift-ci · 2026-07-15T13:48:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: filariow, mshaposhnik

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [filariow,mshaposhnik]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot added do-not-merge/work-in-progress approved labels Jul 15, 2026

github-actions Bot added environment/production infra/hold-production prod/needs-approval labels Jul 15, 2026

mshaposhnik marked this pull request as ready for review July 15, 2026 08:53

openshift-ci Bot removed the do-not-merge/work-in-progress label Jul 15, 2026

openshift-ci Bot requested review from CryptoRodeo and hugares July 15, 2026 08:53

mshaposhnik requested a review from filariow July 15, 2026 11:16

openshift-ci Bot assigned filariow Jul 15, 2026

openshift-ci Bot added the lgtm label Jul 15, 2026

mshaposhnik added the do-not-merge/hold label Jul 15, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

konflux-ui: dynamic dex SA token for production (ring-1)#13042

konflux-ui: dynamic dex SA token for production (ring-1)#13042
mshaposhnik wants to merge 1 commit into
redhat-appstudio:mainfrom
mshaposhnik:dex-dynamic-sa-token-prod-ring1

mshaposhnik commented Jul 15, 2026

Uh oh!

openshift-ci Bot commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

Uh oh!

codecov Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

qodo-for-redhat-appstudio Bot commented Jul 15, 2026 •

edited

Loading

Uh oh!

qodo-for-redhat-appstudio Bot commented Jul 15, 2026

Uh oh!

filariow commented Jul 15, 2026

Uh oh!

openshift-ci Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

mshaposhnik commented Jul 15, 2026

What

Why

Validation

Risk Assessment

Uh oh!

openshift-ci Bot commented Jul 15, 2026

Uh oh!

github-actions Bot commented Jul 15, 2026

Kustomize Render Diff

Uh oh!

codecov Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

qodo-for-redhat-appstudio Bot commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review by Qodo

Sorry, something went wrong

Uh oh!

qodo-for-redhat-appstudio Bot commented Jul 15, 2026

PR Summary by Qodo

Uh oh!

filariow commented Jul 15, 2026

Uh oh!

openshift-ci Bot commented Jul 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

codecov Bot commented Jul 15, 2026 •

edited

Loading

qodo-for-redhat-appstudio Bot commented Jul 15, 2026 •

edited

Loading