Skip to content

COO-1553: feat: bind the tls profile with the ui plugin deployments#1056

Open
jgbernalp wants to merge 1 commit intorhobs:mainfrom
jgbernalp:bind-tls-profile-with-ui-plugins
Open

COO-1553: feat: bind the tls profile with the ui plugin deployments#1056
jgbernalp wants to merge 1 commit intorhobs:mainfrom
jgbernalp:bind-tls-profile-with-ui-plugins

Conversation

@jgbernalp
Copy link
Copy Markdown
Member

@jgbernalp jgbernalp commented Apr 16, 2026

Fixes: COO-1553

This PR binds the cluster TLS profile to the plugins, we added a flag in the compatibility matrix as not all the plugins support the command line args yet. We will be setting the value when the upstream plugin images are ready. Then we can completely remove the check when all the plugins support the TLS configuration.

Signed-off-by: Gabriel Bernal <gbernal@redhat.com>
@openshift-ci-robot
Copy link
Copy Markdown
Collaborator

openshift-ci-robot commented Apr 16, 2026

@jgbernalp: This pull request references COO-1553 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Fixes: COO-1553

This PR binds the cluster TLS profile to the plugins, we added a flag in the compatibility matrix as not all the plugins support the command line args yet. We will be setting the value when the upstream plugin images are ready. Then we can completely remove the check when all the plugins support the TLS configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@openshift-ci
Copy link
Copy Markdown

openshift-ci bot commented Apr 16, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jgbernalp

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot
Copy link
Copy Markdown
Collaborator

openshift-ci-robot commented Apr 16, 2026

@jgbernalp: This pull request references COO-1553 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the task to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Fixes: COO-1553

This PR binds the cluster TLS profile to the plugins, we added a flag in the compatibility matrix as not all the plugins support the command line args yet. We will be setting the value when the upstream plugin images are ready. Then we can completely remove the check when all the plugins support the TLS configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

@coderabbitai
Copy link
Copy Markdown

coderabbitai bot commented Apr 16, 2026

📝 Walkthrough

Walkthrough

This pull request introduces TLS profile support to the UI plugin controller system. A new SupportsTLSProfile boolean field was added to CompatibilityEntry to declare plugin TLS capability. The UIPluginInfo struct now includes TLSMinVersion and TLSCiphers fields. The operator initializes the controller's UIPluginsConfiguration with the cluster's TLS profile spec. The deployment generation logic conditionally appends -tls-min-version and -tls-cipher-suites command-line arguments when configured. The plugin info builder applies TLS settings to plugins marked as supporting TLS profiles, with informational logging for unsupported plugins.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (2 passed)
Check name Status Explanation
Title check ✅ Passed The pull request title accurately summarizes the main change: binding the cluster TLS profile to UI plugin deployments, which is the primary objective across all modified files.
Description check ✅ Passed The pull request description clearly references COO-1553 and explains the changes: binding cluster TLS profile to plugins with a compatibility matrix flag for plugins not yet supporting TLS command-line arguments.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@jgbernalp jgbernalp requested review from simonpasquier and removed request for marioferh April 16, 2026 15:46
switch plugin.Spec.Type {
case uiv1alpha1.TypeDashboards:
return createDashboardsPluginInfo(plugin, namespace, plugin.Name, image)
pluginInfo, err = createDashboardsPluginInfo(plugin, namespace, plugin.Name, image)
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

(nit) I'd rather see an early exit in case of error.

Suggested change
pluginInfo, err = createDashboardsPluginInfo(plugin, namespace, plugin.Name, image)
pluginInfo, err = createDashboardsPluginInfo(plugin, namespace, plugin.Name, image)
if err != nil {
return nil, err
}

return nil, fmt.Errorf("plugin type not supported: %s", plugin.Spec.Type)
}

if pluginInfo != nil {
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

related to my other comment above: if we return early on error, we don't have to check for nil pluginInfo.

Comment thread pkg/operator/operator.go
return nil, fmt.Errorf("failed to fetch TLS profile from cluster: %w", err)
}

cfg.UIPlugins.TLSProfile = initialTLSProfileSpec
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it can be fixed later but it feels like the TLS Profile configuration should be injected by main() just like the other options.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants