Skip to content

Commit 6888701

Browse files
jkheliltekton-robot
jkhelil
authored and
tekton-robot
committed
feat(tls): inject centrally managed TLS config into tekton-pipelines-webhook
Wire the OpenShift APIServer TLS profile (TLS_MIN_VERSION, TLS_CIPHER_SUITES, TLS_CURVE_PREFERENCES) into the tekton-pipelines-webhook Deployment to support PQC readiness (SRVKP-9614). Made-with: Cursor
1 parent 4975b71 commit 6888701

11 files changed

Lines changed: 287 additions & 19 deletions

File tree

‎pkg/reconciler/kubernetes/tektoninstallerset/client/check.go‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -135,7 +135,7 @@ func verifyMeta(resourceKind, isType string, logger *zap.SugaredLogger, set v1al
135135
// Spec Hash Check
136136
logger.Debugf("%v/%v: spec hash check", resourceKind, isType)
137137

138-
expectedHash, err := hash.Compute(comp.GetSpec())
138+
expectedHash, err := hash.Compute(specHashInput(comp))
139139
if err != nil {
140140
return err
141141
}
@@ -149,3 +149,17 @@ func verifyMeta(resourceKind, isType string, logger *zap.SugaredLogger, set v1al
149149

150150
return nil
151151
}
152+
153+
// specHashInput is the canonical input for computing an InstallerSet's spec hash.
154+
// Including PlatformDataHashKey means that operator-injected platform config
155+
// (e.g. OpenShift APIServer TLS profile) causes InstallerSets to be refreshed
156+
// when that config changes, without requiring the component's spec to change.
157+
func specHashInput(comp v1alpha1.TektonComponent) interface{} {
158+
return struct {
159+
Spec interface{}
160+
PlatformData string
161+
}{
162+
Spec: comp.GetSpec(),
163+
PlatformData: comp.GetAnnotations()[v1alpha1.PlatformDataHashKey],
164+
}
165+
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/check_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ func buildTriggerComponent(disabled bool) *v1alpha1.TektonTrigger {
4949
}
5050

5151
func computeHash(comp *v1alpha1.TektonTrigger) string {
52-
h, err := hash.Compute(comp.GetSpec())
52+
h, err := hash.Compute(specHashInput(comp))
5353
if err != nil {
5454
panic("failed to compute hash: " + err.Error())
5555
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/create.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,7 @@ func (i *InstallerSetClient) waitForStatus(ctx context.Context, set *v1alpha1.Te
131131
}
132132

133133
func (i *InstallerSetClient) makeInstallerSet(ctx context.Context, comp v1alpha1.TektonComponent, manifest *mf.Manifest, isName, isType string, customLabels map[string]string) (*v1alpha1.TektonInstallerSet, error) {
134-
specHash, err := hash.Compute(comp.GetSpec())
134+
specHash, err := hash.Compute(specHashInput(comp))
135135
if err != nil {
136136
return nil, err
137137
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/update.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -88,7 +88,7 @@ func (i *InstallerSetClient) updateSet(ctx context.Context, comp v1alpha1.Tekton
8888
return err
8989
}
9090

91-
specHash, err := hash.Compute(comp.GetSpec())
91+
specHash, err := hash.Compute(specHashInput(comp))
9292
if err != nil {
9393
return err
9494
}

‎pkg/reconciler/kubernetes/tektoninstallerset/client/update_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ func TestInstallerSetClient_Update(t *testing.T) {
4141
},
4242
}
4343

44-
expectedHash, err := hash.Compute(comp.GetSpec())
44+
expectedHash, err := hash.Compute(specHashInput(comp))
4545
assert.NilError(t, err)
4646

4747
tests := []struct {

‎pkg/reconciler/openshift/common/tlsprofile.go‎

Lines changed: 15 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,13 @@ const (
4949
// TLS_CURVE_PREFERENCES: comma-separated elliptic curve names (not yet populated;
5050
// defaults to Go standard library values until openshift/api#2583 is merged)
5151
TLSCurvePreferencesEnvVar = "TLS_CURVE_PREFERENCES"
52+
53+
// WebhookEnvVarPrefix is prepended to the TLS env var names when injecting into
54+
// deployments that use the Knative webhook framework. The Knative webhook binary calls
55+
// knativetls.DefaultConfigFromEnv("WEBHOOK_"), so it reads WEBHOOK_TLS_MIN_VERSION,
56+
// WEBHOOK_TLS_CIPHER_SUITES, and WEBHOOK_TLS_CURVE_PREFERENCES.
57+
// Components that read the env vars directly (e.g. Results API) use no prefix.
58+
WebhookEnvVarPrefix = "WEBHOOK_"
5259
)
5360

5461
// TLSEnvVars holds TLS configuration as environment variable values
@@ -263,13 +270,15 @@ func convertTLSVersionToEnvFormat(version string) (string, error) {
263270

264271
// InjectTLSEnvVars returns a transformer that injects TLS environment variables into
265272
// the specified containers of a Deployment or StatefulSet matched by name.
266-
func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string, containerNames []string) mf.Transformer {
273+
// envVarPrefix is prepended to each env var name. Use WebhookEnvVarPrefix ("WEBHOOK_") for
274+
// deployments that run the Knative webhook binary, and "" for all other components.
275+
func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string, containerNames []string, envVarPrefix string) mf.Transformer {
267276
return func(u *unstructured.Unstructured) error {
268277
if u.GetKind() != kind || u.GetName() != resourceName {
269278
return nil
270279
}
271280

272-
envVars := buildTLSEnvVarList(tlsEnvVars)
281+
envVars := buildTLSEnvVarList(tlsEnvVars, envVarPrefix)
273282
if len(envVars) == 0 {
274283
return nil
275284
}
@@ -284,16 +293,16 @@ func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string,
284293
}
285294
}
286295

287-
func buildTLSEnvVarList(tlsEnvVars *TLSEnvVars) []corev1.EnvVar {
296+
func buildTLSEnvVarList(tlsEnvVars *TLSEnvVars, prefix string) []corev1.EnvVar {
288297
var envVars []corev1.EnvVar
289298
if tlsEnvVars.MinVersion != "" {
290-
envVars = append(envVars, corev1.EnvVar{Name: TLSMinVersionEnvVar, Value: tlsEnvVars.MinVersion})
299+
envVars = append(envVars, corev1.EnvVar{Name: prefix + TLSMinVersionEnvVar, Value: tlsEnvVars.MinVersion})
291300
}
292301
if tlsEnvVars.CipherSuites != "" {
293-
envVars = append(envVars, corev1.EnvVar{Name: TLSCipherSuitesEnvVar, Value: tlsEnvVars.CipherSuites})
302+
envVars = append(envVars, corev1.EnvVar{Name: prefix + TLSCipherSuitesEnvVar, Value: tlsEnvVars.CipherSuites})
294303
}
295304
if tlsEnvVars.CurvePreferences != "" {
296-
envVars = append(envVars, corev1.EnvVar{Name: TLSCurvePreferencesEnvVar, Value: tlsEnvVars.CurvePreferences})
305+
envVars = append(envVars, corev1.EnvVar{Name: prefix + TLSCurvePreferencesEnvVar, Value: tlsEnvVars.CurvePreferences})
297306
}
298307
return envVars
299308
}

‎pkg/reconciler/openshift/tektonpipeline/extension.go‎

Lines changed: 32 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525
mf "github.com/manifestival/manifestival"
2626
"github.com/tektoncd/operator/pkg/apis/operator/v1alpha1"
2727
operatorclient "github.com/tektoncd/operator/pkg/client/injection/client"
28+
tektonConfiginformer "github.com/tektoncd/operator/pkg/client/injection/informers/operator/v1alpha1/tektonconfig"
2829
"github.com/tektoncd/operator/pkg/reconciler/common"
2930
"github.com/tektoncd/operator/pkg/reconciler/kubernetes/tektoninstallerset/client"
3031
occommon "github.com/tektoncd/operator/pkg/reconciler/openshift/common"
@@ -40,6 +41,8 @@ const (
4041

4142
tektonPipelinesControllerName = "tekton-pipelines-controller"
4243
tektonRemoteResolversControllerName = "tekton-pipelines-remote-resolvers"
44+
tektonPipelinesWebhookDeployment = "tekton-pipelines-webhook"
45+
webhookContainerName = "webhook"
4346
)
4447

4548
func OpenShiftExtension(ctx context.Context) common.Extension {
@@ -49,22 +52,25 @@ func OpenShiftExtension(ctx context.Context) common.Extension {
4952
logger.Fatal("Failed to find version from env")
5053
}
5154

52-
ext := openshiftExtension{
55+
ext := &openshiftExtension{
5356
// component version is used for metrics, passing a dummy
5457
// value through extension not going to affect execution
5558
installerSetClient: client.NewInstallerSetClient(operatorclient.Get(ctx).OperatorV1alpha1().TektonInstallerSets(),
5659
version, "pipelines-ext", v1alpha1.KindTektonPipeline, nil),
57-
kubeClientSet: kubeclient.Get(ctx),
60+
kubeClientSet: kubeclient.Get(ctx),
61+
tektonConfigLister: tektonConfiginformer.Get(ctx).Lister(),
5862
}
5963
return ext
6064
}
6165

6266
type openshiftExtension struct {
6367
installerSetClient *client.InstallerSetClient
6468
kubeClientSet kubernetes.Interface
69+
tektonConfigLister occommon.TektonConfigLister
70+
resolvedTLSConfig *occommon.TLSEnvVars
6571
}
6672

67-
func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
73+
func (oe *openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Transformer {
6874
trns := []mf.Transformer{
6975
occommon.ApplyCABundlesToDeployment,
7076
occommon.RemoveRunAsUser(),
@@ -74,9 +80,28 @@ func (oe openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.Tr
7480
occommon.ApplyCABundlesForStatefulSet(tektonRemoteResolversControllerName),
7581
common.ReplaceNamespaceInClusterRoleBinding(comp.GetSpec().GetTargetNamespace()),
7682
}
83+
84+
// Inject APIServer TLS profile env vars into the webhook so that it applies
85+
// the cluster-wide TLS version and cipher suite policy (PQC readiness).
86+
if oe.resolvedTLSConfig != nil {
87+
trns = append(trns, occommon.InjectTLSEnvVars(oe.resolvedTLSConfig, "Deployment", tektonPipelinesWebhookDeployment, []string{webhookContainerName}, occommon.WebhookEnvVarPrefix))
88+
}
89+
7790
return trns
7891
}
79-
func (oe openshiftExtension) PreReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
92+
93+
func (oe *openshiftExtension) PreReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
94+
logger := logging.FromContext(ctx)
95+
96+
resolvedTLS, err := occommon.ResolveCentralTLSToEnvVars(ctx, oe.tektonConfigLister)
97+
if err != nil {
98+
return err
99+
}
100+
oe.resolvedTLSConfig = resolvedTLS
101+
if oe.resolvedTLSConfig != nil {
102+
logger.Infof("Injecting central TLS config into webhook: MinVersion=%s", oe.resolvedTLSConfig.MinVersion)
103+
}
104+
80105
manifest, err := preManifest()
81106
if err != nil {
82107
return err
@@ -103,7 +128,7 @@ func (oe openshiftExtension) PreReconcile(ctx context.Context, comp v1alpha1.Tek
103128
return common.ReconcileTargetNamespace(ctx, labels, nil, comp, oe.kubeClientSet)
104129
}
105130

106-
func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
131+
func (oe *openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.TektonComponent) error {
107132
pipeline := comp.(*v1alpha1.TektonPipeline)
108133

109134
// Install monitoring if metrics is enabled
@@ -125,7 +150,7 @@ func (oe openshiftExtension) PostReconcile(ctx context.Context, comp v1alpha1.Te
125150

126151
return nil
127152
}
128-
func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
153+
func (oe *openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonComponent) error {
129154
if err := oe.installerSetClient.CleanupPostSet(ctx); err != nil {
130155
return err
131156
}
@@ -135,7 +160,7 @@ func (oe openshiftExtension) Finalize(ctx context.Context, comp v1alpha1.TektonC
135160
return nil
136161
}
137162

138-
func (oe openshiftExtension) GetPlatformData() string {
163+
func (oe *openshiftExtension) GetPlatformData() string {
139164
return ""
140165
}
141166

0 commit comments

Comments
 (0)