feat: apply TLS profile to COO

Signed-off-by: Simon Pasquier <spasquie@redhat.com>

Author: simonpasquier

pkg/operator/operator.go

@@ -162,6 +162,7 @@ func WithTLSProfile(tlsProfile configv1.TLSProfileSpec) func(*OperatorConfigurat
 func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
 	restConfig := ctrl.GetConfigOrDie()
 	scheme := NewScheme(cfg)
+	setupLog := ctrl.Log.WithName("setup")
 
 	metricsOpts := metricsserver.Options{
 		BindAddress: cfg.MetricsAddr,
@@ -226,10 +227,16 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
 			ctrl.Log.WithName("events").Info(fmt.Sprintf(format, args...))
 		})
 
+		var tlsConfig tls.Config
+		tlsConfigFn, unsupportedCiphers := openshifttls.NewTLSConfigFromProfile(cfg.UIPlugins.TLSProfile)
+		if len(unsupportedCiphers) > 0 {
+			setupLog.Info("Some ciphers from TLS profile are not supported", "ciphers", unsupportedCiphers)
+		}
+		tlsConfigFn(&tlsConfig)
+		tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert
+
 		servingCertController = dynamiccertificates.NewDynamicServingCertificateController(
-			&tls.Config{
-				ClientAuth: tls.RequireAndVerifyClientCert,
-			},
+			&tlsConfig,
 			clientCAController,
 			certKeyProvider,
 			nil,
@@ -322,7 +329,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
 	}
 
 	if cfg.FeatureGates.OpenShift.Enabled {
-		setupLog := ctrl.Log.WithName("setup")
 
 		watcher := &openshifttls.SecurityProfileWatcher{
 			Client:                mgr.GetClient(),
@@ -342,7 +348,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
 			return nil, fmt.Errorf("unable to register observability-ui-plugin controller: %w", err)
 		}
 	} else {
-		setupLog := ctrl.Log.WithName("setup")
 		setupLog.Info("OpenShift feature gate is disabled, UIPlugins are not enabled")
 	}
 
@@ -351,7 +356,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
 			return nil, fmt.Errorf("unable to register operator controller: %w", err)
 		}
 	} else {
-		setupLog := ctrl.Log.WithName("setup")
 		setupLog.Info("OpenShift feature gate is disabled, Operator controller is not enabled")
 	}
 
@@ -374,7 +378,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
 			return nil, fmt.Errorf("unable to register cluster observability controller: %w", err)
 		}
 	} else {
-		setupLog := ctrl.Log.WithName("setup")
 		setupLog.Info("OpenShift feature gate is disabled, cluster observability controller is not enabled")
 	}