Skip to content

TRT-2858: Revert "Merge pull request #1196 from ingvagabund/tls-injection-to-console" #1200

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Jul 28, 2026
Merged

TRT-2858: Revert "Merge pull request #1196 from ingvagabund/tls-injection-to-console" #1200

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion manifests/03-rbac-role-cluster.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,6 @@ rules:
- apiGroups:
- config.openshift.io
resources:
- apiservers
- authentications
- oauths
- infrastructures
Expand Down
54 changes: 0 additions & 54 deletions pkg/console/configobservation/configobservercontroller/observe_config_controller.go
View file
Open in desktop

This file was deleted.

26 changes: 0 additions & 26 deletions pkg/console/configobservation/listers.go
View file
Open in desktop

This file was deleted.

33 changes: 0 additions & 33 deletions pkg/console/operator/sync_v400.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@ package operator

import (
"context"
"encoding/json"
"fmt"
"net/url"
"os"
Expand Down Expand Up @@ -445,11 +444,6 @@ func (co *consoleOperator) SyncConfigMap(
}
}

tlsMinVersion, tlsCiphers, tlsErr := getTLSConfigFromObservedConfig(operatorConfig)
if tlsErr != nil {
return nil, "FailedGetTLSConfig", tlsErr
}

defaultConfigmap, _, err := configmapsub.DefaultConfigMap(
operatorConfig,
consoleConfig,
Expand All @@ -468,8 +462,6 @@ func (co *consoleOperator) SyncConfigMap(
techPreviewEnabled,
olmLifecycleMetadataEnabled,
additionalHosts,
tlsMinVersion,
tlsCiphers,
)
if err != nil {
return nil, "FailedConsoleConfigBuilder", err
Expand Down Expand Up @@ -951,28 +943,3 @@ func (co *consoleOperator) syncSessionSecret(
})
return secret, err
}

// getTLSConfigFromObservedConfig reads TLS configuration from the Console CR's observedConfig field.
func getTLSConfigFromObservedConfig(operatorConfig *operatorv1.Console) (configv1.TLSProtocolVersion, []string, error) {
if operatorConfig == nil || operatorConfig.Spec.ObservedConfig.Raw == nil {
// Not an error - the config observer hasn't injected the config yet
return "", nil, nil
}

observedConfig := map[string]interface{}{}
if err := json.Unmarshal(operatorConfig.Spec.ObservedConfig.Raw, &observedConfig); err != nil {
return "", nil, fmt.Errorf("failed to unmarshal observedConfig: %w", err)
}

minTLSVersion, _, err := unstructured.NestedString(observedConfig, "servingInfo", "minTLSVersion")
if err != nil {
return "", nil, fmt.Errorf("failed to read servingInfo.minTLSVersion: %w", err)
}

cipherSuites, _, err := unstructured.NestedStringSlice(observedConfig, "servingInfo", "cipherSuites")
if err != nil {
return "", nil, fmt.Errorf("failed to read servingInfo.cipherSuites: %w", err)
}

return configv1.TLSProtocolVersion(minTLSVersion), cipherSuites, nil
}
115 changes: 0 additions & 115 deletions pkg/console/operator/sync_v400_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ import (
appsv1 "k8s.io/api/apps/v1"
v1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
appsv1listers "k8s.io/client-go/listers/apps/v1"
corev1listers "k8s.io/client-go/listers/core/v1"
"k8s.io/client-go/tools/cache"
Expand Down Expand Up @@ -730,117 +729,3 @@ func TestEvaluateDeploymentAvailability(t *testing.T) {
}
})
}

func mustMarshal(v interface{}) []byte {
data, err := json.Marshal(v)
if err != nil {
panic(err)
}
return data
}

func makeOperatorConfigWithObservedConfig(observedConfig runtime.RawExtension) *operatorv1.Console {
return &operatorv1.Console{
Spec: operatorv1.ConsoleSpec{
OperatorSpec: operatorv1.OperatorSpec{
ObservedConfig: observedConfig,
},
},
}
}

func TestGetTLSConfigFromObservedConfig(t *testing.T) {
tests := []struct {
name string
operatorConfig *operatorv1.Console
wantMinTLSVersion configv1.TLSProtocolVersion
wantCiphers []string
wantError bool
}{
{
name: "nil operator config returns empty values",
},
{
name: "nil observedConfig.Raw returns empty values",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{}),
},
{
name: "invalid JSON returns error",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{
Raw: []byte(`{invalid json}`),
}),
wantError: true,
},
{
name: "valid config with both minTLSVersion and cipherSuites",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{
Raw: mustMarshal(map[string]interface{}{
"servingInfo": map[string]interface{}{
"minTLSVersion": "VersionTLS12",
"cipherSuites": []string{
"TLS_AES_128_GCM_SHA256",
"TLS_AES_256_GCM_SHA384",
},
},
}),
}),
wantMinTLSVersion: configv1.VersionTLS12,
wantCiphers: []string{"TLS_AES_128_GCM_SHA256", "TLS_AES_256_GCM_SHA384"},
},
{
name: "valid config with only minTLSVersion",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{
Raw: mustMarshal(map[string]interface{}{
"servingInfo": map[string]interface{}{
"minTLSVersion": "VersionTLS13",
},
}),
}),
wantMinTLSVersion: configv1.VersionTLS13,
},
{
name: "valid config with only cipherSuites",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{
Raw: mustMarshal(map[string]interface{}{
"servingInfo": map[string]interface{}{
"cipherSuites": []string{"TLS_AES_128_GCM_SHA256"},
},
}),
}),
wantCiphers: []string{"TLS_AES_128_GCM_SHA256"},
},
{
name: "empty observedConfig returns empty values",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{
Raw: mustMarshal(map[string]interface{}{}),
}),
},
{
name: "observedConfig with no servingInfo returns empty values",
operatorConfig: makeOperatorConfigWithObservedConfig(runtime.RawExtension{
Raw: mustMarshal(map[string]interface{}{
"otherField": "value",
}),
}),
},
}

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
minTLSVersion, ciphers, err := getTLSConfigFromObservedConfig(tt.operatorConfig)

if (err != nil) != tt.wantError {
t.Errorf("getTLSConfigFromObservedConfig() error = %v, wantError %v", err, tt.wantError)
return
}

if minTLSVersion != tt.wantMinTLSVersion {
t.Errorf("getTLSConfigFromObservedConfig() minTLSVersion = %v, want %v", minTLSVersion, tt.wantMinTLSVersion)
}

if diff := deep.Equal(ciphers, tt.wantCiphers); diff != nil {
t.Errorf("getTLSConfigFromObservedConfig() ciphers diff: %v", diff)
}
})
}
}
10 changes: 0 additions & 10 deletions pkg/console/starter/starter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ import (
operatorv1 "github.com/openshift/api/operator/v1"
"github.com/openshift/console-operator/pkg/api"

"github.com/openshift/console-operator/pkg/console/configobservation/configobservercontroller"
"github.com/openshift/console-operator/pkg/console/controllers/clidownloads"
"github.com/openshift/console-operator/pkg/console/controllers/clioidcclientstatus"
"github.com/openshift/console-operator/pkg/console/controllers/downloadsdeployment"
Expand Down Expand Up @@ -636,14 +635,6 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle
logLevelController := loglevel.NewClusterOperatorLoggingController(operatorClient, controllerContext.EventRecorder)
managementStateController := managementstatecontroller.NewOperatorManagementStateController(api.ClusterOperatorName, operatorClient, controllerContext.EventRecorder)

// Config observer watches APIServer and writes TLS config to Console CR's observedConfig
configObserver := configobservercontroller.NewConfigObserver(
operatorClient,
configInformers,
resourceSyncer,
recorder,
)

for _, informer := range []interface {
Start(stopCh <-chan struct{})
}{
Expand Down Expand Up @@ -673,7 +664,6 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle
logLevelController,
managementStateController,
configUpgradeableController,
configObserver,
consoleServiceAccountController,
downloadsServiceAccountController,
consoleServiceController,
Expand Down
3 changes: 0 additions & 3 deletions pkg/console/subresource/configmap/configmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,8 +51,6 @@ func DefaultConfigMap(
techPreviewEnabled bool,
olmLifecycleMetadataEnabled bool,
additionalHosts []string,
tlsMinVersion configv1.TLSProtocolVersion,
tlsCiphers []string,
) (consoleConfigMap *corev1.ConfigMap, unsupportedOverridesHaveMerged bool, err error) {

apiServerURL := infrastructuresub.GetAPIServerURL(infrastructureConfig)
Expand Down Expand Up @@ -114,7 +112,6 @@ func DefaultConfigMap(
TechPreviewEnabled(techPreviewEnabled).
OLMLifecycleMetadataEnabled(olmLifecycleMetadataEnabled).
AdditionalHosts(additionalHosts).
TLSConfig(tlsMinVersion, tlsCiphers).
ConfigYAML()
if err != nil {
klog.Errorf("failed to generate user-defined console-config: %v", err)
Expand Down
8 changes: 3 additions & 5 deletions pkg/console/subresource/configmap/configmap_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1304,11 +1304,9 @@ providers: {}
tt.args.copiedCSVsDisabled,
tt.args.telemetryConfig,
tt.args.rt.Spec.Host,
false, // techPreviewEnabled - default to false for tests
false, // olmLifecycleMetadataEnabled - default to false for tests
nil, // additionalHosts
"", // tlsMinVersion - empty for legacy tests
[]string{}, // tlsCiphers - empty for legacy tests
false, // techPreviewEnabled - default to false for tests
false, // olmLifecycleMetadataEnabled - default to false for tests
nil, // additionalHosts
)

// marshall the exampleYaml to map[string]interface{} so we can use it in diff below
Expand Down
10 changes: 3 additions & 7 deletions pkg/console/subresource/configmap/tech_preview_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,10 +58,8 @@ func TestTechPreviewEnabled(t *testing.T) {
map[string]string{}, // telemetryConfig
"console.test.cluster", // consoleHost
tt.args.techPreviewEnabled,
false, // olmLifecycleMetadataEnabled
nil, // additionalHosts
"", // tlsMinVersion - empty for legacy tests
[]string{}, // tlsCiphers
false, // olmLifecycleMetadataEnabled
nil, // additionalHosts
)

if err != nil {
Expand Down Expand Up @@ -127,9 +125,7 @@ func TestOLMLifecycleMetadataEnabled(t *testing.T) {
"console.test.cluster", // consoleHost
false, // techPreviewEnabled
tt.args.olmLifecycleMetadataEnabled,
nil, // additionalHosts
"", // tlsMinVersion - empty for legacy tests
[]string{}, // tlsCiphers
nil, // additionalHosts
)

if err != nil {
Expand Down
Loading