From fc8b894a8c94dbf6b903000fed6f6cc6231e583e Mon Sep 17 00:00:00 2001 From: Damiano Donati Date: Thu, 19 Mar 2026 22:13:19 +0100 Subject: [PATCH] feat(machine-approver): add TLS configuration options to deployment manifests Added `--tls-min-version` and `--tls-cipher-suites` arguments to the machine approver deployment configurations across multiple environments to enhance security settings. --- ...rolPlaneComponents_machine_approver_deployment.yaml | 2 ++ ...rolPlaneComponents_machine_approver_deployment.yaml | 2 ++ ...rolPlaneComponents_machine_approver_deployment.yaml | 2 ++ ...rolPlaneComponents_machine_approver_deployment.yaml | 2 ++ ...rolPlaneComponents_machine_approver_deployment.yaml | 2 ++ .../v2/machine_approver/deployment.go | 10 ++++++++++ 6 files changed, 20 insertions(+) diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml index 4a1aaf2dd634..821e293ea760 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/AROSwift/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml @@ -72,6 +72,8 @@ spec: - --workload-cluster-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig - --disable-status-controller - --machine-namespace=hcp-namespace + - --tls-min-version=VersionTLS12 + - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 command: - /usr/bin/machine-approver image: cluster-machine-approver diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml index 1ac7c5325d0b..ffbbfa8b0746 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/GCP/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml @@ -72,6 +72,8 @@ spec: - --workload-cluster-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig - --disable-status-controller - --machine-namespace=hcp-namespace + - --tls-min-version=VersionTLS12 + - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 command: - /usr/bin/machine-approver image: cluster-machine-approver diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml index 3b4d3565e692..53f258d6db35 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/IBMCloud/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml @@ -72,6 +72,8 @@ spec: - --workload-cluster-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig - --disable-status-controller - --machine-namespace=hcp-namespace + - --tls-min-version=VersionTLS12 + - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 command: - /usr/bin/machine-approver image: cluster-machine-approver diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml index 4a1aaf2dd634..821e293ea760 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml @@ -72,6 +72,8 @@ spec: - --workload-cluster-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig - --disable-status-controller - --machine-namespace=hcp-namespace + - --tls-min-version=VersionTLS12 + - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 command: - /usr/bin/machine-approver image: cluster-machine-approver diff --git a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml index 4a1aaf2dd634..821e293ea760 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml +++ b/control-plane-operator/controllers/hostedcontrolplane/testdata/machine-approver/zz_fixture_TestControlPlaneComponents_machine_approver_deployment.yaml @@ -72,6 +72,8 @@ spec: - --workload-cluster-kubeconfig=/etc/kubernetes/kubeconfig/kubeconfig - --disable-status-controller - --machine-namespace=hcp-namespace + - --tls-min-version=VersionTLS12 + - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 command: - /usr/bin/machine-approver image: cluster-machine-approver diff --git a/control-plane-operator/controllers/hostedcontrolplane/v2/machine_approver/deployment.go b/control-plane-operator/controllers/hostedcontrolplane/v2/machine_approver/deployment.go index a44457a10708..76a08de956b5 100644 --- a/control-plane-operator/controllers/hostedcontrolplane/v2/machine_approver/deployment.go +++ b/control-plane-operator/controllers/hostedcontrolplane/v2/machine_approver/deployment.go @@ -2,7 +2,9 @@ package machineapprover import ( "fmt" + "strings" + "github.com/openshift/hypershift/support/config" component "github.com/openshift/hypershift/support/controlplane-component" "github.com/openshift/hypershift/support/util" @@ -12,8 +14,16 @@ import ( func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Deployment) error { hcp := cpContext.HCP + configuration := hcp.Spec.Configuration util.UpdateContainer(ComponentName, deployment.Spec.Template.Spec.Containers, func(c *corev1.Container) { c.Args = append(c.Args, fmt.Sprintf("--machine-namespace=%s", hcp.Namespace)) + + if tlsMinVersion := config.MinTLSVersion(configuration.GetTLSSecurityProfile()); tlsMinVersion != "" { + c.Args = append(c.Args, fmt.Sprintf("--tls-min-version=%s", tlsMinVersion)) + } + if cipherSuites := config.CipherSuites(configuration.GetTLSSecurityProfile()); len(cipherSuites) != 0 { + c.Args = append(c.Args, fmt.Sprintf("--tls-cipher-suites=%s", strings.Join(cipherSuites, ","))) + } }) return nil