operator: fix authentication spec api

.github/workflows/python-tests.yaml

@@ -10,9 +10,10 @@ on:
       - 'python/**'
       - 'protocol/**'
   pull_request:
-    paths:
-      - 'python/**'
-      - 'protocol/**'
+    # running for all, since github does not detect skipped on this when required for merging
+    #paths:
+    #  - 'python/**'
+    #  - 'protocol/**'
   merge_group:
 
 permissions:

controller/deploy/operator/api/v1alpha1/jumpstarter_types.go

@@ -226,11 +226,6 @@ type ControllerConfig struct {
 	// gRPC configuration for controller endpoints.
 	// Defines how controller gRPC services are exposed and configured.
 	GRPC GRPCConfig `json:"grpc,omitempty"`
-
-	// Authentication configuration for client and exporter authentication.
-	// Configures how clients and exporters can authenticate with Jumpstarter.
-	// Supports multiple authentication methods including internal tokens, Kubernetes tokens, and JWT.
-	Authentication AuthenticationConfig `json:"authentication,omitempty"`
 }
 
 // ExporterOptions defines configuration options for exporter behavior.

controller/deploy/operator/bundle/manifests/jumpstarter-operator.clusterserviceversion.yaml

@@ -18,7 +18,7 @@ metadata:
         }
       ]
     capabilities: Basic Install
-    createdAt: "2025-12-22T16:34:29Z"
+    createdAt: "2026-01-23T11:36:27Z"
     operators.operatorframework.io/builder: operator-sdk-v1.41.1
     operators.operatorframework.io/project_layout: go.kubebuilder.io/v4
   name: jumpstarter-operator.v0.8.0

controller/deploy/operator/internal/controller/jumpstarter/jumpstarter_controller.go

@@ -907,24 +907,24 @@ func (r *JumpstarterReconciler) buildConfig(jumpstarter *operatorv1alpha1.Jumpst
 
 	// Authentication configuration
 	auth := config.Authentication{
-		JWT: jumpstarter.Spec.Controller.Authentication.JWT,
+		JWT: jumpstarter.Spec.Authentication.JWT,
 	}
 
 	// Internal authentication
-	if jumpstarter.Spec.Controller.Authentication.Internal.Enabled {
-		prefix := jumpstarter.Spec.Controller.Authentication.Internal.Prefix
+	if jumpstarter.Spec.Authentication.Internal.Enabled {
+		prefix := jumpstarter.Spec.Authentication.Internal.Prefix
 		if prefix == "" {
 			prefix = "internal:"
 		}
 		auth.Internal.Prefix = prefix
 
-		if jumpstarter.Spec.Controller.Authentication.Internal.TokenLifetime != nil {
-			auth.Internal.TokenLifetime = jumpstarter.Spec.Controller.Authentication.Internal.TokenLifetime.Duration.String()
+		if jumpstarter.Spec.Authentication.Internal.TokenLifetime != nil {
+			auth.Internal.TokenLifetime = jumpstarter.Spec.Authentication.Internal.TokenLifetime.Duration.String()
 		}
 	}
 
 	// Kubernetes authentication
-	if jumpstarter.Spec.Controller.Authentication.K8s.Enabled {
+	if jumpstarter.Spec.Authentication.K8s.Enabled {
 		auth.K8s.Enabled = true
 	}
 

controller/deploy/operator/test/e2e/e2e_test.go

@@ -369,6 +369,10 @@ metadata:
 spec:
   baseDomain: %s
   useCertManager: false
+  authentication:
+    internal:
+      prefix: "internal:"
+      enabled: true
   controller:
     image: %s
     imagePullPolicy: IfNotPresent
@@ -379,10 +383,6 @@ spec:
           nodeport:
             enabled: true
             port: 30010
-    authentication:
-      internal:
-        prefix: "internal:"
-        enabled: true
   routers:
     image: %s
     imagePullPolicy: IfNotPresent

controller/hack/utils

@@ -65,8 +65,11 @@ kind_load_image() {
 install_nginx_ingress() {
   echo -e "${GREEN}Deploying nginx ingress in kind ...${NC}"
 
-  lsmod | grep ip_tables || \
-    (echo "ip_tables module not loaded needed by nginx ingress, please run 'sudo modprobe ip_tables'" && exit 1)
+  # Check ip_tables module only on Linux (lsmod doesn't exist on macOS)
+  if command -v lsmod &> /dev/null; then
+    lsmod | grep ip_tables || \
+      (echo "ip_tables module not loaded needed by nginx ingress, please run 'sudo modprobe ip_tables'" && exit 1)
+  fi
 
 kubectl apply -f https://github.com/kubernetes/ingress-nginx/raw/refs/heads/main/deploy/static/provider/kind/deploy.yaml