feat(tls): inject TLS env vars into triggers core interceptors

Extend the OpenShift TLS profile injection to also cover the
tekton-triggers-core-interceptors Deployment, in addition to the
existing tekton-triggers-webhook target.

Both deployments now receive TLS_MIN_VERSION, TLS_CIPHER_SUITES, and
TLS_CURVE_PREFERENCES from the centrally resolved APIServer TLS profile,
ensuring cluster-wide PQC-readiness policy is enforced consistently
across all Triggers components (SRVKP-9615).

Container name confirmed from the live cluster:
  tekton-triggers-core-interceptors (openshift-pipelines namespace)

Signed-off-by: Jawed khelil <jkhelil@redhat.com>
Assisted-by: Claude Sonnet 4.6 (via Cursor)
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 2 people

pkg/reconciler/openshift/tektontrigger/extension.go

@@ -32,6 +32,8 @@ import (
 const (
 	tektonTriggersWebhookDeployment = "tekton-triggers-webhook"
 	webhookContainerName            = "webhook"
+	tektonTriggersCoreInterceptors  = "tekton-triggers-core-interceptors"
+	coreInterceptorsContainerName   = "tekton-triggers-core-interceptors"
 )
 
 // triggersProperties holds fields for configuring runAsUser and runAsGroup.
@@ -70,10 +72,15 @@ func (oe *openshiftExtension) Transformers(comp v1alpha1.TektonComponent) []mf.T
 		replaceDeploymentArgs("-el-events", "enable"),
 	}
 
-	// Inject APIServer TLS profile env vars into the webhook so that it applies
-	// the cluster-wide TLS version and cipher suite policy (PQC readiness).
+	// Inject APIServer TLS profile env vars into the webhook and core interceptors
+	// so that both apply the cluster-wide TLS version and cipher suite policy (PQC readiness).
 	if oe.resolvedTLSConfig != nil {
-		trns = append(trns, occommon.InjectTLSEnvVars(oe.resolvedTLSConfig, "Deployment", tektonTriggersWebhookDeployment, []string{webhookContainerName}))
+		trns = append(trns,
+			// tekton-triggers-webhook uses the Knative webhook framework which reads WEBHOOK_TLS_* env vars.
+			occommon.InjectTLSEnvVars(oe.resolvedTLSConfig, "Deployment", tektonTriggersWebhookDeployment, []string{webhookContainerName}, occommon.WebhookEnvVarPrefix),
+			// tekton-triggers-core-interceptors uses its own tlsconfig.LoadFromEnv() which reads TLS_* env vars directly (no prefix).
+			occommon.InjectTLSEnvVars(oe.resolvedTLSConfig, "Deployment", tektonTriggersCoreInterceptors, []string{coreInterceptorsContainerName}, ""),
+		)
 	}
 
 	return trns
@@ -88,7 +95,7 @@ func (oe *openshiftExtension) PreReconcile(ctx context.Context, tc v1alpha1.Tekt
 	}
 	oe.resolvedTLSConfig = resolvedTLS
 	if oe.resolvedTLSConfig != nil {
-		logger.Infof("Injecting central TLS config into triggers webhook: MinVersion=%s", oe.resolvedTLSConfig.MinVersion)
+		logger.Infof("Injecting central TLS config into triggers webhook and core interceptors: MinVersion=%s", oe.resolvedTLSConfig.MinVersion)
 	}
 
 	return nil

pkg/reconciler/openshift/tektontrigger/extension_test.go

@@ -29,20 +29,20 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 )
 
-// makeTriggersWebhookDeployment returns an unstructured triggers webhook Deployment for transformer tests.
-func makeTriggersWebhookDeployment(t *testing.T) unstructured.Unstructured {
+// makeDeployment returns an unstructured Deployment with the given name and container name.
+func makeDeployment(t *testing.T, deploymentName, containerName string) unstructured.Unstructured {
 	t.Helper()
 
 	d := &appsv1.Deployment{
 		ObjectMeta: metav1.ObjectMeta{
-			Name:      tektonTriggersWebhookDeployment,
+			Name:      deploymentName,
 			Namespace: "openshift-pipelines",
 		},
 		Spec: appsv1.DeploymentSpec{
 			Template: corev1.PodTemplateSpec{
 				Spec: corev1.PodSpec{
 					Containers: []corev1.Container{
-						{Name: webhookContainerName},
+						{Name: containerName},
 					},
 				},
 			},
@@ -58,6 +58,16 @@ func makeTriggersWebhookDeployment(t *testing.T) unstructured.Unstructured {
 	return u
 }
 
+// makeTriggersWebhookDeployment returns an unstructured triggers webhook Deployment for transformer tests.
+func makeTriggersWebhookDeployment(t *testing.T) unstructured.Unstructured {
+	return makeDeployment(t, tektonTriggersWebhookDeployment, webhookContainerName)
+}
+
+// makeCoreInterceptorsDeployment returns an unstructured core interceptors Deployment for transformer tests.
+func makeCoreInterceptorsDeployment(t *testing.T) unstructured.Unstructured {
+	return makeDeployment(t, tektonTriggersCoreInterceptors, coreInterceptorsContainerName)
+}
+
 func TestTriggersTransformers_NoTLSConfig(t *testing.T) {
 	ext := &openshiftExtension{
 		resolvedTLSConfig: nil,
@@ -85,7 +95,8 @@ func TestTriggersTransformers_NoTLSConfig(t *testing.T) {
 			continue
 		}
 		for _, e := range c.Env {
-			if e.Name == occommon.TLSMinVersionEnvVar || e.Name == occommon.TLSCipherSuitesEnvVar {
+			if e.Name == occommon.WebhookEnvVarPrefix+occommon.TLSMinVersionEnvVar ||
+				e.Name == occommon.WebhookEnvVarPrefix+occommon.TLSCipherSuitesEnvVar {
 				t.Errorf("unexpected TLS env var %s set when resolvedTLSConfig is nil", e.Name)
 			}
 		}
@@ -129,6 +140,54 @@ func TestTriggersTransformers_WithTLSConfig_InjectsEnvVarsIntoWebhook(t *testing
 		}
 	}
 
+	webhookMinVersion := occommon.WebhookEnvVarPrefix + occommon.TLSMinVersionEnvVar
+	webhookCipherSuites := occommon.WebhookEnvVarPrefix + occommon.TLSCipherSuitesEnvVar
+
+	if got := envMap[webhookMinVersion]; got != tlsConfig.MinVersion {
+		t.Errorf("%s = %q, want %q", webhookMinVersion, got, tlsConfig.MinVersion)
+	}
+	if got := envMap[webhookCipherSuites]; got != tlsConfig.CipherSuites {
+		t.Errorf("%s = %q, want %q", webhookCipherSuites, got, tlsConfig.CipherSuites)
+	}
+}
+
+func TestTriggersTransformers_WithTLSConfig_InjectsEnvVarsIntoCoreInterceptors(t *testing.T) {
+	tlsConfig := &occommon.TLSEnvVars{
+		MinVersion:   "1.2",
+		CipherSuites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_AES_128_GCM_SHA256",
+	}
+	ext := &openshiftExtension{
+		resolvedTLSConfig: tlsConfig,
+	}
+
+	transformers := ext.Transformers(&v1alpha1.TektonTrigger{})
+
+	u := makeCoreInterceptorsDeployment(t)
+	manifest, err := mf.ManifestFrom(mf.Slice([]unstructured.Unstructured{u}))
+	if err != nil {
+		t.Fatalf("failed to build manifest: %v", err)
+	}
+
+	transformed, err := manifest.Transform(transformers...)
+	if err != nil {
+		t.Fatalf("transform failed: %v", err)
+	}
+
+	d := &appsv1.Deployment{}
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(transformed.Resources()[0].Object, d); err != nil {
+		t.Fatalf("failed to convert back: %v", err)
+	}
+
+	envMap := map[string]string{}
+	for _, c := range d.Spec.Template.Spec.Containers {
+		if c.Name != coreInterceptorsContainerName {
+			continue
+		}
+		for _, e := range c.Env {
+			envMap[e.Name] = e.Value
+		}
+	}
+
 	if got := envMap[occommon.TLSMinVersionEnvVar]; got != tlsConfig.MinVersion {
 		t.Errorf("%s = %q, want %q", occommon.TLSMinVersionEnvVar, got, tlsConfig.MinVersion)
 	}
@@ -137,6 +196,39 @@ func TestTriggersTransformers_WithTLSConfig_InjectsEnvVarsIntoWebhook(t *testing
 	}
 }
 
+func TestTriggersTransformers_NoTLSConfig_DoesNotInjectIntoCoreInterceptors(t *testing.T) {
+	ext := &openshiftExtension{
+		resolvedTLSConfig: nil,
+	}
+
+	transformers := ext.Transformers(&v1alpha1.TektonTrigger{})
+
+	u := makeCoreInterceptorsDeployment(t)
+	manifest, err := mf.ManifestFrom(mf.Slice([]unstructured.Unstructured{u}))
+	if err != nil {
+		t.Fatalf("failed to build manifest: %v", err)
+	}
+
+	transformed, err := manifest.Transform(transformers...)
+	if err != nil {
+		t.Fatalf("transform failed: %v", err)
+	}
+
+	d := &appsv1.Deployment{}
+	if err := runtime.DefaultUnstructuredConverter.FromUnstructured(transformed.Resources()[0].Object, d); err != nil {
+		t.Fatalf("failed to convert back: %v", err)
+	}
+	for _, c := range d.Spec.Template.Spec.Containers {
+		for _, e := range c.Env {
+			if e.Name == occommon.TLSMinVersionEnvVar || e.Name == occommon.TLSCipherSuitesEnvVar ||
+				e.Name == occommon.WebhookEnvVarPrefix+occommon.TLSMinVersionEnvVar ||
+				e.Name == occommon.WebhookEnvVarPrefix+occommon.TLSCipherSuitesEnvVar {
+				t.Errorf("unexpected TLS env var %s set when resolvedTLSConfig is nil", e.Name)
+			}
+		}
+	}
+}
+
 func TestTriggersTransformers_WithTLSConfig_DoesNotInjectIntoOtherDeployments(t *testing.T) {
 	tlsConfig := &occommon.TLSEnvVars{
 		MinVersion:   "1.3",
@@ -189,7 +281,9 @@ func TestTriggersTransformers_WithTLSConfig_DoesNotInjectIntoOtherDeployments(t
 
 	for _, c := range result.Spec.Template.Spec.Containers {
 		for _, e := range c.Env {
-			if e.Name == occommon.TLSMinVersionEnvVar || e.Name == occommon.TLSCipherSuitesEnvVar {
+			if e.Name == occommon.TLSMinVersionEnvVar || e.Name == occommon.TLSCipherSuitesEnvVar ||
+				e.Name == occommon.WebhookEnvVarPrefix+occommon.TLSMinVersionEnvVar ||
+				e.Name == occommon.WebhookEnvVarPrefix+occommon.TLSCipherSuitesEnvVar {
 				t.Errorf("unexpected TLS env var %s injected into non-webhook deployment", e.Name)
 			}
 		}