HPCASE-208:Add TLSAdherencePolicy helper by richardsonnick · Pull Request #2114 · openshift/library-go

richardsonnick · 2026-02-04T14:54:27Z

Add ShouldHonorClusterTLSProfile helper for TLS adherence policy

Adds a helper function that encapsulates the logic for determining
whether a component should honor the cluster-wide TLS security profile
from apiserver.config.openshift.io/cluster.

This function handles:

Empty/unset values (treated as LegacyExternalAPIServerComponentsOnly)
LegacyExternalAPIServerComponentsOnly (returns false)
StrictAllComponents (returns true)
Unknown enum values (returns true for forward compatibility)

Component implementors should use this helper rather than checking
tlsAdherence field values directly, allowing coordinated changes to
the default semantic across all implementations.

See: https://github.com/openshift/enhancements/pull/XXXX

Relevant APIServer changes: openshift/api#2680

openshift-ci · 2026-02-04T14:54:55Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

richardsonnick · 2026-02-04T14:55:10Z

This will be a draft diff until openshift/api#2680 is landed. Since 2680 adds the TLSAdherencePolicy type

openshift-ci-robot · 2026-02-05T14:18:38Z

@richardsonnick: This pull request references HPCASE-208 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This helper gives us control on the behavior of consuming components without making changes to the APIServer CRD.

Relevant APIServer changes: openshift/api#2680

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot · 2026-03-04T21:09:08Z

@richardsonnick: This pull request references HPCASE-208 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Add ShouldHonorClusterTLSProfile helper for TLS adherence policy

Adds a helper function that encapsulates the logic for determining
whether a component should honor the cluster-wide TLS security profile
from apiserver.config.openshift.io/cluster.

This function handles:

Empty/unset values (treated as LegacyExternalAPIServerComponentsOnly)

LegacyExternalAPIServerComponentsOnly (returns false)

StrictAllComponents (returns true)

Unknown enum values (returns true for forward compatibility)

Component implementors should use this helper rather than checking
tlsAdherence field values directly, allowing coordinated changes to
the default semantic across all implementations.

See: https://github.com/openshift/enhancements/pull/XXXX

Relevant APIServer changes: openshift/api#2680

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

richardsonnick · 2026-03-04T21:34:27Z

/hold

richardsonnick · 2026-03-04T21:34:52Z

Tests will not pass until api changes are merged: openshift/api#2680

rhmdnd · 2026-03-17T11:34:50Z

/retest-required

openshift/api#2680 landed

damdo · 2026-03-17T13:43:16Z

@rhmdnd @richardsonnick this needs bumping of openshift/api in the go.mod here before being retestable.

Adds a helper function that encapsulates the logic for determining whether a component should honor the cluster-wide TLS security profile from apiserver.config.openshift.io/cluster. This function handles: - Empty/unset values (treated as LegacyAdheringComponentsOnly) - LegacyAdheringComponentsOnly (returns false) - StrictAllComponents (returns true) - Unknown enum values (returns true for forward compatibility)

rhmdnd · 2026-03-17T15:08:07Z

Bumping the deps in #2142

sdodson · 2026-03-18T13:12:20Z

/label approved

richardsonnick · 2026-03-18T13:23:24Z

/retest

openshift-ci · 2026-03-18T13:33:43Z

@richardsonnick: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

damdo

/lgtm

damdo · 2026-03-18T13:48:54Z

/tide refresh

openshift-ci · 2026-03-18T13:53:36Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: damdo, richardsonnick
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

damdo · 2026-03-18T13:57:32Z

/unhold

sdodson · 2026-03-18T14:02:03Z

/label approved

The function has been merged upstream in openshift/library-go#2114, so we can now use it directly and remove our local implementation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Nick Fox <nfox@redhat.com>

…hift (#1513) * Sync Istios with APIServer tlsProfile Adds a global TLSConfig for the operator that gets applied to all Istio resources. On OpenShift, when the operator first starts it will fetch TLS settings from the APIServer. When the APIServer TLS settings change the operator process will terminate forcing a restart. Signed-off-by: Nick Fox <nfox@redhat.com> * Use common tls lib to subscribe to APIServer changes Added [controller-runtime-common](https://github.com/openshift/controller-runtime-common) lib to handle watching the APIServer for changes. Signed-off-by: Nick Fox <nfox@redhat.com> * Fix linting errors Added licenses and fixed gosec complaints about minTLSVersion. Signed-off-by: Nick Fox <nfox@redhat.com> * Update to latest cr-common Updates the controller-runtime-common dep. Signed-off-by: Nick Fox <nfox@redhat.com> * Gate TLS profile syncing on APIServer tlsAdherence policy Only honor the cluster-wide TLS security profile when the APIServer's tlsAdherence field is set to StrictAllComponents. When it is unset or set to LegacyAdheringComponentsOnly, skip TLS profile syncing and the SecurityProfileWatcher entirely. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Nick Fox <nfox@redhat.com> * Use library-go ShouldHonorClusterTLSProfile instead of local copy The function has been merged upstream in openshift/library-go#2114, so we can now use it directly and remove our local implementation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Nick Fox <nfox@redhat.com> * Sync operator TLS config with OpenShift APIServer tlsAdherence policy Honor the APIServer tlsAdherence field (OCP 4.22+) to determine whether the operator should apply the cluster TLS profile to Istio and its own metrics server. Refactor TLS initialization into config.NewTLSConfigForOpenShift and add unit tests. Rewrite TLS profile change e2e tests to cover the three key scenarios: no-op when policy is unset, restart on adherence policy change, and restart on profile change under strict mode. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Nick Fox <nfox@redhat.com> * Refactor e2e tests to test for expected ciphers Rather than testing for the operator pod restarting which is just an implementation detail, the e2e tests now test that the Istio resource is properly setting the expected TLS settings when the TLS profile is set. The e2e tests now test the metrics endpoint directly for the same behavior. Signed-off-by: Nick Fox <nfox@redhat.com> * Use typed values Using typed values instead of the unstructred values for better type safety. Signed-off-by: Nick Fox <nfox@redhat.com> * Address copilot feedback Implement some cleanup suggestions by copilot. Signed-off-by: Nick Fox <nfox@redhat.com> --------- Signed-off-by: Nick Fox <nfox@redhat.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 4, 2026

richardsonnick mentioned this pull request Feb 4, 2026

Add TLS adherence feature gate openshift/api#2680

Merged

richardsonnick changed the title ~~Adds TLSAdherencePolicy helper.~~ HPCASE-208:Add TLSAdherencePolicy helper Feb 5, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Feb 5, 2026

richardsonnick marked this pull request as ready for review February 24, 2026 20:41

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 24, 2026

richardsonnick marked this pull request as draft February 24, 2026 20:42

openshift-ci Bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Feb 24, 2026

openshift-ci Bot requested review from bertinatto and p0lyn0mial February 24, 2026 20:43

richardsonnick marked this pull request as ready for review March 4, 2026 21:08

openshift-ci Bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 4, 2026

openshift-ci Bot requested a review from deads2k March 4, 2026 21:08

openshift-ci Bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 4, 2026

jstuever mentioned this pull request Mar 5, 2026

CCO-787: use apiserver tls config openshift/cloud-credential-operator#965

Merged

vladbologa mentioned this pull request Mar 12, 2026

ROX-33336: [Operator] Propagate cluster-wide TLS settings stackrox/stackrox#18864

Merged

9 tasks

richardsonnick force-pushed the tls-adherence-helper branch from f7ed2e2 to 8ede25a Compare March 17, 2026 13:58

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 18, 2026

damdo reviewed Mar 18, 2026

View reviewed changes

openshift-ci Bot assigned damdo Mar 18, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 18, 2026

openshift-ci Bot removed the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 18, 2026

openshift-ci Bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 18, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 18, 2026

openshift-merge-bot Bot merged commit 04979c7 into openshift:master Mar 18, 2026
4 checks passed

jzding mentioned this pull request Mar 19, 2026

Upgrade to Go 1.25 and update dependencies k8snetworkplumbingwg/ptp-operator#202

Merged

jzding mentioned this pull request Mar 27, 2026

CNF-21768: Add TLS adherence support k8snetworkplumbingwg/ptp-operator#206

Merged

Conversation

richardsonnick commented Feb 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci Bot commented Feb 4, 2026

Uh oh!

richardsonnick commented Feb 4, 2026

Uh oh!

openshift-ci-robot commented Feb 5, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

openshift-ci-robot commented Mar 4, 2026 • edited by openshift-ci Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

richardsonnick commented Mar 4, 2026

Uh oh!

richardsonnick commented Mar 4, 2026

Uh oh!

rhmdnd commented Mar 17, 2026

Uh oh!

damdo commented Mar 17, 2026

Uh oh!

rhmdnd commented Mar 17, 2026

Uh oh!

sdodson commented Mar 18, 2026

Uh oh!

richardsonnick commented Mar 18, 2026

Uh oh!

openshift-ci Bot commented Mar 18, 2026

Uh oh!

damdo left a comment

Choose a reason for hiding this comment

Uh oh!

damdo commented Mar 18, 2026

Uh oh!

openshift-ci Bot commented Mar 18, 2026

Uh oh!

damdo commented Mar 18, 2026

Uh oh!

sdodson commented Mar 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

richardsonnick commented Feb 4, 2026 •

edited

Loading

openshift-ci-robot commented Feb 5, 2026 •

edited by openshift-ci Bot

Loading

openshift-ci-robot commented Mar 4, 2026 •

edited by openshift-ci Bot

Loading