OLS-2459 propagate APIServer TLS profile to olsconfig#1604
Conversation
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
| "minTLSVersion": Equal(string(configv1.TLSProfiles[configv1.TLSProfileModernType].MinTLSVersion)), | ||
| })))) | ||
|
|
||
| apiServer.Spec.TLSSecurityProfile = nil |
There was a problem hiding this comment.
In case of failure above this may not run - may be we can use DeferCleanup func @onmete
When the OLSConfig CR does not specify a TLS security profile, read it from the cluster APIServer CR instead of falling back to hardcoded Intermediate defaults. Add an APIServer watch so the reconciler picks up profile changes automatically. Also fix a Makefile typo where the ImageStream CRD copy target was overwriting the APIServer CRD file. Co-authored-by: Cursor <cursoragent@cursor.com>
onmete
force-pushed
the
OLS-2459-apiserver-tls-profile
branch
from
54a7e06 to
d5f3cf5
Compare
|
@onmete: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
Summary
tlsSecurityProfile, the operator now reads the cluster-wide TLS profile from theAPIServerCR (config.openshift.io/v1, namecluster) and writes it into the generatedolsconfig.yaml. Falls back to Intermediate defaults if neither source has a profile.APIServerwatch toSetupWithManagerwith a predicate that only triggers reconciliation whenSpec.TLSSecurityProfilechanges on theclusterobject. The existing ConfigMap hash annotation mechanism handles the pod restart.Companion to openshift/lightspeed-service#2921 (service-side Postgres TLS hardening).
Test plan
appserverunit tests pass (106 specs, 79.2% coverage)should generate configmap with TLS profile from APIServer when CR has none— sets Modern profile on APIServer, leaves CR nil, asserts generated config uses Moderncontroller,console,lcore,postgres,utils,watchers,tls)Made with Cursor