WIP: OCPNODE-3918: Implement centralized TLS security profile support#998
WIP: OCPNODE-3918: Implement centralized TLS security profile support#998harche wants to merge 3 commits intoopenshift:nextfrom
Conversation
This change implements configurable TLS security profiles for the DAS Operator to comply with OCPSTRAT-2611, which mandates all OpenShift components support centralized TLS profile configuration by OCP 4.22 GA. Key changes: - Add TLS observer controller using informer/lister pattern to watch APIServer.spec.tlsSecurityProfile for cluster-wide TLS configuration - Create TLS helper package (pkg/tlsconfig) for profile resolution and cipher suite conversion using library-go - Apply TLS configuration to controller webhook and metrics servers - Apply TLS configuration to daemonset metrics server - Inject TLS config via CLI args to webhook, operator, and daemonset components - Integrate TLS observer with target config reconciler for dynamic updates - Add RBAC permissions to get/list/watch config.openshift.io/apiservers - Add CSV annotation: features.operators.openshift.io/tls-profiles: "true" - Add comprehensive unit tests for TLS profile resolution - Add E2E tests for TLS security profile verification TLS Profile Resolution Order: 1. APIServer.spec.tlsSecurityProfile (cluster-wide setting) 2. Intermediate profile (default fallback) Supported profiles: Old, Intermediate, Modern (PQC-ready), and Custom. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
openshift-ci-robot
added
the
jira/valid-reference
|
@harche: This pull request references OCPNODE-3918 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
openshift-ci
bot
added
do-not-merge/work-in-progress
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: harche The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
It would be easier to review if there was a commit of the changes, and a commit of the vendor update. |
The controllercmd library requires Kubernetes-style TypeMeta fields
(apiVersion and kind) when deserializing the operator config JSON.
Without these fields, the operator crashes with:
"Object 'Kind' is missing in '{"servingInfo":{...}}'"
Add TypeMeta to GenericOperatorConfig in both operator and daemonset
commands to fix the CI e2e-bundle tests.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
The TLS E2E tests were using incorrect daemonset name "das-operator-daemonset" but the actual daemonset is named "das-daemonset" as defined in: - bindata/assets/instaslice-operator/daemonset.yaml - pkg/cmd/daemonset/cmd.go Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
/test unit |
|
@harche: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/test unit |
| return cmd | ||
| } | ||
|
|
||
| // createTLSConfigFile fetches the cluster TLS profile and creates a temp config file |
There was a problem hiding this comment.
sorta confused why we need a config file? The command line arguments should be passed to the operator.
3 participants
Summary
This PR implements configurable TLS security profiles for the DAS Operator to comply with OCPSTRAT-2611, which mandates all OpenShift components support centralized TLS profile configuration by OCP 4.22 GA.
Key changes:
APIServer.spec.tlsSecurityProfilefor cluster-wide TLS configurationpkg/tlsconfig) for profile resolution and cipher suite conversion using library-goconfig.openshift.io/apiserversfeatures.operators.openshift.io/tls-profiles: "true"TLS Profile Resolution Order:
APIServer.spec.tlsSecurityProfile(cluster-wide setting)Supported profiles: Old, Intermediate, Modern (PQC-ready), and Custom.
Test plan
go test ./pkg/tlsconfig/... ./pkg/controller/tlsobserver/...)References
🤖 Generated with Claude Code