feat: Support add GrantType and JWT Bearer options in OAuth2 config#8565
Open
dongjiang1989 wants to merge 1 commit into
Open
feat: Support add GrantType and JWT Bearer options in OAuth2 config#8565dongjiang1989 wants to merge 1 commit into
GrantType and JWT Bearer options in OAuth2 config#8565dongjiang1989 wants to merge 1 commit into
Conversation
simonpasquier
left a comment
simonpasquier
left a comment
Contributor
There was a problem hiding this comment.
All fields which say Only used when grantType is set to "urn:ietf:params:oauth:grant-type:jwt-bearer" can be enforced by CEL validations.
Member
Author
|
Changed
|
dongjiang1989
force-pushed
the
update-oauth2
branch
4 times, most recently
from
May 13, 2026 10:25
f9ba4d5 to
4e0094c
Compare
Member
Author
|
@simonpasquier PTAL, thanks |
5 tasks
This was referenced Jun 6, 2026
Member
Author
|
Thanks @simonpasquier Please re-check, thanks |
dongjiang1989
added a commit
to kubeservice-stack/prometheus-operator
that referenced
this pull request
Jul 2, 2026
Add two new CEL validation rules to the OAuth2 CRD: - clientSecret is required when grantType is 'ClientCredentials' or empty - clientCertificateKey is required when grantType is 'JWTBearer' Update documentation to reflect Alertmanager >= v0.30.0 support for JWTBearer grant type (previously stated as "not supported"). Add e2e test cases for the new CEL rules. Address review feedback from simonpasquier on PR prometheus-operator#8565.
Member
Author
|
Thanks @simonpasquier Please re-check it |
dongjiang1989
added a commit
to kubeservice-stack/prometheus-operator
that referenced
this pull request
Jul 22, 2026
Add two new CEL validation rules to the OAuth2 CRD: - clientSecret is required when grantType is 'ClientCredentials' or empty - clientCertificateKey is required when grantType is 'JWTBearer' Update documentation to reflect Alertmanager >= v0.30.0 support for JWTBearer grant type (previously stated as "not supported"). Add e2e test cases for the new CEL rules. Address review feedback from simonpasquier on PR prometheus-operator#8565.
dongjiang1989
force-pushed
the
update-oauth2
branch
from
July 22, 2026 06:52
2d0e04c to
dd6c650
Compare
Add GrantType field to OAuth2 struct with support for client_credentials and jwt-bearer grant types. Add CEL validations to enforce required fields based on grant type: - client_credentials: requires clientSecret - jwt-bearer: requires clientCertificateKey - default (no grantType): requires clientSecret Also add TokenURL validation annotations (pattern + minLength) and corresponding unit/e2e tests. Signed-off-by: dongjiang <[email protected]>
dongjiang1989
force-pushed
the
update-oauth2
branch
from
July 23, 2026 06:09
9664b0f to
f4efdce
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Describe the big picture of your changes here to communicate to the maintainers why we should accept this pull request.
ref: prometheus/common#862 and prometheus/alertmanager#2735
GrantTypefield to the OAuth2 configuration, supporting bothclient_credentials(default) andurn:ietf:params:oauth:grant-type:jwt-bearer(RFC 7523)clientCertificateKey,clientCertificateKeyId,signatureAlgorithm,iss,audience, andclaimsIf you're contributing for the first-time, check our contribution guidelines.
Type of change
What type of changes does your code introduce to the Prometheus operator? Put an
xin the box that apply.CHANGE(fix or feature that would cause existing functionality to not work as expected)FEATURE(non-breaking change which adds functionality)BUGFIX(non-breaking change which fixes an issue)ENHANCEMENT(non-breaking change which improves existing functionality)NONE(if none of the other choices apply. Example, tooling, build system, CI, docs, etc.)Verification
Please check the Prometheus-Operator testing guidelines for recommendations about automated tests.
Changelog entry
Please put a one-line changelog entry below. This will be copied to the changelog file during the release process.