Wrap up 4630 tasks, remove synthetic permissions and preflight admissions feature gates and residuals.

Signed-off-by: Daniel Franz <dfranz@redhat.com>

Author: dtfranz

.claude/TODO-OCPSTRAT-3040.md

@@ -35,11 +35,11 @@ Anyone:      Stream 6 (docs) ← after 4
 
 ### Stream 2 — Authentication + Action + Labels (Engineer B, no blockers)
 
-- [ ] Remove `TokenGetter` (`authentication/tokengetter.go`) — **OPRUN-4630**
-- [ ] Remove `TokenInjectingRoundTripper` (`authentication/tripper.go`) — **OPRUN-4630**
-- [ ] Remove `authentication/synthetic.go` + tests — **OPRUN-4632**
-- [ ] Remove `ServiceAccountRestConfigMapper` from `action/restconfig.go` — **OPRUN-4630**
-- [ ] Remove `SyntheticUserRestConfigMapper` from `action/restconfig.go` + tests — **OPRUN-4632**
+- [X] Remove `TokenGetter` (`authentication/tokengetter.go`) — **OPRUN-4630**
+- [X] Remove `TokenInjectingRoundTripper` (`authentication/tripper.go`) — **OPRUN-4630**
+- [X] Remove `authentication/synthetic.go` + tests — **OPRUN-4632**
+- [X] Remove `ServiceAccountRestConfigMapper` from `action/restconfig.go` — **OPRUN-4630**
+- [X] Remove `SyntheticUserRestConfigMapper` from `action/restconfig.go` + tests — **OPRUN-4632**
 - [X] Remove SA annotations (`ServiceAccountNameKey`, `ServiceAccountNamespaceKey`) from `labels/labels.go` — **OPRUN-4630** `7f5a6843`
 
 ### Stream 3 — Authorization + Build tooling (Engineer C, no blockers)
@@ -57,7 +57,7 @@ Anyone:      Stream 6 (docs) ← after 4
 - [X] Remove pre-auth checks from Helm applier — **OPRUN-4631** N/A (PreAuthorizer removed in `9791b717`)
 - [X] Remove pre-auth checks from Boxcutter applier — **OPRUN-4631** N/A (PreAuthorizer removed in `9791b717`)
 - [X] Remove `PreflightPermissions` feature gate from `features.go` — **OPRUN-4631** `e1b7d2f1`
-- [ ] Remove `SyntheticPermissions` feature gate from `features.go` — **OPRUN-4632**
+- [X] Remove `SyntheticPermissions` feature gate from `features.go` — **OPRUN-4632**
 - [X] Clean up RBAC watches if only needed for pre-auth — **OPRUN-4631** N/A (RBAC watches serve Boxcutter phase ordering)
 - [X] Rewire `main.go`: remove all SA/synthetic/preflight wiring, always use controller's own SA — **OPRUN-4630** `7f5a6843`
 - [ ] Update all unit + e2e tests — **OPRUN-4630, OPRUN-4631, OPRUN-4632**

cmd/operator-controller/main.go

@@ -60,7 +60,6 @@ import (
 	ocv1 "github.com/operator-framework/operator-controller/api/v1"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/action"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/applier"
-	"github.com/operator-framework/operator-controller/internal/operator-controller/authentication"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/cache"
 	catalogclient "github.com/operator-framework/operator-controller/internal/operator-controller/catalogmetadata/client"
 	"github.com/operator-framework/operator-controller/internal/operator-controller/contentmanager"
@@ -656,20 +655,13 @@ func (c *boxcutterReconcilerConfigurator) Configure(ceReconciler *controllers.Cl
 		return fmt.Errorf("unable to add tracking cache to manager: %v", err)
 	}
 
-	cerCoreClient, err := corev1client.NewForConfig(c.mgr.GetConfig())
-	if err != nil {
-		return fmt.Errorf("unable to create client for ClusterObjectSet controller: %w", err)
-	}
-	cerTokenGetter := authentication.NewTokenGetter(cerCoreClient, authentication.WithExpirationDuration(1*time.Hour))
-
 	revisionEngineFactory, err := controllers.NewDefaultRevisionEngineFactory(
 		c.mgr.GetScheme(),
 		trackingCache,
 		discoveryClient,
 		c.mgr.GetRESTMapper(),
 		fieldOwnerPrefix,
 		c.mgr.GetConfig(),
-		cerTokenGetter,
 	)
 	if err != nil {
 		return fmt.Errorf("unable to create revision engine factory: %w", err)
@@ -695,11 +687,7 @@ func (c *helmReconcilerConfigurator) Configure(ceReconciler *controllers.Cluster
 	if err != nil {
 		return fmt.Errorf("unable to create core client: %w", err)
 	}
-	tokenGetter := authentication.NewTokenGetter(coreClient, authentication.WithExpirationDuration(1*time.Hour))
-	clientRestConfigMapper := action.ServiceAccountRestConfigMapper(tokenGetter)
-	if features.OperatorControllerFeatureGate.Enabled(features.SyntheticPermissions) {
-		clientRestConfigMapper = action.SyntheticUserRestConfigMapper(clientRestConfigMapper)
-	}
+	clientRestConfigMapper := action.ClusterAdminRestConfigMapper(c.mgr.GetConfig())
 
 	cfgGetter, err := helmclient.NewActionConfigGetter(c.mgr.GetConfig(), c.mgr.GetRESTMapper(),
 		helmclient.StorageDriverMapper(action.ChunkedStorageDriverMapper(coreClient, c.mgr.GetAPIReader(), cfg.systemNamespace)),

hack/demo/resources/synthetic-user-perms/argocd-clusterextension.yaml

@@ -15,11 +15,9 @@ options:
         - BundleReleaseSupport
         - DeploymentConfig
         - HelmChartSupport
-        - PreflightPermissions
         - SingleOwnNamespaceInstallSupport
         - WebhookProviderCertManager
       disabled:
-        - SyntheticPermissions
         - WebhookProviderOpenshiftServiceCA
 # List of enabled experimental features for catalogd
 # Use with {{- if has "FeatureGate" .Values.options.catalogd.features.enabled }}

hack/demo/resources/synthetic-user-perms/cegroup-admin-binding.yaml

@@ -18,9 +18,7 @@ options:
         - BundleReleaseSupport
         - DeploymentConfig
         - HelmChartSupport
-        - PreflightPermissions
         - SingleOwnNamespaceInstallSupport
-        - SyntheticPermissions
         - WebhookProviderOpenshiftServiceCA
     podDisruptionBudget:
       enabled: true

hack/demo/synthetic-user-cluster-admin-demo-script.sh

@@ -15,7 +15,6 @@ options:
     features:
       enabled:
         - SingleOwnNamespaceInstallSupport
-        - PreflightPermissions
         - HelmChartSupport
       disabled:
         - WebhookProviderOpenshiftServiceCA

helm/experimental.yaml

@@ -2,64 +2,15 @@ package action
 
 import (
 	"context"
-	"fmt"
-	"net/http"
 
-	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/client-go/rest"
-	"k8s.io/client-go/transport"
 	"sigs.k8s.io/controller-runtime/pkg/client"
-
-	ocv1 "github.com/operator-framework/operator-controller/api/v1"
-	"github.com/operator-framework/operator-controller/internal/operator-controller/authentication"
 )
 
-// SyntheticUserRestConfigMapper returns an AuthConfigMapper that that impersonates synthetic users and groups for Object o.
-// o is expected to be a ClusterExtension. If the service account defined in o is different from 'olm.synthetic-user', the
-// defaultAuthMapper will be used
-func SyntheticUserRestConfigMapper(defaultAuthMapper func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error)) func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
-	return func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
-		cExt, err := validate(o, c)
-		if err != nil {
-			return nil, err
-		}
-		cc := rest.CopyConfig(c)
-		cc.Wrap(func(rt http.RoundTripper) http.RoundTripper {
-			return transport.NewImpersonatingRoundTripper(authentication.SyntheticImpersonationConfig(*cExt), rt)
-		})
-		return cc, nil
-	}
-}
-
-// ServiceAccountRestConfigMapper returns an AuthConfigMapper scoped to the service account defined in o, which is expected to
-// be a ClusterExtension
-func ServiceAccountRestConfigMapper(tokenGetter *authentication.TokenGetter) func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
+// ClusterAdminRestConfigMapper returns a config with cluster-admin permissions
+func ClusterAdminRestConfigMapper(adminConfig *rest.Config) func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config,
+	error) {
 	return func(ctx context.Context, o client.Object, c *rest.Config) (*rest.Config, error) {
-		saConfig := rest.AnonymousClientConfig(c)
-		saConfig.Wrap(func(rt http.RoundTripper) http.RoundTripper {
-			return &authentication.TokenInjectingRoundTripper{
-				Tripper:     rt,
-				TokenGetter: tokenGetter,
-				Key: types.NamespacedName{
-					Name:      "operator-controller-controller-manager",
-					Namespace: "olmv1-system",
-				},
-			}
-		})
-		return saConfig, nil
-	}
-}
-
-func validate(o client.Object, c *rest.Config) (*ocv1.ClusterExtension, error) {
-	if c == nil {
-		return nil, fmt.Errorf("rest config is nil")
-	}
-	if o == nil {
-		return nil, fmt.Errorf("object is nil")
-	}
-	cExt, ok := o.(*ocv1.ClusterExtension)
-	if !ok {
-		return nil, fmt.Errorf("object is not a ClusterExtension")
+		return rest.CopyConfig(adminConfig), nil
 	}
-	return cExt, nil
 }