feat(webhook/tls): read OpenShift APIServer TLS profile at startup, inject as WEBHOOK_TLS_* env vars

At startup the webhook calls occommon.SetupAPIServerTLSWatch (the same helper
used by the TektonConfig controller) to initialise the shared APIServer lister
and register a watcher. When the cluster TLS profile changes the webhook exits
with code 1; Kubernetes restartPolicy: Always restarts it so the new instance
picks up the updated profile.

After the watch is set up, GetTLSProfileFromAPIServer + TLSEnvVarsFromProfile
convert the current profile into "1.2"/"1.3" + comma-separated IANA cipher
strings and inject them as WEBHOOK_TLS_MIN_VERSION / WEBHOOK_TLS_CIPHER_SUITES /
WEBHOOK_TLS_CURVE_PREFERENCES before Knative bootstraps. Knative's
DefaultConfigFromEnv("WEBHOOK_") inside webhook.New() picks them up automatically.

No changes to kwebhook.Options, Deployment manifests, or the Kubernetes webhook.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

cmd/openshift/webhook/main.go

@@ -18,8 +18,10 @@ package main
 
 import (
 	"context"
+	"log"
 	"os"
 
+	occommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
 	"github.com/tektoncd/operator/pkg/webhook"
 	"knative.dev/pkg/injection"
 	"knative.dev/pkg/injection/sharedmain"
@@ -39,13 +41,57 @@ func main() {
 		secretName = "tekton-operator-webhook-certs"
 	}
 
-	//Set up a signal context with our webhook options
-	ctx := kwebhook.WithOptions(signals.NewContext(), kwebhook.Options{
+	// cfg is obtained before signals.NewContext so it's available for the TLS watch setup.
+	cfg := injection.ParseAndGetRESTConfigOrDie()
+	signalCtx := signals.NewContext()
+
+	// Set up the APIServer TLS watch using the same helper as the TektonConfig controller.
+	// - Populates the shared lister so GetTLSProfileFromAPIServer works below.
+	// - Calls os.Exit(1) when the TLS profile changes; Kubernetes restartPolicy: Always
+	//   restarts the container so the new instance picks up the updated profile.
+	if err := occommon.SetupAPIServerTLSWatch(signalCtx, cfg, func() {
+		log.Println("APIServer TLS profile changed — restarting webhook to apply updated settings")
+		os.Exit(1)
+	}); err != nil {
+		// On OpenShift clusters the APIServer resource should always exist.
+		// SKIP_APISERVER_TLS_WATCH=true is an escape hatch for tests/edge cases —
+		// same pattern as the TektonConfig controller.
+		if os.Getenv(occommon.SkipAPIServerTLSWatch) == "true" {
+			log.Printf("WARNING: APIServer TLS watch not available, using Knative defaults: %v", err)
+		} else {
+			log.Fatalf("Failed to set up APIServer TLS watch: %v", err)
+		}
+	}
+
+	// Read the current TLS profile and inject as WEBHOOK_TLS_* env vars.
+	// Knative's DefaultConfigFromEnv("WEBHOOK_") inside webhook.New() reads these automatically.
+	// TLSEnvVarsFromProfile produces "1.2"/"1.3" and comma-separated IANA cipher names —
+	// exactly the format Knative expects.
+	if tlsProfile, err := occommon.GetTLSProfileFromAPIServer(signalCtx); err != nil {
+		log.Printf("WARNING: could not read APIServer TLS profile, using Knative defaults: %v", err)
+	} else if tlsProfile != nil {
+		if envVars, err := occommon.TLSEnvVarsFromProfile(tlsProfile); err != nil {
+			log.Printf("WARNING: could not convert TLS profile, using Knative defaults: %v", err)
+		} else if envVars != nil {
+			if envVars.MinVersion != "" {
+				os.Setenv("WEBHOOK_TLS_MIN_VERSION", envVars.MinVersion)
+			}
+			if envVars.CipherSuites != "" {
+				os.Setenv("WEBHOOK_TLS_CIPHER_SUITES", envVars.CipherSuites)
+			}
+			if envVars.CurvePreferences != "" {
+				os.Setenv("WEBHOOK_TLS_CURVE_PREFERENCES", envVars.CurvePreferences)
+			}
+		}
+	}
+
+	// kwebhook.Options is unchanged — no TLS fields needed.
+	// Knative reads the WEBHOOK_TLS_* env vars we just set inside webhook.New().
+	ctx := kwebhook.WithOptions(signalCtx, kwebhook.Options{
 		ServiceName: serviceName,
 		Port:        8443,
 		SecretName:  secretName,
 	})
-	cfg := injection.ParseAndGetRESTConfigOrDie()
 	ctx, _ = injection.EnableInjectionOrDie(ctx, cfg)
 	webhook.CreateWebhookResources(ctx)
 	webhook.SetTypes("openshift")