Skip to content

Commit 71cf1df

Browse files
moulalismoulalis
committed
Merge remote-tracking branch 'upstream/main'
2 parents 6fee71c + 4918f20 commit 71cf1df

6 files changed

Lines changed: 66 additions & 17 deletions

File tree

‎internal/controller/mcplifecycleoperator_reconciler.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -156,7 +156,7 @@ func (r *MCPLifecycleOperatorReconciler) reconcile(ctx context.Context, cr *v1al
156156
return r.handleRemoved(ctx, cr, cm)
157157
}
158158

159-
tlsMinVersion, tlsCipherSuites, err := fetchTLSConfig(ctx, r.Client)
159+
tlsMinVersion, tlsCipherSuites, tlsGroups, err := fetchTLSConfig(ctx, r.Client)
160160
if err != nil {
161161
cm.MarkFalse(v1alpha1.ConditionMCPLifecycleOperatorAvailable,
162162
"TLSConfigFetchFailed", fmt.Sprintf("Failed to fetch TLS config: %v", err))
@@ -165,13 +165,14 @@ func (r *MCPLifecycleOperatorReconciler) reconcile(ctx context.Context, cr *v1al
165165
return ctrl.Result{}, fmt.Errorf("fetching TLS config: %w", err)
166166
}
167167

168-
log.V(1).Info("TLS configuration resolved", "minVersion", tlsMinVersion)
168+
log.V(1).Info("TLS configuration resolved", "minVersion", tlsMinVersion, "groups", tlsGroups)
169169

170170
desired, err := r.ManifestProvider.Manifests(ctx, manifests.Params{
171171
OperandNamespace: r.PodNamespace,
172172
OperandImage: r.OperandImage,
173173
TLSMinVersion: tlsMinVersion,
174174
TLSCipherSuites: tlsCipherSuites,
175+
TLSGroups: tlsGroups,
175176
})
176177
if err != nil {
177178
cm.MarkFalse(v1alpha1.ConditionMCPLifecycleOperatorAvailable,

‎internal/controller/tls.go‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ import (
1818
logf "sigs.k8s.io/controller-runtime/pkg/log"
1919
)
2020

21-
func fetchTLSConfig(ctx context.Context, cl client.Client) (minVersion string, cipherSuites string, err error) {
21+
func fetchTLSConfig(ctx context.Context, cl client.Client) (minVersion string, cipherSuites string, groups string, err error) {
2222
log := logf.FromContext(ctx)
2323

2424
spec, err := utiltls.FetchAPIServerTLSProfile(ctx, cl)
@@ -32,26 +32,31 @@ func fetchTLSConfig(ctx context.Context, cl client.Client) (minVersion string, c
3232
return intermediateDefaults()
3333
}
3434

35-
return "", "", fmt.Errorf("fetching TLS profile: %w", err)
35+
return "", "", "", fmt.Errorf("fetching TLS profile: %w", err)
3636
}
3737

3838
return tlsProfileSpecToStrings(spec)
3939
}
4040

41-
func intermediateDefaults() (string, string, error) {
41+
func intermediateDefaults() (string, string, string, error) {
4242
defaultSpec := *configv1.TLSProfiles[configv1.TLSProfileIntermediateType]
4343
return tlsProfileSpecToStrings(defaultSpec)
4444
}
4545

46-
func tlsProfileSpecToStrings(spec configv1.TLSProfileSpec) (string, string, error) {
46+
func tlsProfileSpecToStrings(spec configv1.TLSProfileSpec) (string, string, string, error) {
4747
minVersion := string(spec.MinTLSVersion)
4848
if minVersion == "" {
4949
minVersion = string(configv1.VersionTLS12)
5050
}
5151

5252
ianaCiphers := libgocrypto.OpenSSLToIANACipherSuites(spec.Ciphers)
5353

54-
return minVersion, strings.Join(ianaCiphers, ","), nil
54+
groupStrs := make([]string, len(spec.Groups))
55+
for i, g := range spec.Groups {
56+
groupStrs[i] = string(g)
57+
}
58+
59+
return minVersion, strings.Join(ianaCiphers, ","), strings.Join(groupStrs, ","), nil
5560
}
5661

5762
func isNotRegisteredError(err error) bool {

‎internal/controller/tls_test.go‎

Lines changed: 42 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ func TestFetchTLSConfig_IntermediateProfile(t *testing.T) {
3333
WithObjects(apiServer).
3434
Build()
3535

36-
minVersion, cipherSuites, err := fetchTLSConfig(context.Background(), cli)
36+
minVersion, cipherSuites, _, err := fetchTLSConfig(context.Background(), cli)
3737
if err != nil {
3838
t.Fatalf("unexpected error: %v", err)
3939
}
@@ -80,7 +80,7 @@ func TestFetchTLSConfig_ModernProfile(t *testing.T) {
8080
WithObjects(apiServer).
8181
Build()
8282

83-
minVersion, cipherSuites, err := fetchTLSConfig(context.Background(), cli)
83+
minVersion, cipherSuites, _, err := fetchTLSConfig(context.Background(), cli)
8484
if err != nil {
8585
t.Fatalf("unexpected error: %v", err)
8686
}
@@ -116,7 +116,7 @@ func TestFetchTLSConfig_CustomProfile(t *testing.T) {
116116
WithObjects(apiServer).
117117
Build()
118118

119-
minVersion, cipherSuites, err := fetchTLSConfig(context.Background(), cli)
119+
minVersion, cipherSuites, _, err := fetchTLSConfig(context.Background(), cli)
120120
if err != nil {
121121
t.Fatalf("unexpected error: %v", err)
122122
}
@@ -140,7 +140,7 @@ func TestFetchTLSConfig_NilProfile_ReturnsIntermediateDefaults(t *testing.T) {
140140
WithObjects(apiServer).
141141
Build()
142142

143-
minVersion, cipherSuites, err := fetchTLSConfig(context.Background(), cli)
143+
minVersion, cipherSuites, _, err := fetchTLSConfig(context.Background(), cli)
144144
if err != nil {
145145
t.Fatalf("unexpected error: %v", err)
146146
}
@@ -159,7 +159,7 @@ func TestFetchTLSConfig_APIServerNotFound_ReturnsDefaults(t *testing.T) {
159159
WithScheme(tlsTestScheme).
160160
Build()
161161

162-
minVersion, cipherSuites, err := fetchTLSConfig(context.Background(), cli)
162+
minVersion, cipherSuites, _, err := fetchTLSConfig(context.Background(), cli)
163163
if err != nil {
164164
t.Fatalf("unexpected error: %v", err)
165165
}
@@ -173,12 +173,48 @@ func TestFetchTLSConfig_APIServerNotFound_ReturnsDefaults(t *testing.T) {
173173
}
174174
}
175175

176+
func TestFetchTLSConfig_CustomProfile_WithGroups(t *testing.T) {
177+
apiServer := &configv1.APIServer{
178+
ObjectMeta: metav1.ObjectMeta{Name: "cluster"},
179+
Spec: configv1.APIServerSpec{
180+
TLSSecurityProfile: &configv1.TLSSecurityProfile{
181+
Type: configv1.TLSProfileCustomType,
182+
Custom: &configv1.CustomTLSProfile{
183+
TLSProfileSpec: configv1.TLSProfileSpec{
184+
MinTLSVersion: configv1.VersionTLS13,
185+
Ciphers: []string{"TLS_AES_128_GCM_SHA256"},
186+
Groups: []configv1.TLSGroup{
187+
"X25519MLKEM768",
188+
"X25519",
189+
"secp256r1",
190+
},
191+
},
192+
},
193+
},
194+
},
195+
}
196+
197+
cli := fake.NewClientBuilder().
198+
WithScheme(tlsTestScheme).
199+
WithObjects(apiServer).
200+
Build()
201+
202+
_, _, groups, err := fetchTLSConfig(context.Background(), cli)
203+
if err != nil {
204+
t.Fatalf("unexpected error: %v", err)
205+
}
206+
207+
if groups != "X25519MLKEM768,X25519,secp256r1" {
208+
t.Errorf("groups = %q, want %q", groups, "X25519MLKEM768,X25519,secp256r1")
209+
}
210+
}
211+
176212
func TestFetchTLSConfig_NoMatchError_ReturnsDefaults(t *testing.T) {
177213
cli := fake.NewClientBuilder().
178214
WithScheme(runtime.NewScheme()).
179215
Build()
180216

181-
minVersion, cipherSuites, err := fetchTLSConfig(context.Background(), cli)
217+
minVersion, cipherSuites, _, err := fetchTLSConfig(context.Background(), cli)
182218
if err != nil {
183219
t.Fatalf("unexpected error: %v", err)
184220
}

‎internal/manifests/kustomize.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ func (p *KustomizeProvider) Manifests(_ context.Context, params Params) ([]unstr
6969
}),
7070
manifestival.InjectNamespace(targetNS),
7171
replaceImage(params.OperandImage),
72-
injectTLSEnvVars(params.TLSMinVersion, params.TLSCipherSuites),
72+
injectTLSEnvVars(params.TLSMinVersion, params.TLSCipherSuites, params.TLSGroups),
7373
)
7474
if err != nil {
7575
return nil, fmt.Errorf("transforming manifests: %w", err)
@@ -120,12 +120,13 @@ func injectLabels(labels map[string]string) manifestival.Transformer {
120120
const (
121121
envTLSMinVersion = "TLS_MIN_VERSION"
122122
envTLSCipherSuites = "TLS_CIPHER_SUITES"
123+
envTLSGroups = "TLS_GROUPS"
123124
envPropagateTLS = "PROPAGATE_TLS_ENV_VARS"
124125
)
125126

126-
func injectTLSEnvVars(minVersion, cipherSuites string) manifestival.Transformer {
127+
func injectTLSEnvVars(minVersion, cipherSuites, groups string) manifestival.Transformer {
127128
return func(u *unstructured.Unstructured) error {
128-
if minVersion == "" && cipherSuites == "" {
129+
if minVersion == "" && cipherSuites == "" && groups == "" {
129130
return nil
130131
}
131132
if u.GetKind() != "Deployment" {
@@ -150,6 +151,7 @@ func injectTLSEnvVars(minVersion, cipherSuites string) manifestival.Transformer
150151
envSlice, _, _ := unstructured.NestedSlice(container, "env")
151152
envSlice = setEnvVar(envSlice, envTLSMinVersion, minVersion)
152153
envSlice = setEnvVar(envSlice, envTLSCipherSuites, cipherSuites)
154+
envSlice = setEnvVar(envSlice, envTLSGroups, groups)
153155
envSlice = setEnvVar(envSlice, envPropagateTLS, "true")
154156

155157
if err := unstructured.SetNestedSlice(container, envSlice, "env"); err != nil {

‎internal/manifests/kustomize_test.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -233,6 +233,7 @@ func TestInjectTLSEnvVars(t *testing.T) {
233233
resources, err := provider.Manifests(context.Background(), Params{
234234
TLSMinVersion: "VersionTLS12",
235235
TLSCipherSuites: "TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
236+
TLSGroups: "X25519MLKEM768,X25519,secp256r1",
236237
})
237238
if err != nil {
238239
t.Fatalf("unexpected error: %v", err)
@@ -264,6 +265,9 @@ func TestInjectTLSEnvVars(t *testing.T) {
264265
if envMap["TLS_CIPHER_SUITES"] != "TLS_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" {
265266
t.Errorf("TLS_CIPHER_SUITES = %q, want expected value", envMap["TLS_CIPHER_SUITES"])
266267
}
268+
if envMap["TLS_GROUPS"] != "X25519MLKEM768,X25519,secp256r1" {
269+
t.Errorf("TLS_GROUPS = %q, want %q", envMap["TLS_GROUPS"], "X25519MLKEM768,X25519,secp256r1")
270+
}
267271
if envMap["PROPAGATE_TLS_ENV_VARS"] != "true" {
268272
t.Errorf("PROPAGATE_TLS_ENV_VARS = %q, want 'true'", envMap["PROPAGATE_TLS_ENV_VARS"])
269273
}
@@ -293,7 +297,7 @@ func TestInjectTLSEnvVars_EmptyValues_SkipsInjection(t *testing.T) {
293297
for _, e := range envSlice {
294298
env := e.(map[string]interface{})
295299
name := env["name"].(string)
296-
if name == "TLS_MIN_VERSION" || name == "TLS_CIPHER_SUITES" || name == "PROPAGATE_TLS_ENV_VARS" {
300+
if name == "TLS_MIN_VERSION" || name == "TLS_CIPHER_SUITES" || name == "TLS_GROUPS" || name == "PROPAGATE_TLS_ENV_VARS" {
297301
t.Errorf("TLS env var %q should not be present when values are empty", name)
298302
}
299303
}

‎internal/manifests/provider.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ type Params struct {
2828
OperandImage string
2929
TLSMinVersion string
3030
TLSCipherSuites string
31+
TLSGroups string
3132
}
3233

3334
// Provider abstracts how operand manifests are obtained and transformed.

0 commit comments

Comments
 (0)