Merge pull request #482 from Thealisyed/bump-to-4.22

NE-2743: Support centralized TLS security profiles for CDO metrics

Author: openshift-merge-bot[bot]

cmd/dns-operator/main.go

@@ -1,26 +1,33 @@
 package main
 
 import (
+	"context"
+	"crypto/tls"
 	"flag"
 	"os"
 
+	configv1 "github.com/openshift/api/config/v1"
+	configclient "github.com/openshift/client-go/config/clientset/versioned"
+	operatorcontroller "github.com/openshift/cluster-dns-operator/pkg/operator/controller"
+
 	"github.com/openshift/cluster-dns-operator/pkg/operator"
 	operatorconfig "github.com/openshift/cluster-dns-operator/pkg/operator/config"
 	statuscontroller "github.com/openshift/cluster-dns-operator/pkg/operator/controller/status"
 
 	"github.com/sirupsen/logrus"
 
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	ctrl "sigs.k8s.io/controller-runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client/config"
 	"sigs.k8s.io/controller-runtime/pkg/log/zap"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
 )
 
 const operatorNamespace = "openshift-dns-operator"
 
 func main() {
-	metricsserver.DefaultBindAddress = "127.0.0.1:60000"
+	metricsBindAddr := flag.String("metrics-bind-addr", "127.0.0.1:60000", "The TCP address for the metrics endpoint.")
+	metricsCertDir := flag.String("metrics-cert-dir", "", "The directory containing tls.crt and tls.key for the metrics endpoint.")
 
 	opts := zap.Options{
 		Development: true,
@@ -49,18 +56,53 @@ func main() {
 		logrus.Fatalf("KUBE_RBAC_PROXY_IMAGE environment variable is required")
 	}
 
+	kubeConfig, err := config.GetConfig()
+	if err != nil {
+		logrus.Fatalf("failed to get kube config: %v", err)
+	}
+
+	// Build TLS options for the operator metrics server from the
+	// cluster-wide TLS security profile when secure serving is enabled.
+	// NOTE: the TLS profile is read once at startup; runtime changes to
+	// APIServer.spec.tlsSecurityProfile require an operator restart.
+	var metricsTLSOpts []func(*tls.Config)
+	if *metricsCertDir != "" {
+		cfgClient, err := configclient.NewForConfig(kubeConfig)
+		if err != nil {
+			logrus.Fatalf("failed to create config client: %v", err)
+		}
+		apiServer, err := cfgClient.ConfigV1().APIServers().Get(context.TODO(), "cluster", metav1.GetOptions{})
+		var tlsSecurityProfile *configv1.TLSSecurityProfile
+		if err != nil {
+			logrus.Warningf("failed to get apiserver config, using Intermediate TLS profile: %v", err)
+		} else {
+			tlsSecurityProfile = apiServer.Spec.TLSSecurityProfile
+		}
+		profileSpec := operatorcontroller.TLSProfileSpecForSecurityProfile(tlsSecurityProfile)
+		tlsCfg, err := operatorcontroller.TLSConfigFromProfile(profileSpec)
+		if err != nil {
+			logrus.Fatalf("failed to build TLS config from profile: %v", err)
+		}
+		metricsTLSOpts = append(metricsTLSOpts, func(cfg *tls.Config) {
+			cfg.CipherSuites = tlsCfg.CipherSuites
+			cfg.MinVersion = tlsCfg.MinVersion
+			if len(tlsCfg.CurvePreferences) > 0 {
+				cfg.CurvePreferences = tlsCfg.CurvePreferences
+			}
+		})
+	}
+
 	operatorConfig := operatorconfig.Config{
 		OperatorNamespace:      operatorNamespace,
 		OperatorReleaseVersion: releaseVersion,
 		CoreDNSImage:           coreDNSImage,
 		OpenshiftCLIImage:      cliImage,
 		KubeRBACProxyImage:     kubeRBACProxyImage,
+		MetricsBindAddress:     *metricsBindAddr,
+		MetricsCertDir:         *metricsCertDir,
+		MetricsTLSOpts:         metricsTLSOpts,
 	}
 
-	kubeConfig, err := config.GetConfig()
-	if err != nil {
-		logrus.Fatalf("failed to get kube config %v", err)
-	}
 	ctx := signals.SetupSignalHandler()
 	// Set up and start the operator.
 	op, err := operator.New(ctx, operatorConfig, kubeConfig)

go.mod

@@ -6,40 +6,47 @@ require (
 	github.com/apparentlymart/go-cidr v1.1.0
 	github.com/go-logr/logr v1.4.3
 	github.com/google/go-cmp v0.7.0
-	github.com/openshift/api v0.0.0-20251111193948-50e2ece149d7
+	github.com/openshift/api v0.0.0-20260615110019-261e3a0546f3
 	github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
-	github.com/openshift/client-go v0.0.0-20251015124057-db0dee36e235
+	github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1
 	github.com/openshift/coredns-ocp-dnsnameresolver/operator v0.0.0-20260211095308-1a5277b4db1c
 	github.com/openshift/library-go v0.0.0-20251119174848-88c26bf0df68
 	github.com/sirupsen/logrus v1.9.3
 	github.com/stretchr/testify v1.11.1
-	k8s.io/api v0.35.0
-	k8s.io/apimachinery v0.35.0
-	k8s.io/client-go v0.35.0
-	k8s.io/kubectl v0.35.0
+	k8s.io/api v0.35.1
+	k8s.io/apimachinery v0.35.1
+	k8s.io/client-go v0.35.1
+	k8s.io/kubectl v0.35.1
 	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
 	sigs.k8s.io/controller-runtime v0.23.1
 )
 
 require (
+	cel.dev/expr v0.24.0 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
+	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/emicklei/go-restful/v3 v3.12.2 // indirect
 	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
+	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fsnotify/fsnotify v1.9.0 // indirect
 	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/stdr v1.2.2 // indirect
 	github.com/go-logr/zapr v1.3.0 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/google/btree v1.1.3 // indirect
+	github.com/google/cel-go v0.26.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/imdario/mergo v0.3.12 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
@@ -53,14 +60,24 @@ require (
 	github.com/prometheus/common v0.66.1 // indirect
 	github.com/prometheus/procfs v0.16.1 // indirect
 	github.com/robfig/cron v1.2.0 // indirect
+	github.com/spf13/cobra v1.10.0 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 // indirect
 	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.34.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.34.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
 	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.5.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
 	golang.org/x/mod v0.29.0 // indirect
 	golang.org/x/net v0.47.0 // indirect
 	golang.org/x/oauth2 v0.30.0 // indirect
@@ -71,16 +88,20 @@ require (
 	golang.org/x/time v0.9.0 // indirect
 	golang.org/x/tools v0.38.0 // indirect
 	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250303144028-a0af3efb3deb // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
+	google.golang.org/grpc v1.72.2 // indirect
 	google.golang.org/protobuf v1.36.8 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/apiextensions-apiserver v0.35.0 // indirect
-	k8s.io/apiserver v0.35.0 // indirect
-	k8s.io/component-base v0.35.0 // indirect
+	k8s.io/apiextensions-apiserver v0.35.1 // indirect
+	k8s.io/apiserver v0.35.1 // indirect
+	k8s.io/component-base v0.35.1 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
-	k8s.io/kube-aggregator v0.35.0 // indirect
+	k8s.io/kube-aggregator v0.35.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.31.2 // indirect
 	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
 	sigs.k8s.io/kube-storage-version-migrator v0.0.6-0.20230721195810-5c8923c5ff96 // indirect
 	sigs.k8s.io/randfill v1.0.0 // indirect