[GITOPS-9015]: Skip OpenshiftDexConfig when OpenShift Cluster Authentication is based on OIDC Provider

[akhilnittala]

What type of PR is this?

Uncomment only one /kind line, and delete the rest.
For example, > /kind bug would simply become: /kind bug

/kind bug
/kind cleanup
/kind failing-test
/kind enhancement
/kind documentation
/kind code-refactoring

What does this PR do / why we need it:
Currently, when an OpenShift cluster is configured with external authentication providers (such as Keycloak, Google, etc.) and the default openshift-gitops Argo CD instance also has SSO configured, authentication to the Argo CD route fails due to a Dex misconfiguration.

This PR addresses the issue by skipping the openshiftOAuth configuration when external authentication is enabled on the cluster. The operator determines this by inspecting the cluster-scoped Authentication CR and avoids configuring openshiftOAuth if spec.type is set to "OIDC".

In addition, this PR populates a condition on the Argo CD CR status to indicate that external authentication is enabled on the cluster, providing better visibility and reference for users for user created instances and also marks status.sso to Failed and creates condition.

for user-created-instances with sso on external authentication enabled clusters.

status:
  applicationController: Pending
  applicationSetController: Running
  conditions:
  - lastTransitionTime: "2026-02-12T10:03:10Z"
    message: ""
    reason: Success
    status: "True"
    type: Reconciled
  **- lastTransitionTime: "2026-02-12T10:03:08Z"
    message: OpenshiftOAuth is not supported when external authentication is enabled
      on cluster, please provide oidc config
    reason: UnSupportedSSOConfiguration
    status: "True"
    type: UnSupportedConfiguration**
  host: okhil-openshift-gitops-server-openshift-gitops.apps.psi-420-04.ocp-gitops-qe.com
  phase: Available
  redis: Running
  repo: Running
  server: Running
  sso: **Failed**

Have you updated the necessary documentation?

• Documentation update is required by this PR.
• Documentation has been updated.

Which issue(s) this PR fixes:
https://issues.redhat.com/browse/GITOPS-9015
Fixes #?
https://issues.redhat.com/browse/GITOPS-9015
Test acceptance criteria:

• Unit Test
• E2E Test

How to test changes / Special notes to the reviewer:

• Create an OpenShift 4.20 cluster, which enables external authentication by default.
• Configure Keycloak and integrate it with the OpenShift cluster as an external authentication provider by following the steps in the documentation: https://docs.google.com/document/d/1OxWa3gnbz2lLYYovd9UVQFJPIw4f2kBtTVwq8ScEI8Y/edit?tab=t.0#heading=h.okdpp55nmmi5
• Log in to the OpenShift cluster using Keycloak credentials.
• Install the OpenShift GitOps Operator with the changes introduced in this PR.
• Once the installation is complete, access the Argo CD route and log in using the admin credentials.
• Verify that the login is successful.

[akhilnittala]

go.mod and go.sum needs to be changed once upstream argocd-operator PR gets merged.
argocd-operator PR: argoproj-labs/argocd-operator#2073

[svghadi]

Looks good. Thanks

[akhilnittala]

/retest-required

[akhilnittala]

/retest-failed

[akhilnittala]

/retest-required

[akhilnittala]

/retest

[akhilnittala]

/retest-failed

[akhilnittala]

/retest-required

[akhilnittala]

/retest-required

[akhilnittala]

/retest-required

[akhilnittala]

/retest

[anandrkskd]

/retest

[akhilnittala]

/retest

[anandf]

LGTM

[anandf]

/approve
/lgtm

[chetan-rns]

/lgtm
/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anandf, chetan-rns

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anandf,chetan-rns]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[akhilnittala]

/retest-required

[varshab1210]

/retest

[anandrkskd]

/retest

[openshift-ci]

@akhilnittala: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/v4.14-e2e	a4e891b	link	true	/test v4.14-e2e
ci/prow/v4.14-kuttl-parallel	a4e891b	link	false	/test v4.14-kuttl-parallel
ci/prow/v4.14-kuttl-sequential	a4e891b	link	false	/test v4.14-kuttl-sequential

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[jgwest]

Merging even though v4.14 tests are failing, as these are known to be unreliable due to GitHub rate-limiting.

[jgwest]

LGTM