IR-350: add tls security profile configuration for the image registry operator by ricardomaraschini · Pull Request #8011 · openshift/hypershift

ricardomaraschini · 2026-03-19T10:23:55Z

What this PR does / why we need it:

Configure the cluster-image-registry-operator to use the TLS security profile settings from the HostedCluster resource. This ensures the operator's serving endpoint uses ciphers and minimum TLS version that match the cluster's security requirements.

Implementation:

Add ConfigMap adapter to generate configv1.GenericControllerConfig with TLS settings derived from hcp.spec.configuration.apiServer.tlsSecurityProfile.
Mount the config and use it via --config flag on the operator deployment.
Reuse existing config.CipherSuites() and config.minTLSVersion() helper functions for consistency with other control plane components.

Special notes for your reviewer:

This PR is expected to fail as it depends on openshift/cluster-image-registry-operator#1297 being merged.

Checklist:

Subject and description added to both, commit and PR.
Relevant issues have been referenced.
This change includes docs.
This change includes unit tests.

Summary by CodeRabbit

New Features
- Registry operator now reads a deployed controller config to set its serving bind address (:60000) and honor configurable TLS security profiles and cipher suites.
- Deployment updated to load the controller config at startup.
Tests
- Added tests covering generation of controller config for various TLS profile variants (Intermediate, Modern, Old, Custom) and cipher handling.

openshift-ci-robot · 2026-03-19T10:23:59Z

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

openshift-ci · 2026-03-19T10:24:05Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

coderabbitai · 2026-03-19T10:24:49Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro

Run ID: 6af144fa-8c9a-4ec8-b03f-62ed61305130

📥 Commits

Reviewing files that changed from the base of the PR and between 6a2b484 and ecb7bea.

⛔ Files ignored due to path filters (15)

control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/AROSwift/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/GCP/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/IBMCloud/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/TechPreviewNoUpgrade/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_controlplanecomponent.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_cluster_image_registry_operator_deployment.yaml is excluded by !**/testdata/**
control-plane-operator/controllers/hostedcontrolplane/testdata/cluster-image-registry-operator/zz_fixture_TestControlPlaneComponents_image_registry_controller_config_configmap.yaml is excluded by !**/testdata/**

📒 Files selected for processing (5)

control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-image-registry-operator/controller-config.yaml
control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-image-registry-operator/deployment.yaml
control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/component.go
control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/configmap.go
control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/configmap_test.go

✅ Files skipped from review due to trivial changes (1)

control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-image-registry-operator/controller-config.yaml

🚧 Files skipped from review as they are similar to previous changes (2)

control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/component.go
control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/configmap.go

📝 Walkthrough

Walkthrough

This pull request adds a ConfigMap named image-registry-controller-config containing config.yaml for the cluster-image-registry-operator. The Deployment is updated to mount that ConfigMap and pass --config and --files pointing at the mounted file. The component registration was extended to include an adapter adaptControllerConfig which generates the YAML controller config from the HostedControlPlane TLS security profile. Tests cover generation for multiple TLS profile variants and preserve existing ConfigMap data.

Sequence Diagram(s)

sequenceDiagram
    participant HCP as HostedControlPlane controller
    participant Adapter as adaptControllerConfig
    participant CM as ConfigMap (image-registry-controller-config)
    participant K8s as Kubernetes API (Deployment/Pod)
    participant Operator as cluster-image-registry-operator

    HCP->>Adapter: provide WorkloadContext (HCP.Spec.Configuration)
    Adapter->>CM: create/modify Data["config.yaml"] (servingInfo, TLS settings)
    Adapter-->>HCP: return success/error
    CM->>K8s: stored via manifests (applied)
    K8s->>K8s: mount ConfigMap into Pod volume
    K8s->>Operator: start process with args --config=/var/run/configmaps/.../config.yaml --files=...
    Operator->>CM: read config file at startup
    Operator-->>K8s: operate using provided servingInfo/TLS settings

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

ricardomaraschini · 2026-03-19T12:12:43Z

@coderabbitai help

coderabbitai · 2026-03-19T12:12:52Z

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

CodeRabbit commands

These commands are invoked using PR/Issue comments.

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai evaluate custom pre-merge check --instructions <custom-checks-instructions> --name <custom-checks-title> [--mode <error|warning>] to validate the custom pre-merge checks instructions. Defaults to error when --mode is omitted.
- @coderabbitai ignore pre-merge checks to override pre-merge checks and get an approval on PR.
- @coderabbitai run pre-merge checks to run pre-merge checks on the pull request.
- @coderabbitai plan to generate a coding prompt for all unresolved human review comments in this PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai generate unit tests to generate unit tests for this PR.
@coderabbitai fix merge conflict to automatically resolve merge conflicts.
@coderabbitai autofix to automatically fix issues identified in unresolved review comments.
@coderabbitai resolve to resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai generate configuration to create a PR that adds the current resolved configuration as .coderabbit.yaml (or show it if already present).
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore or @coderabbit ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

Status, support, documentation and community

Visit our status page to check the current availability of CodeRabbit.
Create a ticket on our support page for assistance with any issues or questions.
Visit our documentation site for detailed information on how to use CodeRabbit.
Join our Discord community to connect with other users and get help from the community.
Follow us on X/Twitter for updates and announcements.

ricardomaraschini · 2026-03-19T12:13:14Z

@coderabbitai full review

coderabbitai · 2026-03-19T12:13:20Z

✅ Actions performed

Full review triggered.

configure the cluster-image-registry-operator to use the tls security profile settings from the hostedcontrolplane resource. this ensures the operator's serving endpoint uses ciphers and minimum tls version that match the cluster's security requirements. implementation: - add configmap adapter to generate genericcontrollerconfig with tls settings derived from hcp.spec.configuration.tlssecurityprofile - mount the config via --config flag on the operator deployment - reuse existing config.ciphersuites() and config.mintlsversion() helper functions for consistency with other control plane components

we have changed the image registry deployment and added a new config map to the equation. we need to regenerate the testdata to incorporate these changes.

openshift-ci · 2026-03-23T09:20:48Z

@ricardomaraschini: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

ricardomaraschini · 2026-03-23T09:36:07Z

/retest

openshift-ci-robot · 2026-03-23T11:29:18Z

@ricardomaraschini: This pull request references IR-350 which is a valid jira issue.

Details

In response to this:

What this PR does / why we need it:

Configure the cluster-image-registry-operator to use the TLS security profile settings from the HostedCluster resource. This ensures the operator's serving endpoint uses ciphers and minimum TLS version that match the cluster's security requirements.

Implementation:

Add ConfigMap adapter to generate configv1.GenericControllerConfig with TLS settings derived from hcp.spec.configuration.apiServer.tlsSecurityProfile.

Mount the config and use it via --config flag on the operator deployment.

Reuse existing config.CipherSuites() and config.minTLSVersion() helper functions for consistency with other control plane components.

Special notes for your reviewer:

This PR is expected to fail as it depends on openshift/cluster-image-registry-operator#1297 being merged.

Checklist:

Subject and description added to both, commit and PR.

Relevant issues have been referenced.

This change includes docs.

This change includes unit tests.

Summary by CodeRabbit

New Features

Registry operator now reads a deployed controller config to set its serving bind address (:60000) and honor configurable TLS security profiles and cipher suites.

Deployment updated to load the controller config at startup.

Tests

Added tests covering generation of controller config for various TLS profile variants (Intermediate, Modern, Old, Custom) and cipher handling.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/configmap.go

ingvagabund · 2026-03-23T11:57:41Z

control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/configmap.go

+		return fmt.Errorf("failed to json unmarshal config: %w", err)
+	}
+
+	asMap["apiVersion"] = configv1.GroupVersion.String()


Oh, configv1.GenericControllerConfig does not define metav1.TypeMeta field. Compared to GenericOperatorConfig.

You are right. I guess we could simply not set it out then.

It needs to be set so the CVO knows which kind it is. Otherwise, it's a blind guess. Also, no field to validate the kind and version against.

bryan-cox · 2026-03-23T12:21:37Z

/approve

openshift-ci · 2026-03-23T12:22:44Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bryan-cox, ricardomaraschini

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [bryan-cox]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 19, 2026

openshift-ci bot added do-not-merge/needs-area area/control-plane-operator Indicates the PR includes changes for the control plane operator - in an OCP release and removed do-not-merge/needs-area labels Mar 19, 2026

ricardomaraschini marked this pull request as ready for review March 20, 2026 11:30

openshift-ci bot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Mar 20, 2026

openshift-ci bot requested review from devguyio and sjenning March 20, 2026 11:30

ricardomaraschini added 2 commits March 23, 2026 08:57

chore: regenerate test data fixtures

ecb7bea

we have changed the image registry deployment and added a new config map to the equation. we need to regenerate the testdata to incorporate these changes.

ricardomaraschini force-pushed the pqc-image-registry branch from 6a2b484 to ecb7bea Compare March 23, 2026 07:57

ingvagabund mentioned this pull request Mar 23, 2026

CNTRLPLANE-2777: feat(resource builder): allow to inject tls configuration into annotated config maps openshift/cluster-version-operator#1322

Open

ricardomaraschini changed the title ~~feat(image-registry): add tls security profile configuration~~ IR-350: add tls security profile configuration for the image registry operator Mar 23, 2026

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Mar 23, 2026

bryan-cox reviewed Mar 23, 2026

View reviewed changes

control-plane-operator/controllers/hostedcontrolplane/v2/registryoperator/configmap.go Show resolved Hide resolved

ingvagabund reviewed Mar 23, 2026

View reviewed changes

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 23, 2026

Conversation

ricardomaraschini commented Mar 19, 2026 • edited by coderabbitai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

openshift-ci-robot commented Mar 19, 2026

Uh oh!

openshift-ci bot commented Mar 19, 2026

Uh oh!

coderabbitai bot commented Mar 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Sequence Diagram(s)

Uh oh!

ricardomaraschini commented Mar 19, 2026

Uh oh!

coderabbitai bot commented Mar 19, 2026

Chat

CodeRabbit commands

Other keywords and placeholders

Status, support, documentation and community

Uh oh!

ricardomaraschini commented Mar 19, 2026

Uh oh!

coderabbitai bot commented Mar 19, 2026

Uh oh!

openshift-ci bot commented Mar 23, 2026

Uh oh!

ricardomaraschini commented Mar 23, 2026

Uh oh!

openshift-ci-robot commented Mar 23, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What this PR does / why we need it:

Special notes for your reviewer:

Checklist:

Summary by CodeRabbit

Uh oh!

Uh oh!

ingvagabund Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

ricardomaraschini Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

ingvagabund Mar 23, 2026

Choose a reason for hiding this comment

Uh oh!

bryan-cox commented Mar 23, 2026

Uh oh!

openshift-ci bot commented Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ricardomaraschini commented Mar 19, 2026 •

edited by coderabbitai bot

Loading

coderabbitai bot commented Mar 19, 2026 •

edited

Loading

openshift-ci-robot commented Mar 23, 2026 •

edited by openshift-ci bot

Loading