OCPCLOUD-3347: tls: use centralized TLS profile - #286
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@damdo: This pull request references OCPCLOUD-3347 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this: Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@damdo: This pull request references OCPCLOUD-3347 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
1739832 to
4011872
Compare
|
Units will be fixed by #287 |
4011872 to
9349d48
Compare
|
/retest |
|
/hold until we sort the main library |
openshift-ci
Bot
added
the
do-not-merge/hold
9349d48 to
056043e
Compare
|
/retest |
df73dbb to
bc9c1ce
Compare
|
/test e2e-aws-operator |
|
/test e2e-aws-capi-techpreview |
|
/assign @RadekManak |
|
/test e2e-aws-capi-techpreview |
a05cbe0 to
b556534
Compare
|
/lgtm |
openshift-ci
Bot
added
lgtm
b556534 to
74d6739
Compare
74d6739 to
8e3a98f
Compare
|
/test e2e-aws-capi-techpreview |
1 similar comment
|
/test e2e-aws-capi-techpreview |
|
|
|
Thanks @sunzhaohua2 /override ci/prow/e2e-aws-capi-techpreview |
|
@damdo: Overrode contexts on behalf of damdo: ci/prow/e2e-aws-capi-techpreview DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@damdo: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/test ? |
| klog.Fatalf("Can't set client configs: %v", err) | ||
| } | ||
|
|
||
| k8sClient, err := client.New(managementConfig, client.Options{Scheme: scheme}) |
There was a problem hiding this comment.
This should have been workloadConfig
## Summary - Integrate `controller-runtime-common/pkg/tls` for TLS profile support - Fetch the cluster APIServer TLS profile at startup with 10s context timeout (OpenShift only, fail closed on unexpected errors) - Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully by falling back to Intermediate profile - Apply profile-driven cipher suites and TLS version to webhook and metrics servers - Set explicit `MinVersion=TLS12` fallback for non-OpenShift clusters via the Intermediate profile - Register `SecurityProfileWatcher` to restart on profile changes - Set NextProtos (ALPN) for HTTP/2 support on all TLS endpoints - Add RBAC for `config.openshift.io/apiservers` (get/list/watch) - Bump controller-runtime to v0.23.3 and adapt webhook to generic `admission.Validator[T]` interface ## Motivation OCP 5.0 (GA October 2026) requires all components to honor the centralized TLS profile ([OCPSTRAT-2611](https://redhat.atlassian.net/browse/OCPSTRAT-2611)). Reference: [openshift/cluster-machine-approver #286](openshift/cluster-machine-approver#286) Supersedes #308 (closed due to shallow clone force-push issue). Moved from opendatahub-io#128 per reviewer request. ## Test plan - [x] `go build ./...` passes - [x] `gofmt` clean - [x] RBAC manifests regenerated and committed - [ ] Existing unit tests pass - [ ] CI green Ref: [RHOAIENG-67674](https://redhat.atlassian.net/browse/RHOAIENG-67674) Approved-by: VaishnaviHire Approved-by: derekhiggins
- Integrate `controller-runtime-common/pkg/tls` for TLS profile support - Fetch the cluster APIServer TLS profile at startup with 10s context timeout (OpenShift only, fail closed on unexpected errors) - Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully by falling back to Intermediate profile - Apply profile-driven cipher suites and TLS version to webhook and metrics servers - Set explicit `MinVersion=TLS12` fallback for non-OpenShift clusters via the Intermediate profile - Register `SecurityProfileWatcher` to restart on profile changes - Set NextProtos (ALPN) for HTTP/2 support on all TLS endpoints - Add RBAC for `config.openshift.io/apiservers` (get/list/watch) - Bump controller-runtime to v0.23.3 and adapt webhook to generic `admission.Validator[T]` interface OCP 5.0 (GA October 2026) requires all components to honor the centralized TLS profile ([OCPSTRAT-2611](https://redhat.atlassian.net/browse/OCPSTRAT-2611)). Reference: [openshift/cluster-machine-approver ogx-ai#286](openshift/cluster-machine-approver#286) Supersedes ogx-ai#308 (closed due to shallow clone force-push issue). Moved from #128 per reviewer request. - [x] `go build ./...` passes - [x] `gofmt` clean - [x] RBAC manifests regenerated and committed - [ ] Existing unit tests pass - [ ] CI green Ref: [RHOAIENG-67674](https://redhat.atlassian.net/browse/RHOAIENG-67674) Approved-by: VaishnaviHire Approved-by: derekhiggins (cherry picked from commit 70becbf)
6 participants
Start using centralized TLS profile fetched from the APIServer configuration.
Remove kube-rbac-proxy