TRT-2858: Revert "Merge pull request #1196 from ingvagabund/tls-injection-to-console"

[redhat-chai-bot]

What

Reverts #1196 (feat: inject centralized TLS into console operand).

Why

PR #1196 injects an unsupported servingInfo.minTLSVersion config value, causing every console pod to crash at startup with:

Failed to load config: servingInfo.minTLSVersion is not supported

This breaks all 16 blocking jobs in the 5.0 nightly payload 5.0.0-0.nightly-2026-07-28-081944 — the 4th consecutive rejection. Install jobs time out waiting for the console operator; upgrade jobs stall when the console PDB blocks master node drain. Identical crash observed across all platforms (AWS, Azure, GCP, metal, HyperShift, SNO).

Confidence: 100% — new failure mode, sole console-operator PR in the payload, error message directly references the field added by the PR.

Tracking

• Jira: TRT-2858

---

@smg247 requested in Slack thread

Summary by CodeRabbit

• Improvements
  • Updated console access permissions to read the cluster configuration resources required for operation.
  • Simplified console configuration by removing TLS settings from generated console configuration.
  • Console TLS behavior now follows the platform’s standard configuration rather than values supplied through observed console configuration.

[coderabbitai]

Walkthrough

The operator removes centralized TLS observation and injection, updates related RBAC permissions, simplifies console configuration builders, and adjusts tests and startup wiring.

Changes

TLS configuration injection removal

Layer / File(s)	Summary
Configuration API permissions manifests/03-rbac-role-cluster.yaml	The ClusterRole resource list changes from apiservers to selected config.openshift.io resources while retaining read-only verbs.
Observer and synchronization removal pkg/console/configobservation/..., pkg/console/operator/sync_v400.go, pkg/console/operator/sync_v400_test.go, pkg/console/starter/starter.go	Config observer definitions and startup wiring are removed, and TLS values are no longer read from Console.spec.observedConfig.
Console configuration builder changes pkg/console/subresource/configmap/*, pkg/console/subresource/consoleserver/*	TLS builder inputs, TLSConfig, generated TLS assignments, and TLS injection tests are removed; remaining ConfigMap callers are updated.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

• openshift/console-operator#1196: Adds the centralized TLS injection plumbing removed by this PR.

Suggested labels: jira/valid-reference

Suggested reviewers: spadgett, leo6leo

🚥 Pre-merge checks | ✅ 14 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The description covers what, why, and tracking, but omits most required template sections.	Add the missing Analysis/Root cause, Solution description, Test setup, Test cases, Browser conformance, Additional info, and Reviewers/assignees sections.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	No test titles were added or changed; the touched tests use static function/subtest names and no dynamic identifiers or Ginkgo-style titles.
Test Structure And Quality	✅ Passed	No Ginkgo specs were changed; the modified tests are plain table-driven Go unit tests, so the Ginkgo quality check is not applicable.
Microshift Test Compatibility	✅ Passed	No new Ginkgo e2e specs were added; changed files are unit tests, controller code, and manifests, with no MicroShift-incompatible test additions.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	No new Ginkgo e2e tests were added; touched tests are unit tests with no multi-node or SNO-specific assumptions.
Topology-Aware Scheduling Compatibility	✅ Passed	No changed manifest, controller, or deployment code adds topology-sensitive scheduling constraints; edits only remove TLS/observer wiring and adjust RBAC/config builders.
Ote Binary Stdout Contract	✅ Passed	No new stdout writes were added in process-level code; the diff only removes TLS observer/config builder wiring, and no main/init/TestMain stdout calls appear in changed files.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	Only unit-test and library changes are present; no new Ginkgo e2e tests or IPv4/public-internet dependencies were added.
No-Weak-Crypto	✅ Passed	No MD5/SHA1/DES/RC4/3DES/Blowfish/ECB, custom crypto, or secret/token comparison issues were introduced in the touched files.
Container-Privileges	✅ Passed	No changed manifest or code line adds privileged settings; the only YAML change is RBAC rules, and diff searches found no hostPID/privileged/allowPrivilegeEscalation/root flags.
No-Sensitive-Data-In-Logs	✅ Passed	PASS: The commit only removes TLS config plumbing; diff scan found no added log statements or new logging of secrets/PII in touched files.
Title check	✅ Passed	The title clearly matches the main change and includes the required Jira prefix.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[smg247]

/override ci/prow/e2e-aws-console
/override ci/prow/e2e-aws-operator
/override ci/prow/e2e-azure-ovn-upgrade
/override ci/prow/e2e-gcp-ovn

[openshift-ci]

@smg247: Overrode contexts on behalf of smg247: ci/prow/e2e-aws-console, ci/prow/e2e-aws-operator, ci/prow/e2e-azure-ovn-upgrade, ci/prow/e2e-gcp-ovn

Details

In response to this:

/override ci/prow/e2e-aws-console
/override ci/prow/e2e-aws-operator
/override ci/prow/e2e-azure-ovn-upgrade
/override ci/prow/e2e-gcp-ovn

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[stbenjam]

/lgtm

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: redhat-chai-bot, stbenjam
Once this PR has been reviewed and has the lgtm label, please assign jhadvig for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[smg247]

/verified bypass

[openshift-ci-robot]

@smg247: The verified label has been added.

Details

In response to this:

/verified bypass

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[smg247]

/retitle TRT-2858: Revert "Merge pull request #1196 from ingvagabund/tls-injection-to-console"

[openshift-ci-robot]

@redhat-chai-bot: This pull request references TRT-2858 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set.

Details

In response to this:

What

Reverts #1196 (feat: inject centralized TLS into console operand).

Why

PR #1196 injects an unsupported servingInfo.minTLSVersion config value, causing every console pod to crash at startup with:

Failed to load config: servingInfo.minTLSVersion is not supported

This breaks all 16 blocking jobs in the 5.0 nightly payload 5.0.0-0.nightly-2026-07-28-081944 — the 4th consecutive rejection. Install jobs time out waiting for the console operator; upgrade jobs stall when the console PDB blocks master node drain. Identical crash observed across all platforms (AWS, Azure, GCP, metal, HyperShift, SNO).

Confidence: 100% — new failure mode, sole console-operator PR in the payload, error message directly references the field added by the PR.

Tracking

• Jira: TRT-2858

---

@smg247 requested in Slack thread

Summary by CodeRabbit

• Improvements
• Updated console access permissions to read the cluster configuration resources required for operation.
• Simplified console configuration by removing TLS settings from generated console configuration.
• Console TLS behavior now follows the platform’s standard configuration rather than values supplied through observed console configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[smg247]

/label approved
/label docs-approved
/label px-approved

[openshift-ci]

@redhat-chai-bot: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

@redhat-chai-bot: This PR was included in a payload test run from openshift/cluster-version-operator#1435
trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command

• periodic-ci-openshift-release-main-ci-5.0-e2e-aws-upgrade-ovn-single-node

See details on https://pr-payload-tests.ci.openshift.org/runs/ci/f0afade0-8aa8-11f1-8113-af31792b0819-0