Skip to content

feat: auto-detect TLS security profile from OpenShift cluster #850

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jcrossley3 wants to merge 1 commit into
base: release/3.y.z
Choose a base branch
from
+131 −0
Open

feat: auto-detect TLS security profile from OpenShift cluster #850

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,4 +80,12 @@ rules:
- update
- watch

- apiGroups:
- config.openshift.io
resources:
- apiservers
verbs:
- get
- list

# +kubebuilder:scaffold:rules
2 changes: 2 additions & 0 deletions helm-charts/redhat-trusted-profile-analyzer/templates/helpers/_http.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,8 @@ Arguments (dict):
value: "/etc/tls/tls.crt"
{{ end }}

{{ include "trustification.tls.securityProfile.envVars" . }}

{{- with .module.requestLimit }}
- name: HTTP_SERVER_REQUEST_LIMIT
value: {{ include "trustification.common.byteSizeValue" . }}
Expand Down
76 changes: 76 additions & 0 deletions helm-charts/redhat-trusted-profile-analyzer/templates/helpers/_tls_profile.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
{{/*
Environment variables for the TLS security profile.

Precedence:
1. User-specified via .Values.tls.securityProfile (string or object)
2. Auto-detected from OpenShift APIServer CR via lookup
3. Nothing (trustify server uses its compiled default: modern)

Arguments (dict):
* root - .
*/}}
{{- define "trustification.tls.securityProfile.envVars" -}}

{{- $profile := (.root.Values.tls).securityProfile -}}

{{- if $profile -}}
{{/* User explicitly set tls.securityProfile */}}
{{- if kindIs "string" $profile }}
- name: HTTP_SERVER_TLS_SECURITY_PROFILE
value: {{ $profile | quote }}
{{- else if kindIs "map" $profile }}
- name: HTTP_SERVER_TLS_SECURITY_PROFILE
value: {{ $profile.type | quote }}
{{- if eq $profile.type "custom" }}
{{- with $profile.minTLSVersion }}
- name: HTTP_SERVER_TLS_MIN_VERSION
value: {{ . | quote }}
{{- end }}
{{- with $profile.ciphers }}
- name: HTTP_SERVER_TLS_CIPHERS
value: {{ join ":" . | quote }}
{{- end }}
{{- with $profile.ciphersuites }}
- name: HTTP_SERVER_TLS_CIPHERSUITES
value: {{ join ":" . | quote }}
{{- end }}
{{- end }}
{{- end }}

{{- else if eq (include "trustification.openshift.detect" .root) "true" -}}
{{/* Auto-detect from OpenShift APIServer CR */}}
{{- $apiserver := (lookup "config.openshift.io/v1" "APIServer" "" "cluster") -}}
{{- $tlsProfile := dig "spec" "tlsSecurityProfile" dict $apiserver -}}
Comment on lines +42 to +43

@sourcery-ai sourcery-ai Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue (bug_risk): Using dict as the default for dig may cause with $tlsProfile to execute on an empty map and then fail when accessing .type.

Because dig defaults to dict, $tlsProfile becomes an empty map when the APIServer resource or its tlsSecurityProfile field is missing. Empty maps are truthy in Go templates, so the with block still runs and .type | lower is evaluated on a value without type, likely causing a render error. To avoid this, default to nil (or omit the default and handle nil) so the with block is skipped when the profile is absent:

{{- $tlsProfile := dig "spec" "tlsSecurityProfile" nil $apiserver -}}
{{- with $tlsProfile -}}
  {{- $type := .type | lower }}
  ...
{{- end }}

{{- with $tlsProfile -}}
{{- $type := .type | lower }}
- name: HTTP_SERVER_TLS_SECURITY_PROFILE
value: {{ $type | quote }}
{{- if eq $type "custom" }}
{{- with .custom -}}
{{- with .minTLSVersion }}
- name: HTTP_SERVER_TLS_MIN_VERSION
value: {{ include "trustification.tls.securityProfile.mapVersion" . | quote }}
{{- end }}
{{- with .ciphers }}
- name: HTTP_SERVER_TLS_CIPHERS
value: {{ join ":" . | quote }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

{{- end }}

{{- end }}

{{/*
Map OpenShift TLS version names to trustify version strings.

VersionTLS10 -> 1.0, VersionTLS11 -> 1.1, VersionTLS12 -> 1.2, VersionTLS13 -> 1.3

Arguments: version string (e.g. "VersionTLS12")
*/}}
{{- define "trustification.tls.securityProfile.mapVersion" -}}
{{- $map := dict "VersionTLS10" "1.0" "VersionTLS11" "1.1" "VersionTLS12" "1.2" "VersionTLS13" "1.3" -}}
{{- get $map . | default . -}}
{{- end }}
45 changes: 45 additions & 0 deletions helm-charts/redhat-trusted-profile-analyzer/values.schema.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,6 +178,51 @@ properties:
additionalTrustAnchor:
type: string
description: The path of the certificate to add to the list of trust anchors
securityProfile:
description: |
TLS security profile aligned with OpenShift TLS Security Profiles.
On OpenShift, auto-detected from the cluster's APIServer CR if not set.
Can be a simple string (old, intermediate, modern) or an object with
type and custom settings.
oneOf:
- type: string
enum:
- old
- intermediate
- modern
- type: object
required:
- type
additionalProperties: false
properties:
type:
type: string
enum:
- old
- intermediate
- modern
- custom
minTLSVersion:
type: string
description: |
Minimum TLS version (custom profile only).
enum:
- "1.0"
- "1.1"
- "1.2"
- "1.3"
ciphers:
type: array
items:
type: string
description: |
TLS 1.2 cipher list in OpenSSL format (custom profile only).
ciphersuites:
type: array
items:
type: string
description: |
TLS 1.3 ciphersuites in OpenSSL format (custom profile only).

modules:
type: object
Expand Down
Loading