Operator OIDC management redo

[travisbcotton]

Description

Reworks how the operator provisions Vault OIDC for TokenSmith and the CLI, fixing two multi-control-plane bugs (#57, #58) and separating the Vault dial address from the canonical OIDC issuer.

Motivation

The previous implementation wrote the Vault-global identity/oidc/config and mutated the shared provider's allowed_client_ids via read-modify-write. When multiple OpenCHAMIControlPlane resources share one Vault, this caused:

• [Bug]: EnsureOIDCConfig treats global Vault configuration as per-control-plane state #58 — control planes overwriting each other's issuer (last reconcile wins)
• [Bug]: ensureProviderAllowsClient lost-update race #57 — a lost-update race dropping OIDC clients from the shared provider

Changes

Shared named OIDC provider

• The operator now manages a single named provider identity/oidc/provider/openchami instead of the global identity/oidc/config.
• allowed_client_ids is a fixed wildcard (["*"]); access is scoped per-client via assignments, so there is no shared mutable list to race on ([Bug]: ensureProviderAllowsClient lost-update race #57).
• Each control plane provisions its own per-cluster confidential (TokenSmith) and public/PKCE (CLI) clients; the CLI client_id is surfaced at a new KV path.

Conflict detection instead of silent overwrite

• Provider writes use read-before-write plus a strict post-write read-back that requires the intended issuer to be observable.
• If the shared provider already carries a different issuer, reconciliation fails with a clear configuration conflict rather than overwriting it ([Bug]: EnsureOIDCConfig treats global Vault configuration as per-control-plane state #58). Control planes sharing a Vault must agree on the canonical issuer.

Separate dial address from canonical OIDC issuer

• Added optional spec.platform.vault.oidcIssuer. address remains the URL the operator uses to reach Vault; oidcIssuer is the canonical scheme://host[:port] issuer that clients (including TokenSmith) validate iss against. Falls back to address when unset.
• Helpers split into VaultAddress, VaultOIDCIssuerBase, and VaultOIDCProviderURL.

Validation

• Webhook validates oidcIssuer as scheme://host[:port] with no userinfo/path/query/fragment.
• Applies an HTTPS policy: https for any host, http only for provably-internal hosts. Single-label hostnames are accepted for the dial address (dev convenience) but rejected as a plaintext issuer since they aren't provably cluster-local.

Tests & docs

• Added unit tests for the split, issuer conflicts (including the concurrent-creation read-back path), the HTTP/HTTPS host policy, and concurrent multi-control-plane reconciliation.
• Updated CRD reference and phase docs.

Checklist

• My code follows the style guidelines of this project
• I have added/updated comments where needed
• I have added tests that prove my fix is effective or my feature works
• I have run make test (or equivalent) locally and all tests pass
• I have updated the relevant documentation (CLI examples, man pages, README, other docs, etc.)
• DCO Sign-off: All commits are signed off (git commit -s) with my real name and email
• REUSE Compliance:
  • Each new/modified source file has SPDX copyright and license headers
  • Any non-commentable files include a <filename>.license sidecar
  • All referenced licenses are present in the LICENSES/ directory

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Dependency update
• Build system/CI

---

• I agree to follow the Code of Conduct.