Change:
fldPath := field.NewPath("issuer", "discoveryURL") testCases := []struct { <del> name      string in        string issuerURL string want      string </del> <ins> name                          string in                            string issuerURL                     string want                          string structuredAuthnFeatureEnabled bool </ins> }{ { <del> name: "url is empty", in:   "", want: "", </del> <ins> name:                          "url is empty", in:                            "", want:                          "", structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "url parse error", in:   "https://oidc.oidc-namespace.svc:invalid-port", want: `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc:invalid-port": parse "https://oidc.oidc-namespace.svc:invalid-port": invalid port ":invalid-port" after host`, </del> <ins> name:                          "url parse error", in:                            "https://oidc.oidc-namespace.svc:invalid-port", want:                          `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc:invalid-port": parse "https://oidc.oidc-namespace.svc:invalid-port": invalid port ":invalid-port" after host`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "url is not https", in:   "http://oidc.oidc-namespace.svc", want: `issuer.discoveryURL: Invalid value: "http://oidc.oidc-namespace.svc": URL scheme must be https`, </del> <ins> name:                          "url is not https", in:                            "http://oidc.oidc-namespace.svc", want:                          `issuer.discoveryURL: Invalid value: "http://oidc.oidc-namespace.svc": URL scheme must be https`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "url user info is not allowed", in:   "https://user:pass@oidc.oidc-namespace.svc", want: `issuer.discoveryURL: Invalid value: "https://user:pass@oidc.oidc-namespace.svc": URL must not contain a username or password`, </del> <ins> name:                          "url user info is not allowed", in:                            "https://user:pass@oidc.oidc-namespace.svc", want:                          `issuer.discoveryURL: Invalid value: "https://user:pass@oidc.oidc-namespace.svc": URL must not contain a username or password`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "url raw query is not allowed", in:   "https://oidc.oidc-namespace.svc?query", want: `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc?query": URL must not contain a query`, </del> <ins> name:                          "url raw query is not allowed", in:                            "https://oidc.oidc-namespace.svc?query", want:                          `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc?query": URL must not contain a query`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "url fragment is not allowed", in:   "https://oidc.oidc-namespace.svc#fragment", want: `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc#fragment": URL must not contain a fragment`, </del> <ins> name:                          "url fragment is not allowed", in:                            "https://oidc.oidc-namespace.svc#fragment", want:                          `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc#fragment": URL must not contain a fragment`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "valid url", in:   "https://oidc.oidc-namespace.svc", want: "", </del> <ins> name:                          "valid url", in:                            "https://oidc.oidc-namespace.svc", want:                          "", structuredAuthnFeatureEnabled: true, </ins> }, { <del> name: "valid url with path", in:   "https://oidc.oidc-namespace.svc/path", want: "", </del> <ins> name:                          "valid url with path", in:                            "https://oidc.oidc-namespace.svc/path", want:                          "", structuredAuthnFeatureEnabled: true, </ins> }, { <del> name:      "discovery url same as issuer url", issuerURL: "https://issuer-url", in:        "https://issuer-url", want:      `issuer.discoveryURL: Invalid value: "https://issuer-url": discoveryURL must be different from URL`, </del> <ins> name:                          "discovery url same as issuer url", issuerURL:                     "https://issuer-url", in:                            "https://issuer-url", want:                          `issuer.discoveryURL: Invalid value: "https://issuer-url": discoveryURL must be different from URL`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name:      "discovery url same as issuer url, with trailing slash", issuerURL: "https://issuer-url", in:        "https://issuer-url/", want:      `issuer.discoveryURL: Invalid value: "https://issuer-url/": discoveryURL must be different from URL`, </del> <ins> name:                          "discovery url same as issuer url, with trailing slash", issuerURL:                     "https://issuer-url", in:                            "https://issuer-url/", want:                          `issuer.discoveryURL: Invalid value: "https://issuer-url/": discoveryURL must be different from URL`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name:      "discovery url same as issuer url, with multiple trailing slashes", issuerURL: "https://issuer-url", in:        "https://issuer-url///", want:      `issuer.discoveryURL: Invalid value: "https://issuer-url///": discoveryURL must be different from URL`, </del> <ins> name:                          "discovery url same as issuer url, with multiple trailing slashes", issuerURL:                     "https://issuer-url", in:                            "https://issuer-url///", want:                          `issuer.discoveryURL: Invalid value: "https://issuer-url///": discoveryURL must be different from URL`, structuredAuthnFeatureEnabled: true, </ins> }, { <del> name:      "discovery url same as issuer url, issuer url with trailing slash", issuerURL: "https://issuer-url/", in:        "https://issuer-url", want:      `issuer.discoveryURL: Invalid value: "https://issuer-url": discoveryURL must be different from URL`, </del> <ins> name:                          "discovery url same as issuer url, issuer url with trailing slash", issuerURL:                     "https://issuer-url/", in:                            "https://issuer-url", want:                          `issuer.discoveryURL: Invalid value: "https://issuer-url": discoveryURL must be different from URL`, structuredAuthnFeatureEnabled: true, }, { name: "discovery url set but structured authn feature disabled", in:   "https://oidc.oidc-namespace.svc", want: `issuer.discoveryURL: Invalid value: "https://oidc.oidc-namespace.svc": discoveryURL is not supported when StructuredAuthenticationConfiguration feature gate is disabled`, </ins> }, } for _, tt := range testCases { t.Run(tt.name, func(t *testing.T) { <del> got := validateIssuerDiscoveryURL(tt.issuerURL, tt.in, fldPath).ToAggregate() </del> <ins> got := validateIssuerDiscoveryURL(tt.issuerURL, tt.in, fldPath, tt.structuredAuthnFeatureEnabled).ToAggregate() </ins> if d := cmp.Diff(tt.want, errString(got)); d != "" { t.Fatalf("URL validation mismatch (-want +got):n%s", d) }

Discussion:
For example, should not let you set discovery URL when the feature gate is not enabled. I believe this only impacts library users, as direct usage in KAS requires the file based config, which is feature gated. /assign enj aramase /milestone v1.32