Integrate central TLS profile via controller-runtime-common by JonahSussman · Pull Request #83 · medik8s/storage-based-remediation

JonahSussman · 2026-07-30T18:54:41Z

Adds support for reading the cluster's centrally configured TLS profile from the APIServer CR and applying it to the metrics and webhook servers, enabling compliance with cluster-wide TLS policies. Follows the same pattern established in FAR PR #214.

What this PR does

Fetches the TLS profile at startup using openshifttls.FetchAPIServerTLSProfile from controller-runtime-common. On non-OpenShift clusters, falls back to default TLS settings gracefully.
Applies the TLS profile to metrics and webhook servers via openshifttls.NewTLSConfigFromProfile, which configures MinVersion and CipherSuites based on the cluster's TLS security profile (e.g. Old, Intermediate, Modern, or Custom).
Watches for runtime TLS profile changes using openshifttls.SecurityProfileWatcher. If the admin changes the TLS profile on a running cluster, the manager restarts to pick up the new settings.
Adds RBAC for get/list/watch on config.openshift.io/apiservers.
Migrates webhook validator to typed generics (admission.Validator[*StorageBasedRemediationConfig]) as required by the new controller-runtime API.
Sets tls-profiles OLM annotation to "true" in the Makefile bundle target to declare TLS profile support.

Dependency bumps

sigs.k8s.io/controller-runtime: v0.21.0 -> v0.24.1
k8s.io/api, k8s.io/apimachinery, k8s.io/client-go: v0.34.7 -> v0.36.2
github.com/openshift/api: updated to latest
github.com/openshift/controller-runtime-common: added (new dependency)

Other fixes

Fixed pre-existing go vet warning: non-constant format string passed to emitEventf (exposed by Go 1.26)

Testing

All unit tests pass (7 packages, including 57.1% coverage on controller)
Binary builds successfully
Bundle validates with operator-sdk bundle validate

Add support for reading the cluster's centrally configured TLS profile from the APIServer CR and applying it to metrics and webhook servers. On non-OpenShift clusters, falls back to default TLS settings gracefully. Bump controller-runtime to v0.24.1 and k8s.io libraries to v0.36.2. Migrate webhook validator to typed generics (admission.Validator[*T]) required by the new controller-runtime API. Following the pattern established in FAR PR #214. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

coderabbitai · 2026-07-30T19:10:58Z

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

Validation Failed: {"resource":"IssueComment","code":"custom","field":"body","message":"body is too long (maximum is 65536 characters)"} - https://docs.github.com/rest/issues/comments#update-an-issue-comment

The operator now supports centralized TLS profiles, so the features.operators.openshift.io/tls-profiles annotation should reflect that. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

coderabbitai · 2026-07-30T19:38:00Z

Caution

Failed to replace (edit) comment. This is likely due to insufficient permissions or the comment being deleted.

Error details

Validation Failed: {"resource":"IssueComment","code":"custom","field":"body","message":"body is too long (maximum is 65536 characters)"} - https://docs.github.com/rest/issues/comments#update-an-issue-comment

weshayutin · 2026-08-05T22:06:01Z

/ok-to-test

weshayutin · 2026-08-06T19:31:22Z

@pranavgaikwad please review

pranavgaikwad

ACK

pranavgaikwad

/lgtm

razo7 · 2026-08-10T08:22:17Z

    categories: OpenShift Optional
    containerImage: quay.io/medik8s/storage-based-remediation-operator:latest
-    createdAt: ""
+    createdAt: "2026-07-30T19:35:27Z"


That should be empty

Address review feedback on PR medik8s#83 (razo7): reset createdAt so the field does not churn on bundle regeneration. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

coderabbitai · 2026-08-12T12:35:17Z

Caution

CodeRabbit couldn't update its existing comment. The review summary may be out of date.

Error details

Validation Failed: {"resource":"IssueComment","code":"custom","field":"body","message":"body is too long (maximum is 65536 characters)"} - https://docs.github.com/rest/issues/comments#update-an-issue-comment

JonahSussman · 2026-08-20T19:18:50Z

/retest

razo7 · 2026-08-21T09:28:26Z

This PR uses controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e, which doesn't include CurvePreferences/Groups support that was merged on 2026-08-13 and adds TLS groups/curve preferences (including PQC groups like X25519MLKEM768).

Please bump to v0.0.0-20260813135806-e1187ec555fc before merging. FAR PR#214 already includes this bump as a reference.

/hold

…in.go Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

Pick up openshift/controller-runtime-common#22 which adds TLS groups/curve preferences (including PQC groups like X25519MLKEM768) to the central TLS profile configuration. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

weshayutin · 2026-08-21T20:13:02Z

/override "ci/prow/4.22-tls-pqc-readiness"

openshift-ci · 2026-08-21T20:13:06Z

@weshayutin: Overrode contexts on behalf of weshayutin: ci/prow/4.22-tls-pqc-readiness

Details

In response to this:

/override "ci/prow/4.22-tls-pqc-readiness"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

weshayutin · 2026-08-21T20:13:10Z

/override "ci/prow/4.23-tls-pqc-readiness"

openshift-ci · 2026-08-21T20:13:15Z

@weshayutin: Overrode contexts on behalf of weshayutin: ci/prow/4.23-tls-pqc-readiness

Details

In response to this:

/override "ci/prow/4.23-tls-pqc-readiness"

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

weshayutin

see @razo7's comment

weshayutin · 2026-08-21T20:16:54Z

ugh.. apologies.. too many tabs opened and I made comments in the wrong pr

razo7 · 2026-08-23T07:40:10Z

/retest

razo7

/unhold

razo7 · 2026-08-23T12:57:06Z

/retest

fixing

weshayutin

/LGTM

openshift-ci · 2026-08-24T13:52:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JonahSussman, pranavgaikwad, razo7, weshayutin

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [JonahSussman,pranavgaikwad,razo7,weshayutin]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot added needs-rebase needs-ok-to-test labels Jul 30, 2026

openshift-ci Bot requested review from eemcmullan and razo7 July 30, 2026 18:55

JonahSussman force-pushed the JonahSussman/use-cluster-tls-profile branch from db56c56 to 862c99e Compare July 30, 2026 19:10

openshift-ci Bot removed the needs-rebase label Jul 30, 2026

Set tls-profiles annotation to true in OLM bundle

b359a65

The operator now supports centralized TLS profiles, so the features.operators.openshift.io/tls-profiles annotation should reflect that. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

This was referenced Jul 30, 2026

Integrate central TLS profile via controller-runtime-common medik8s/node-healthcheck-operator#426

Merged

Integrate central TLS profile via controller-runtime-common medik8s/self-node-remediation#333

Merged

openshift-ci Bot added ok-to-test and removed needs-ok-to-test labels Aug 5, 2026

pranavgaikwad approved these changes Aug 6, 2026

View reviewed changes

openshift-ci Bot assigned pranavgaikwad Aug 6, 2026

openshift-ci Bot added the lgtm label Aug 6, 2026

pranavgaikwad previously approved these changes Aug 6, 2026

View reviewed changes

razo7 reviewed Aug 10, 2026

View reviewed changes

Reset bundle CSV createdAt to empty

f48bf96

Address review feedback on PR medik8s#83 (razo7): reset createdAt so the field does not churn on bundle regeneration. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

openshift-ci Bot removed the lgtm label Aug 12, 2026

openshift-ci Bot added the approved label Aug 12, 2026

razo7 mentioned this pull request Aug 16, 2026

Add TLS and PQC checks for RHWA operators openshift/release#83399

Merged

JonahSussman dismissed pranavgaikwad’s stale review via f48bf96 August 20, 2026 17:27

openshift-ci Bot added the do-not-merge/hold label Aug 21, 2026

JonahSussman added 2 commits August 21, 2026 14:04

fix: remove stray blank line breaking import grouping in sbr-agent ma…

86502e7

…in.go Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

Bump controller-runtime-common for CurvePreferences support

63cf843

Pick up openshift/controller-runtime-common#22 which adds TLS groups/curve preferences (including PQC groups like X25519MLKEM768) to the central TLS profile configuration. Signed-off-by: JonahSussman <sussmanjonah@gmail.com>

weshayutin approved these changes Aug 21, 2026 •

edited

Loading

View reviewed changes

openshift-ci Bot assigned weshayutin Aug 21, 2026

openshift-ci Bot added the lgtm label Aug 21, 2026

weshayutin previously requested changes Aug 21, 2026

View reviewed changes

openshift-ci Bot removed the lgtm label Aug 21, 2026

razo7 approved these changes Aug 23, 2026

View reviewed changes

openshift-ci Bot removed the do-not-merge/hold label Aug 23, 2026

openshift-ci Bot assigned razo7 Aug 23, 2026

openshift-ci Bot added the lgtm label Aug 23, 2026

weshayutin approved these changes Aug 24, 2026

View reviewed changes

openshift-merge-bot Bot merged commit a6098b0 into medik8s:main Aug 24, 2026
17 checks passed

Conversation

JonahSussman commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does

Dependency bumps

Other fixes

Testing

Related

Uh oh!

openshift-ci Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 30, 2026

Uh oh!

coderabbitai Bot commented Jul 30, 2026

Uh oh!

weshayutin commented Aug 5, 2026

Uh oh!

weshayutin commented Aug 6, 2026

Uh oh!

pranavgaikwad left a comment

Choose a reason for hiding this comment

Uh oh!

pranavgaikwad left a comment

Choose a reason for hiding this comment

Uh oh!

razo7 Aug 10, 2026

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot commented Aug 12, 2026

Uh oh!

JonahSussman commented Aug 20, 2026

Uh oh!

razo7 commented Aug 21, 2026

Uh oh!

weshayutin commented Aug 21, 2026

Uh oh!

openshift-ci Bot commented Aug 21, 2026

Uh oh!

weshayutin commented Aug 21, 2026

Uh oh!

openshift-ci Bot commented Aug 21, 2026

Uh oh!

Uh oh!

weshayutin left a comment

Choose a reason for hiding this comment

Uh oh!

weshayutin commented Aug 21, 2026

Uh oh!

razo7 commented Aug 23, 2026

Uh oh!

razo7 left a comment

Choose a reason for hiding this comment

Uh oh!

razo7 commented Aug 23, 2026

Uh oh!

weshayutin left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Aug 24, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

JonahSussman commented Jul 30, 2026 •

edited

Loading

coderabbitai Bot commented Jul 30, 2026 •

edited

Loading