Skip to content

OCPNETUI-63: Support custom TLS settings in the Helm charts #467

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rszwajko wants to merge 1 commit into from
+20 −7
Closed

OCPNETUI-63: Support custom TLS settings in the Helm charts #467

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions charts/openshift-console-plugin/templates/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,15 @@ data:
listen [::]:{{ .Values.plugin.port }} ssl;
ssl_certificate /var/cert/tls.crt;
ssl_certificate_key /var/cert/tls.key;
{{- if .Values.tls.protocols }}
ssl_protocols {{ .Values.tls.protocols }};
{{- end }}
{{- if .Values.tls.ciphers }}
ssl_ciphers {{ .Values.tls.ciphers }};
{{- end }}
{{- if .Values.tls.preferServerCiphers }}
ssl_prefer_server_ciphers {{ .Values.tls.preferServerCiphers }};
{{- end }}
Comment on lines +22 to +30

@coderabbitai coderabbitai Bot Aug 11, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- chart files ---'
git ls-files charts/openshift-console-plugin | sed -n '1,120p'

printf '%s\n' '--- values.yaml ---'
cat -n charts/openshift-console-plugin/values.yaml

printf '%s\n' '--- configmap.yaml ---'
cat -n charts/openshift-console-plugin/templates/configmap.yaml

printf '%s\n' '--- TLS references in the chart ---'
rg -n --glob '*.yaml' --glob '*.yml' --glob '*.tpl' 'tls|ssl_protocols|ssl_ciphers|ssl_prefer_server_ciphers' charts/openshift-console-plugin

Repository: openshift/networking-console-plugin

Length of output: 5157

🏁 Script executed:

#!/bin/bash
set -eu

printf '%s\n' '--- all chart value and TLS references ---'
rg -n --hidden --glob '!charts/openshift-console-plugin/templates/configmap.yaml' \
  --glob '!charts/openshift-console-plugin/.helmignore' \
  '(^|[[:space:]])tls([.:]|:|$)|preferServerCiphers|ssl_protocols|ssl_ciphers|ssl_prefer_server_ciphers' .

printf '%s\n' '--- chart metadata and documentation files ---'
cat -n charts/openshift-console-plugin/Chart.yaml
git ls-files | rg '(^|/)(README|values)([^/]*)?$|charts/openshift-console-plugin'

printf '%s\n' '--- default-value path probe ---'
python3 - <<'PY'
from pathlib import Path

values = Path("charts/openshift-console-plugin/values.yaml").read_text()
paths = []
stack = []
for line in values.splitlines():
    if not line.strip() or line.lstrip().startswith("#") or line.strip() == "---":
        continue
    indent = len(line) - len(line.lstrip())
    key, sep, value = line.strip().partition(":")
    if not sep:
        continue
    while stack and stack[-1][0] >= indent:
        stack.pop()
    path = ".".join([item[1] for item in stack] + [key])
    if value.strip():
        paths.append(path)
    else:
        stack.append((indent, key))

template = Path("charts/openshift-console-plugin/templates/configmap.yaml").read_text()
for path in (
    "tls.protocols",
    "tls.ciphers",
    "tls.preferServerCiphers",
    "plugin.tls.protocols",
    "plugin.tls.ciphers",
    "plugin.tls.preferServerCiphers",
):
    print(f"{path}: {'defined' if path in paths else 'undefined'}")

print("template paths:")
for line in template.splitlines():
    if ".Values." in line and ("tls" in line or "ssl_" in line):
        print(line.strip())
PY

Repository: openshift/networking-console-plugin

Length of output: 2133

Read TLS values from the plugin scope.

The default values and user overrides are defined under .Values.plugin.tls, but these conditions and directives use .Values.tls.*. The rendered NGINX configuration therefore omits all three TLS settings. Change each reference to .Values.plugin.tls.*.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@charts/openshift-console-plugin/templates/configmap.yaml` around lines 22 -
30, Update the TLS configuration block to read protocols, ciphers, and
preferServerCiphers from .Values.plugin.tls instead of .Values.tls, preserving
the existing conditional rendering and NGINX directives.

root /usr/share/nginx/html;
}
}
18 changes: 11 additions & 7 deletions charts/openshift-console-plugin/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,15 @@
---
plugin:
name: ""
description: ""
image: ""
name: ''
description: ''
image: ''
imagePullPolicy: IfNotPresent
replicas: 2
port: 9443
tls:
protocols: 'TLSv1.2 TLSv1.3'
ciphers: 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305'
preferServerCiphers: 'on'
securityContext:
enabled: true
podSecurityContext:
Expand All @@ -24,19 +28,19 @@ plugin:
cpu: 10m
memory: 50Mi
basePath: /
certificateSecretName: ""
certificateSecretName: ''
serviceAccount:
create: true
annotations: {}
name: ""
name: ''
patcherServiceAccount:
create: true
annotations: {}
name: ""
name: ''
jobs:
patchConsoles:
enabled: true
image: "registry.redhat.io/openshift4/ose-tools-rhel8@sha256:e44074f21e0cca6464e50cb6ff934747e0bd11162ea01d522433a1a1ae116103"
image: 'registry.redhat.io/openshift4/ose-tools-rhel8@sha256:e44074f21e0cca6464e50cb6ff934747e0bd11162ea01d522433a1a1ae116103'
podSecurityContext:
enabled: true
runAsNonRoot: true
Expand Down