Skip to content

Commit 6648ed6

Browse files
jkheliljkhelil
committed
feat(tls): inject centrally managed TLS config into tekton-pipelines-webhook
Wire the OpenShift APIServer TLS profile (TLS_MIN_VERSION, TLS_CIPHER_SUITES, TLS_CURVE_PREFERENCES) into the tekton-pipelines-webhook Deployment to support PQC readiness (SRVKP-9614). Made-with: Cursor
1 parent e4eaabd commit 6648ed6

11 files changed

Lines changed: 287 additions & 19 deletions

File tree

‎pkg/reconciler/kubernetes/tektoninstallerset/client/check.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ func verifyMeta(resourceKind, isType string, logger *zap.SugaredLogger, set v1al
135135
// Spec Hash Check
136136
logger.Debugf("%v/%v: spec hash check", resourceKind, isType)
137137

138-
expectedHash, err := hash.Compute(comp.GetSpec())
138+
expectedHash, err := hash.Compute(specHashInput(comp))
139139
if err != nil {
140140
return err
141141
}
@@ -149,3 +149,17 @@ func verifyMeta(resourceKind, isType string, logger *zap.SugaredLogger, set v1al
149149

150150
return nil
151151
}
152+
153+
// specHashInput is the canonical input for computing an InstallerSet's spec hash.
154+
// Including PlatformDataHashKey means that operator-injected platform config
155+
// (e.g. OpenShift APIServer TLS profile) causes InstallerSets to be refreshed
156+
// when that config changes, without requiring the component's spec to change.
157+
func specHashInput(comp v1alpha1.TektonComponent) interface{} {
158+
return struct {
159+
Spec interface{}
160+
PlatformData string
161+
}{
162+
Spec: comp.GetSpec(),
163+
PlatformData: comp.GetAnnotations()[v1alpha1.PlatformDataHashKey],
164+
}
165+
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/check_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func buildTriggerComponent(disabled bool) *v1alpha1.TektonTrigger {
4949
}
5050

5151
func computeHash(comp *v1alpha1.TektonTrigger) string {
52-
h, err := hash.Compute(comp.GetSpec())
52+
h, err := hash.Compute(specHashInput(comp))
5353
if err != nil {
5454
panic("failed to compute hash: " + err.Error())
5555
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/create.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ func (i *InstallerSetClient) waitForStatus(ctx context.Context, set *v1alpha1.Te
131131
}
132132

133133
func (i *InstallerSetClient) makeInstallerSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, isName, isType string, customLabels map[string]string) (*v1alpha1.TektonInstallerSet, error) {
134-
specHash, err := hash.Compute(comp.GetSpec())
134+
specHash, err := hash.Compute(specHashInput(comp))
135135
if err != nil {
136136
return nil, err
137137
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/update.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func (i *InstallerSetClient) updateSet(ctx context.Context, comp v1alpha1.Tekton
8888
return err
8989
}
9090

91-
specHash, err := hash.Compute(comp.GetSpec())
91+
specHash, err := hash.Compute(specHashInput(comp))
9292
if err != nil {
9393
return err
9494
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/update_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func TestInstallerSetClient_Update(t *testing.T) {
4141
},
4242
}
4343

44-
expectedHash, err := hash.Compute(comp.GetSpec())
44+
expectedHash, err := hash.Compute(specHashInput(comp))
4545
assert.NilError(t, err)
4646

4747
tests := []struct {

‎pkg/reconciler/openshift/common/tlsprofile.go‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,13 @@ const (
4949
// TLS_CURVE_PREFERENCES: comma-separated elliptic curve names (not yet populated;
5050
// defaults to Go standard library values until openshift/api#2583 is merged)
5151
TLSCurvePreferencesEnvVar = "TLS_CURVE_PREFERENCES"
52+
53+
// WebhookEnvVarPrefix is prepended to the TLS env var names when injecting into
54+
// deployments that use the Knative webhook framework. The Knative webhook binary calls
55+
// knativetls.DefaultConfigFromEnv("WEBHOOK_"), so it reads WEBHOOK_TLS_MIN_VERSION,
56+
// WEBHOOK_TLS_CIPHER_SUITES, and WEBHOOK_TLS_CURVE_PREFERENCES.
57+
// Components that read the env vars directly (e.g. Results API) use no prefix.
58+
WebhookEnvVarPrefix = "WEBHOOK_"
5259
)
5360

5461
// TLSEnvVars holds TLS configuration as environment variable values
@@ -260,13 +267,15 @@ func convertTLSVersionToEnvFormat(version string) (string, error) {
260267

261268
// InjectTLSEnvVars returns a transformer that injects TLS environment variables into
262269
// the specified containers of a Deployment or StatefulSet matched by name.
263-
func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string, containerNames []string) mf.Transformer {
270+
// envVarPrefix is prepended to each env var name. Use WebhookEnvVarPrefix ("WEBHOOK_") for
271+
// deployments that run the Knative webhook binary, and "" for all other components.
272+
func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string, containerNames []string, envVarPrefix string) mf.Transformer {
264273
return func(u *unstructured.Unstructured) error {
265274
if u.GetKind() != kind || u.GetName() != resourceName {
266275
return nil
267276
}
268277

269-
envVars := buildTLSEnvVarList(tlsEnvVars)
278+
envVars := buildTLSEnvVarList(tlsEnvVars, envVarPrefix)
270279
if len(envVars) == 0 {
271280
return nil
272281
}
@@ -281,16 +290,16 @@ func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string,
281290
}
282291
}
283292

284-
func buildTLSEnvVarList(tlsEnvVars *TLSEnvVars) []corev1.EnvVar {
293+
func buildTLSEnvVarList(tlsEnvVars *TLSEnvVars, prefix string) []corev1.EnvVar {
285294
var envVars []corev1.EnvVar
286295
if tlsEnvVars.MinVersion != "" {
287-
envVars = append(envVars, corev1.EnvVar{Name: TLSMinVersionEnvVar, Value: tlsEnvVars.MinVersion})
296+
envVars = append(envVars, corev1.EnvVar{Name: prefix + TLSMinVersionEnvVar, Value: tlsEnvVars.MinVersion})
288297
}
289298
if tlsEnvVars.CipherSuites != "" {
290-
envVars = append(envVars, corev1.EnvVar{Name: TLSCipherSuitesEnvVar, Value: tlsEnvVars.CipherSuites})
299+
envVars = append(envVars, corev1.EnvVar{Name: prefix + TLSCipherSuitesEnvVar, Value: tlsEnvVars.CipherSuites})
291300
}
292301
if tlsEnvVars.CurvePreferences != "" {
293-
envVars = append(envVars, corev1.EnvVar{Name: TLSCurvePreferencesEnvVar, Value: tlsEnvVars.CurvePreferences})
302+
envVars = append(envVars, corev1.EnvVar{Name: prefix + TLSCurvePreferencesEnvVar, Value: tlsEnvVars.CurvePreferences})
294303
}
295304
return envVars
296305
}

‎pkg/reconciler/openshift/tektonpipeline/extension.go‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
mf "github.com/manifestival/manifestival"
2626
"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
2727
operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
28+
tektonConfiginformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonconfig"
2829
"github.com/tektoncd/operator/pkg/reconciler/common"
2930
"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
3031
occommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
@@ -40,6 +41,8 @@ const (
4041

4142
tektonPipelinesControllerName = "tekton-pipelines-controller"
4243
tektonRemoteResolversControllerName = "tekton-pipelines-remote-resolvers"
44+
tektonPipelinesWebhookDeployment = "tekton-pipelines-webhook"
45+
webhookContainerName = "webhook"
4346
)
4447

4548
func OpenShiftExtension(ctx context.Context) common.Extension {
@@ -49,22 +52,25 @@ func OpenShiftExtension(ctx context.Context) common.Extension {
4952
logger.Fatal("Failed to find version from env")
5053
}
5154

52-
ext := openshiftExtension{
55+
ext := &openshiftExtension{
5356
// component version is used for metrics, passing a dummy
5457
// value through extension not going to affect execution
5558
installerSetClient: client.NewInstallerSetClient(operatorclient.Get(ctx).OperatorV1alpha1().TektonInstallerSets(),
5659
version, "pipelines-ext", v1alpha1.KindTektonPipeline, nil),
57-
kubeClientSet: kubeclient.Get(ctx),
60+
kubeClientSet: kubeclient.Get(ctx),
61+
tektonConfigLister: tektonConfiginformer.Get(ctx).Lister(),
5862
}
5963
return ext
6064
}
6165

6266
type openshiftExtension struct {
6367
installerSetClient *client.InstallerSetClient
6468
kubeClientSet kubernetes.Interface
69+
tektonConfigLister occommon.TektonConfigLister
70+
resolvedTLSConfig *occommon.TLSEnvVars
6571
}
6672

67-
func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
73+
func (oe *openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
6874
trns := []mf.Transformer{
6975
occommon.ApplyCABundlesToDeployment,
7076
occommon.RemoveRunAsUser(),
@@ -73,9 +79,28 @@ func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Tr
7379
occommon.ApplyCABundlesForStatefulSet(tektonPipelinesControllerName),
7480
occommon.ApplyCABundlesForStatefulSet(tektonRemoteResolversControllerName),
7581
}
82+
83+
// Inject APIServer TLS profile env vars into the webhook so that it applies
84+
// the cluster-wide TLS version and cipher suite policy (PQC readiness).
85+
if oe.resolvedTLSConfig != nil {
86+
trns = append(trns, occommon.InjectTLSEnvVars(oe.resolvedTLSConfig, "Deployment", tektonPipelinesWebhookDeployment, []string{webhookContainerName}, occommon.WebhookEnvVarPrefix))
87+
}
88+
7689
return trns
7790
}
78-
func (oe openshiftExtension) PreReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
91+
92+
func (oe *openshiftExtension) PreReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
93+
logger := logging.FromContext(ctx)
94+
95+
resolvedTLS, err := occommon.ResolveCentralTLSToEnvVars(ctx, oe.tektonConfigLister)
96+
if err != nil {
97+
return err
98+
}
99+
oe.resolvedTLSConfig = resolvedTLS
100+
if oe.resolvedTLSConfig != nil {
101+
logger.Infof("Injecting central TLS config into webhook: MinVersion=%s", oe.resolvedTLSConfig.MinVersion)
102+
}
103+
79104
manifest, err := preManifest()
80105
if err != nil {
81106
return err
@@ -102,7 +127,7 @@ func (oe openshiftExtension) PreReconcile(ctx context.Context, comp v1alpha1.Tek
102127
return common.ReconcileTargetNamespace(ctx, labels, nil, comp, oe.kubeClientSet)
103128
}
104129

105-
func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
130+
func (oe *openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
106131
pipeline := comp.(*v1alpha1.TektonPipeline)
107132

108133
// Install monitoring if metrics is enabled
@@ -124,7 +149,7 @@ func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.Te
124149

125150
return nil
126151
}
127-
func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
152+
func (oe *openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
128153
if err := oe.installerSetClient.CleanupPostSet(ctx); err != nil {
129154
return err
130155
}
@@ -134,7 +159,7 @@ func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonC
134159
return nil
135160
}
136161

137-
func (oe openshiftExtension) GetPlatformData() string {
162+
func (oe *openshiftExtension) GetPlatformData() string {
138163
return ""
139164
}
140165

0 commit comments

Comments
 (0)