CNTRLPLANE-3423: feat: inject centralized TLS into service-ca operand - #365
Conversation
openshift-ci-robot
added
the
jira/valid-reference
|
@ingvagabund: This pull request references CNTRLPLANE-3423 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (6)
🚧 Files skipped from review as they are similar to previous changes (4)
WalkthroughAdds TLS configuration observation for the service CA operator, renders observed settings into a controller ConfigMap, mounts that ConfigMap into the controller deployment, and triggers deployment updates when the generated configuration changes. ChangesService CA controller configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 Checkov (3.3.8)bindata/assets/controller-config.yamlTraceback (most recent call last): bindata/assets/deployment.yamlTraceback (most recent call last): Comment |
eb1000e to
613dcca
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@bindata/assets/deployment.yaml`:
- Around line 48-59: Harden the Kubernetes workload in deployment.yaml by adding
allowPrivilegeEscalation: false, readOnlyRootFilesystem: true,
capabilities.drop: ["ALL"], CPU and memory limits, and liveness/readiness probes
to the container specification. Set automountServiceAccountToken: false unless
the controller explicitly needs in-cluster API credentials, and add or ensure a
restrictive NetworkPolicy exists for the workload’s namespace.
In `@pkg/operator/sync_common.go`:
- Around line 256-260: Update the TLS field extraction in the surrounding sync
function to handle errors from NestedString and NestedStringSlice separately:
return the existing `(bool, error)` failure result immediately when either
lookup reports an error, while only adding fields when found and non-empty.
Follow the established early-return pattern used near the referenced
error-handling blocks, preserving normal behavior for absent valid fields.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: e4579948-7aee-4532-8a36-02e6f711b39d
⛔ Files ignored due to path filters (6)
vendor/github.com/openshift/library-go/pkg/operator/configobserver/apiserver/OWNERSis excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/configobserver/apiserver/listers.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/configobserver/apiserver/observe_audit.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/configobserver/apiserver/observe_cors.gois excluded by!**/vendor/**,!vendor/**vendor/github.com/openshift/library-go/pkg/operator/configobserver/apiserver/observe_tlssecurityprofile.gois excluded by!**/vendor/**,!vendor/**vendor/modules.txtis excluded by!**/vendor/**,!vendor/**
📒 Files selected for processing (7)
bindata/assets/controller-config.yamlbindata/assets/deployment.yamlgo.modpkg/operator/configobservation/configobserver_controller.gopkg/operator/starter.gopkg/operator/sync.gopkg/operator/sync_common.go
| - mountPath: /var/run/configmaps/config | ||
| name: config | ||
| volumes: | ||
| - name: signing-key | ||
| secret: | ||
| secretName: signing-key | ||
| - name: signing-cabundle | ||
| configMap: | ||
| name: signing-cabundle | ||
| - name: config | ||
| configMap: | ||
| name: service-ca-controller-config |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
Apply the required workload hardening controls.
This workload still lacks explicit allowPrivilegeEscalation: false, readOnlyRootFilesystem: true, capabilities.drop: ["ALL"], CPU/memory limits, and liveness/readiness probes. Also set automountServiceAccountToken: false unless this controller requires in-cluster API credentials, and ensure its namespace has a restrictive NetworkPolicy.
As per path instructions, Kubernetes workloads require these security controls, limits, probes, and least-privilege defaults.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@bindata/assets/deployment.yaml` around lines 48 - 59, Harden the Kubernetes
workload in deployment.yaml by adding allowPrivilegeEscalation: false,
readOnlyRootFilesystem: true, capabilities.drop: ["ALL"], CPU and memory limits,
and liveness/readiness probes to the container specification. Set
automountServiceAccountToken: false unless the controller explicitly needs
in-cluster API credentials, and add or ensure a restrictive NetworkPolicy exists
for the workload’s namespace.
Source: Path instructions
There was a problem hiding this comment.
Not in the scope of the PR
There was a problem hiding this comment.
@ingvagabund Understood—this hardening work is outside the scope of the centralized TLS configuration change. I’ll treat it as a follow-up rather than a blocker for this PR. Would you like me to open a GitHub issue to track it?
|
/retest-required |
1 similar comment
|
/retest-required |
To support cluster wide cryptographic policy aligning with a centralized TLS configuration.
613dcca to
11a6d83
Compare
"args": [
"--config=/var/run/configmaps/config/controller-config.yaml",
"--terminate-on-files=/var/run/configmaps/config/controller-config.yaml",
"-v=2"
], {
"apiVersion": "v1",
"data": {
"controller-config.yaml": "apiVersion: operator.openshift.io/v1alpha1\nkind: GenericOperatorConfig\nservingInfo:\n cipherSuites:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\n - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\n - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\n - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\n - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\n minTLSVersion: VersionTLS12\n"
},
"kind": "ConfigMap",
"metadata": {
"creationTimestamp": "2026-07-23T11:55:11Z",
"name": "service-ca-controller-config",
"namespace": "openshift-service-ca",
"resourceVersion": "5660",
"uid": "fd12dfa9-a6af-42a5-a0ff-9705a9c61b15"
}
},/verified by CI |
openshift-ci-robot
added
the
verified
|
@ingvagabund: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
@ingvagabund: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ricardomaraschini The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
|
/approved |
|
/hold |
openshift-ci
Bot
added
the
do-not-merge/hold
|
/lgtm |
|
/verified by @kaleemsiddiqu |
|
@kaleemsiddiqu: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/hold cancel |
openshift-ci
Bot
removed
the
do-not-merge/hold
4 participants
Operator part implemented in #359.
This covers the operand side as well.
Summary by CodeRabbit
New Features
Improvements