Skip to content

COO-1557: apply TLS profile to COO #1088

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
simonpasquier wants to merge 1 commit into
base: main
Choose a base branch
from
Open

COO-1557: apply TLS profile to COO #1088

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 13 additions & 8 deletions pkg/operator/operator.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,6 +72,7 @@ type OperatorConfiguration struct {
UIPlugins uictrl.UIPluginsConfiguration
FeatureGates FeatureGates
ObservabilityInstaller ObservabilityInstallerConfiguration
TLSProfile configv1.TLSProfileSpec
// CancelFunc is called to trigger graceful shutdown (e.g., on TLS profile change).
CancelFunc context.CancelFunc
}
Expand Down Expand Up @@ -159,13 +160,15 @@ func WithCancelFunc(cancel context.CancelFunc) func(*OperatorConfiguration) {

func WithTLSProfile(tlsProfile configv1.TLSProfileSpec) func(*OperatorConfiguration) {
return func(oc *OperatorConfiguration) {
oc.TLSProfile = tlsProfile
oc.UIPlugins.TLSProfile = tlsProfile
}
}

func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
restConfig := ctrl.GetConfigOrDie()
scheme := NewScheme(cfg)
setupLog := ctrl.Log.WithName("setup")

metricsOpts := metricsserver.Options{
BindAddress: cfg.MetricsAddr,
Expand Down Expand Up @@ -230,10 +233,16 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
ctrl.Log.WithName("events").Info(fmt.Sprintf(format, args...))
})

var tlsConfig tls.Config
tlsConfigFn, unsupportedCiphers := openshifttls.NewTLSConfigFromProfile(cfg.TLSProfile)
if len(unsupportedCiphers) > 0 {
setupLog.Info("Some ciphers from TLS profile are not supported", "ciphers", unsupportedCiphers)
}
tlsConfigFn(&tlsConfig)
tlsConfig.ClientAuth = tls.RequireAndVerifyClientCert

servingCertController = dynamiccertificates.NewDynamicServingCertificateController(
&tls.Config{
ClientAuth: tls.RequireAndVerifyClientCert,
},
&tlsConfig,
clientCAController,
certKeyProvider,
nil,
Expand Down Expand Up @@ -326,11 +335,10 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
}

if cfg.FeatureGates.OpenShift.Enabled {
setupLog := ctrl.Log.WithName("setup")

watcher := &openshifttls.SecurityProfileWatcher{
Client: mgr.GetClient(),
InitialTLSProfileSpec: cfg.UIPlugins.TLSProfile,
InitialTLSProfileSpec: cfg.TLSProfile,
OnProfileChange: func(_ context.Context, _, _ configv1.TLSProfileSpec) {
setupLog.Info("TLS security profile changed, triggering graceful restart")
if cfg.CancelFunc != nil {
Expand All @@ -346,7 +354,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
return nil, fmt.Errorf("unable to register observability-ui-plugin controller: %w", err)
}
} else {
setupLog := ctrl.Log.WithName("setup")
setupLog.Info("OpenShift feature gate is disabled, UIPlugins are not enabled")
}

Expand All @@ -355,7 +362,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
return nil, fmt.Errorf("unable to register operator controller: %w", err)
}
} else {
setupLog := ctrl.Log.WithName("setup")
setupLog.Info("OpenShift feature gate is disabled, Operator controller is not enabled")
}

Expand All @@ -378,7 +384,6 @@ func New(ctx context.Context, cfg *OperatorConfiguration) (*Operator, error) {
return nil, fmt.Errorf("unable to register cluster observability controller: %w", err)
}
} else {
setupLog := ctrl.Log.WithName("setup")
setupLog.Info("OpenShift feature gate is disabled, cluster observability controller is not enabled")
}

Expand Down
Loading