Conversation
ugiordan
requested review from
MortalHappiness,
andrewsykim,
kevin85421 and
rueian
as code owners
June 19, 2026 15:10
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
ugiordan
force-pushed
the
tls-profile-upstream
branch
from
June 19, 2026 15:23
5ff3ccc to
c13d4c4
Compare
ugiordan
force-pushed
the
tls-profile-upstream
branch
from
June 19, 2026 15:45
c13d4c4 to
e2e3932
Compare
ugiordan
force-pushed
the
tls-profile-upstream
branch
4 times, most recently
from
June 24, 2026 09:41
456dc60 to
7342c58
Compare
4 tasks
ugiordan
force-pushed
the
tls-profile-upstream
branch
from
July 15, 2026 17:47
7342c58 to
4690bae
Compare
ugiordan
force-pushed
the
tls-profile-upstream
branch
from
July 27, 2026 07:28
54193e6 to
056577f
Compare
ugiordan
force-pushed
the
tls-profile-upstream
branch
from
July 27, 2026 07:46
056577f to
1cc66ab
Compare
Read the cluster-wide TLS security profile from apiservers.config.openshift.io/cluster at startup and apply MinVersion, CipherSuites, and NextProtos to the metrics server TLS config. On non-OpenShift clusters or when the API is temporarily unavailable, fall back to hardened Intermediate defaults (TLS 1.2, ECDHE AEAD ciphers, ALPN h2/http1.1). Transient errors (503, timeout, 429, context deadline) are handled gracefully. Non-transient errors (including 403 Forbidden from missing RBAC) crash the operator so kubelet restarts it until the configuration is correct. Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
force-pushed
the
tls-profile-upstream
branch
from
August 18, 2026 08:32
1cc66ab to
79e5ef9
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
Reviewed by Cursor Bugbot for commit 79e5ef9. Configure here.
| "ECDHE-RSA-CHACHA20-POLY1305-SHA256": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, | ||
| "ECDHE-ECDSA-CHACHA20-POLY1305": tls.TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, | ||
| "ECDHE-RSA-CHACHA20-POLY1305": tls.TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, | ||
| } |
There was a problem hiding this comment.
Custom cipher map is incomplete
Medium Severity
openSSLToGoCipher only maps GCM and ChaCha20 ECDHE suites. Go-supported suites that still appear in OpenShift custom or Old profiles (for example CBC SHA and RSA GCM names) are dropped. A custom profile can therefore lose most of its intended ciphers, or fail startup if every listed cipher is treated as unsupported.
Reviewed by Cursor Bugbot for commit 79e5ef9. Configure here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
apiservers.config.openshift.io/clusterat startupray-operator/pkg/tls/using typedconfigv1.APIServerobjects (openshift/api already a dependency)config.openshift.io/apiservers(get/list/watch)Motivation
OCP 5.0 requires all components to honor the centralized TLS profile. The kuberay operator already imports openshift/api (for routes). This PR extends that to also read the cluster TLS security posture, ensuring the operator's metrics endpoint uses the correct TLS version and cipher suites configured by the cluster admin.
On non-OpenShift clusters, the code gracefully falls back to hardened defaults (TLS 1.2, Intermediate cipher set).
Reference: openshift/cluster-machine-approver #286
Test plan
go build ./...passesgo test ./pkg/tls/... -vpasses (9 table-driven tests)make manifestsregenerated RBAC