Apply cluster TLS security profile to packageserver serving options#3849
Apply cluster TLS security profile to packageserver serving options#3849tmshort wants to merge 1 commit into
Conversation
Read the OpenShift APIServer CR at startup to apply the cluster-wide TLS security profile (min version and cipher suites) to the packageserver's SecureServingOptions when --tls-min-version is not already set via flags. Includes a 30s timeout on the API lookup and fails closed if the profile cannot be applied. Adds RBAC to allow reading apiservers.config.openshift.io. Signed-off-by: Todd Short <tshort@redhat.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
There was a problem hiding this comment.
Pull request overview
This PR updates the packageserver startup flow to honor OpenShift’s cluster-wide TLS security profile by reading the APIServer config (apiservers.config.openshift.io/cluster) at boot and applying the resulting min TLS version and cipher suites to the packageserver’s SecureServingOptions when --tls-min-version is not explicitly set.
Changes:
- Build a REST client config earlier in packageserver startup and (when
--tls-min-versionis unset) fetch/apply the cluster TLS security profile with a 30s timeout. - Add a helper to detect OpenShift config API availability and apply the derived TLS settings to serving options.
- Extend RBAC in upstream quickstart and Helm CSV template to allow
getonapiservers.config.openshift.io.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.
| File | Description |
|---|---|
| pkg/package-server/server/server.go | Applies OpenShift cluster TLS profile to packageserver secure serving options during startup. |
| deploy/upstream/quickstart/olm.yaml | Grants packageserver RBAC to get the OpenShift APIServer config object. |
| deploy/chart/templates/_packageserver.clusterserviceversion.yaml | Grants packageserver RBAC to get the OpenShift APIServer config object in the Helm-generated CSV. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| minVersion, cipherSuites := olmapiserver.GetSecurityProfileConfig(apiServer.Spec.TLSSecurityProfile) | ||
| serving.MinTLSVersion = libcrypto.TLSVersionToNameOrDie(minVersion) | ||
| serving.CipherSuites = libcrypto.CipherSuitesToNamesOrDie(cipherSuites) | ||
| log.Infof("Applying cluster TLS security profile: minVersion=%s cipherSuites=%v", serving.MinTLSVersion, serving.CipherSuites) | ||
| return nil |
| - "config.openshift.io" | ||
| resources: | ||
| - apiservers | ||
| verbs: | ||
| - get |
| - "config.openshift.io" | ||
| resources: | ||
| - apiservers | ||
| verbs: | ||
| - get |
Read the OpenShift APIServer CR at startup to apply the cluster-wide TLS security profile (min version and cipher suites) to the packageserver's SecureServingOptions when --tls-min-version is not already set via flags. Includes a 30s timeout on the API lookup and fails closed if the profile cannot be applied. Adds RBAC to allow reading apiservers.config.openshift.io.
This ought to complete the upstream portion of TLS profiles (not including curves). The existing catalog and olm operators also directly read the OpenShift API.
Description of the change:
Motivation for the change:
Architectural changes:
Testing remarks:
Reviewer Checklist
/doc[FLAKE]are truly flaky and have an issue