Allow private IPs for in-cluster OIDC and OAuth2 upstream providers

[tgrunnagle]

Summary

• In-cluster OIDC and OAuth2 providers (e.g. Dex, Keycloak deployed as ClusterIP services) were unreachable because newHTTPClientForHost() unconditionally set WithPrivateIPs(false) for any non-localhost host. OIDC providers failed immediately at startup during discovery; OAuth2 providers failed at first token exchange. Both failures block in-cluster deployments.
• Adds an AllowPrivateIPs boolean flag to OIDCUpstreamRunConfig, OAuth2UpstreamRunConfig, upstream.OIDCConfig, and upstream.OAuth2Config. When true, the upstream HTTP clients accept RFC-1918 and link-local addresses. The flag widens only the private-IP gate — the HTTP-scheme restriction is unchanged, so HTTPS remains required for non-localhost hosts.

Closes #5614

Type of change

• Bug fix

Test plan

• Unit tests (task test)
• Linting (task lint-fix)

New tests cover:

• TestNewHTTPClientForHost extended with allowPrivateIPs parameter cases
• TestOAuth2Config_AllowPrivateIPs — field propagated through NewOAuth2Provider and defaults to false
• buildOIDCConfig / buildPureOAuth2Config propagation tests asserting the flag flows from RunConfig to the upstream config struct

API Compatibility

• This PR does not break the v1beta1 API, OR the api-break-allowed label is applied and the migration guidance is described above.

Changes

File	Change
pkg/authserver/config.go	Add AllowPrivateIPs bool to OIDCUpstreamRunConfig and OAuth2UpstreamRunConfig
pkg/authserver/upstream/oauth2.go	Add AllowPrivateIPs to OAuth2Config; update newHTTPClientForHost signature and logic
pkg/authserver/upstream/oidc.go	Pass config.AllowPrivateIPs to newHTTPClientForHost and propagate into internal oauth2 config
pkg/authserver/runner/embeddedauthserver.go	Propagate AllowPrivateIPs in buildOIDCConfig and buildPureOAuth2Config
pkg/authserver/runner/embeddedauthserver_test.go	Tests for flag propagation through both builder functions
pkg/authserver/upstream/oauth2_test.go	Tests for newHTTPClientForHost with the new parameter and AllowPrivateIPs field propagation

Does this introduce a user-facing change?

Yes. Operators can now set allow_private_ips: true on an OIDC or OAuth2 upstream config block to allow the embedded auth server to reach providers hosted at private IP addresses inside the same Kubernetes cluster.

upstreams:
  - name: in-cluster-oidc
    type: oidc
    oidc_config:
      issuer_url: https://dex.my-namespace.svc.cluster.local:5556
      client_id: my-client
      client_secret_file: /var/run/secrets/client_secret
      allow_private_ips: true

Special notes for reviewers

The fix intentionally does not widen the HTTP-scheme gate. WithInsecureAllowHTTP is still keyed only on localhost or INSECURE_DISABLE_URL_VALIDATION, so AllowPrivateIPs: true permits https://10.96.x.x:5556 but still rejects http://10.96.x.x:5556. The two properties are orthogonal: private-IP reachability vs. plaintext transport.

The pattern follows the existing serializable security-override convention used for Redis TLS (InsecureSkipVerify in storage/config.go).

Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.00%. Comparing base (8d5875b) to head (a1d6924).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #5618      +/-   ##
==========================================
+ Coverage   69.93%   70.00%   +0.07%     
==========================================
  Files         651      651              
  Lines       66502    66505       +3     
==========================================
+ Hits        46507    46559      +52     
+ Misses      16642    16577      -65     
- Partials     3353     3369      +16     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.