@@ -36,13 +36,6 @@ const (
3636 DeploymentTypeMicroservices DeploymentType = "MicroservicesDeployment"
3737)
3838
39- // TdxConfigSpec defines the desired state for TDX configuration
40- type TdxConfigSpec struct {
41- // kbsTdxConfigMapName is the name of the configmap containing sgx_default_qcnl.conf file
42- // +optional
43- KbsTdxConfigMapName string `json:"kbsTdxConfigMapName,omitempty"`
44- }
45-
4639// IbmSEConfigSpec defines the desired state for IBMSE configuration
4740type IbmSEConfigSpec struct {
4841 // certStorePvc is the name of the PeristentVolumeClaim where certificates/keys are mounted
@@ -75,6 +68,69 @@ type KbsDeploymentSpec struct {
7568 Replicas * int32 `json:"replicas,omitempty"`
7669}
7770
71+ // TlsConfig defines TLS protocol and cipher configuration for Trustee HTTPS server.
72+ //
73+ // The TLS profile determines which protocol versions and cipher suites are enabled:
74+ // - old: TLS 1.0+ (legacy compatibility)
75+ // - intermediate: TLS 1.2+ (default, balanced security)
76+ // - modern: TLS 1.3 only (PQC-ready)
77+ // - custom: user-defined configuration
78+ //
79+ // When using the custom profile, all fields (minVersion, maxVersion, ciphers, groups)
80+ // are optional. If not specified, the underlying KBS will use its default values.
81+ //
82+ // Example - Modern profile for PQC:
83+ //
84+ // tlsConfig:
85+ // profile: modern
86+ //
87+ // Example - Custom profile with explicit settings:
88+ //
89+ // tlsConfig:
90+ // profile: custom
91+ // minVersion: "1.2"
92+ // ciphers:
93+ // - TLS_AES_128_GCM_SHA256
94+ // groups:
95+ // - x25519
96+ //
97+ // +kubebuilder:validation:XValidation:rule="!has(self.minVersion) || !has(self.maxVersion) || self.minVersion <= self.maxVersion",message="minVersion must not be greater than maxVersion"
98+ type TlsConfig struct {
99+ // Profile defines the TLS security profile.
100+ // Valid values: "old", "intermediate" (default), "modern", "custom"
101+ // - old: TLS 1.0+ (legacy compatibility)
102+ // - intermediate: TLS 1.2+ (balanced security, default)
103+ // - modern: TLS 1.3 only (PQC-ready)
104+ // - custom: user-defined versions and ciphers
105+ // +kubebuilder:validation:Enum=old;intermediate;modern;custom
106+ // +kubebuilder:default=intermediate
107+ // +optional
108+ Profile string `json:"profile,omitempty"`
109+
110+ // MinVersion specifies minimum TLS version (only for custom profile)
111+ // Valid values: "1.0", "1.1", "1.2", "1.3"
112+ // +kubebuilder:validation:Pattern=`^1\.[0-3]$`
113+ // +optional
114+ MinVersion string `json:"minVersion,omitempty"`
115+
116+ // MaxVersion specifies maximum TLS version (only for custom profile)
117+ // Valid values: "1.0", "1.1", "1.2", "1.3"
118+ // +kubebuilder:validation:Pattern=`^1\.[0-3]$`
119+ // +optional
120+ MaxVersion string `json:"maxVersion,omitempty"`
121+
122+ // Ciphers is a list of cipher suites (only for custom profile)
123+ // Supports both IANA and OpenSSL formats
124+ // Example: ["TLS_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"]
125+ // +optional
126+ Ciphers []string `json:"ciphers,omitempty"`
127+
128+ // Groups specifies TLS key exchange groups (only for custom profile)
129+ // Example: ["x25519", "secp256r1"]
130+ // +optional
131+ Groups []string `json:"groups,omitempty"`
132+ }
133+
78134// KbsConfigSpec defines the desired state of KbsConfig
79135type KbsConfigSpec struct {
80136 // INSERT ADDITIONAL SPEC FIELDS - desired state of cluster
@@ -143,10 +199,6 @@ type KbsConfigSpec struct {
143199 // +optional
144200 KbsResourcePolicyConfigMapName string `json:"kbsResourcePolicyConfigMapName,omitempty"`
145201
146- // TdxConfigSpec is the struct that hosts the TDX specific configuration
147- // +optional
148- TdxConfigSpec TdxConfigSpec `json:"tdxConfigSpec,omitempty"`
149-
150202 // IbmSEConfigSpec is the struct that hosts the IBMSE specific configuration
151203 // +optional
152204 IbmSEConfigSpec IbmSEConfigSpec `json:"ibmSEConfigSpec,omitempty"`
@@ -242,6 +294,11 @@ type TrusteeConfigSpec struct {
242294 // Default value is ClusterIP
243295 // +optional
244296 KbsServiceType corev1.ServiceType `json:"kbsServiceType,omitempty"`
297+
298+ // TlsConfig defines TLS protocol and cipher configuration for KBS HTTPS server
299+ // If not specified, defaults to "intermediate" profile (TLS 1.2+)
300+ // +optional
301+ TlsConfig * TlsConfig `json:"tlsConfig,omitempty"`
245302}
246303
247304// TrusteeConfigStatus defines the observed state of TrusteeConfig
0 commit comments