Skip to content

Commit 018856d

Browse files
enarhaenarha
committed
Add centralized TLS configuration infrastructure
Add support for centralized TLS configuration derived from the OpenShift APIServer TLS security profile. This enables Tekton components to inherit cluster-wide TLS settings (minimum version, cipher suites) via the TektonConfig CR. Key changes: - Watch the APIServer resource for TLS profile changes and enqueue TektonConfig for reconciliation - Add GetTLSProfileFromAPIServer and TLSEnvVarsFromProfile to extract and convert TLS profiles to environment variables - Add ResolveCentralTLSToEnvVars and InjectTLSEnvVars as reusable helpers for component extensions - Add EnableCentralTLSConfig flag in TektonConfig OpenShift platform spec (opt-in, default false) - Add GetPlatformData to the Extension interface for platform-specific hash data (e.g., TLS config fingerprint) - Add RBAC permissions for reading the APIServer resource Note: curve preferences (CurvePreferences) are currently omitted and default to Go's standard library values until openshift/api#2583 is merged. Assisted-by: Cursor
1 parent 306d5ab commit 018856d

File tree

920 files changed

+209703
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

920 files changed

+209703
-0
lines changed

‎config/openshift/base/role.yaml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -396,3 +396,12 @@ rules:
396396
- delete
397397
- update
398398
- patch
399+
# to read cluster TLS security profile for centralized TLS configuration
400+
- apiGroups:
401+
- config.openshift.io
402+
resources:
403+
- apiservers
404+
verbs:
405+
- get
406+
- list
407+
- watch

‎docs/OpenShiftCentralizedTLSManagement.md‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
# Centralized TLS Configuration Support
2+
3+
This change adds support for centralized TLS configuration from OpenShift's APIServer resource, enabling Tekton components to inherit TLS settings (minimum version, cipher suites, curve preferences) from the cluster-wide security policy.
4+
5+
## Key Changes
6+
7+
### 1. New Configuration Flag
8+
9+
- Added `EnableCentralTLSConfig` boolean field to `TektonConfig.Spec.Platforms.OpenShift`
10+
- When enabled, TLS settings from the cluster's APIServer are automatically injected into supported components
11+
- Default: `false` (opt-in)
12+
13+
### 2. APIServer Watcher
14+
15+
- Single centralized watcher in TektonConfig controller monitors the APIServer cluster resource
16+
- Uses a shared informer with 30-minute resync interval
17+
- When APIServer TLS profile changes, enqueues TektonConfig for reconciliation
18+
19+
### 3. Extension Interface Enhancement
20+
21+
- Added `GetPlatformData() string` method to the Extension interface
22+
- Enables components to include platform-specific data in installer set hash computation
23+
- Triggers installer set updates when TLS configuration changes
24+
25+
### 4. TektonResult Integration
26+
27+
- First component to support centralized TLS configuration
28+
- Injects `TLS_MIN_VERSION`, `TLS_CIPHER_SUITES`, and `TLS_CURVE_PREFERENCES` environment variables into the Results API deployment
29+
30+
## TLS Configuration Flow
31+
32+
```
33+
┌─────────────────────────────────────────────────────────────────────────────┐
34+
│ INITIALIZATION │
35+
├─────────────────────────────────────────────────────────────────────────────┤
36+
│ │
37+
│ 1. TektonConfig Controller starts │
38+
│ └─► setupAPIServerTLSWatch() creates shared informer for APIServer │
39+
│ └─► Stores lister in occommon.SetSharedAPIServerLister() │
40+
│ └─► Registers event handler to enqueue TektonConfig on changes │
41+
│ │
42+
└─────────────────────────────────────────────────────────────────────────────┘
43+
44+
┌─────────────────────────────────────────────────────────────────────────────┐
45+
│ RECONCILIATION │
46+
├─────────────────────────────────────────────────────────────────────────────┤
47+
│ │
48+
│ 2. TektonResult reconciliation triggered │
49+
│ │ │
50+
│ ▼ │
51+
│ 3. Extension.PreReconcile(ctx) called │
52+
│ │ │
53+
│ ├─► resolveTLSConfig(ctx) │
54+
│ │ ├─► Check TektonConfig.Spec.Platforms.OpenShift.EnableCentralTLSConfig│
55+
│ │ │ └─► If false, return nil (no central TLS) │
56+
│ │ │ │
57+
│ │ └─► occommon.GetTLSEnvVarsFromAPIServer(ctx) │
58+
│ │ ├─► Read from shared APIServer lister (no API call) │
59+
│ │ ├─► Use library-go's ObserveTLSSecurityProfile() │
60+
│ │ └─► Return TLSEnvVars{MinVersion, CipherSuites, CurvePreferences}│
61+
│ │ │
62+
│ └─► Store result in oe.resolvedTLSConfig │
63+
│ └─► Log: "Injecting central TLS config: MinVersion=..." │
64+
│ │
65+
│ 4. Hash computation includes Extension.GetPlatformData() │
66+
│ └─► Returns fingerprint: "MinVersion:CipherSuites:CurvePreferences" │
67+
│ └─► Change in TLS config → different hash → installer set update │
68+
│ │
69+
│ 5. Extension.Transformers() called │
70+
│ └─► If resolvedTLSConfig != nil: │
71+
│ └─► Add injectTLSConfig() transformer │
72+
│ │
73+
│ 6. Manifests transformed │
74+
│ └─► injectTLSConfig() adds env vars to Results API deployment: │
75+
│ ├─► TLS_MIN_VERSION │
76+
│ ├─► TLS_CIPHER_SUITES │
77+
│ └─► TLS_CURVE_PREFERENCES │
78+
│ │
79+
└─────────────────────────────────────────────────────────────────────────────┘
80+
81+
┌─────────────────────────────────────────────────────────────────────────────┐
82+
│ AUTOMATIC UPDATES │
83+
├─────────────────────────────────────────────────────────────────────────────┤
84+
│ │
85+
│ 7. When APIServer TLS profile changes: │
86+
│ └─► Informer event handler triggers │
87+
│ └─► Enqueues TektonConfig for reconciliation │
88+
│ └─► TektonResult reconciled with new TLS config │
89+
│ └─► New hash computed → InstallerSet updated │
90+
│ └─► Deployment updated with new env vars │
91+
│ │
92+
└─────────────────────────────────────────────────────────────────────────────┘
93+
```

‎go.mod‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ require (
1616
github.com/openshift/api v0.0.0-20240521185306-0314f31e7774
1717
github.com/openshift/apiserver-library-go v0.0.0-20230816171015-6bfafa975bfb
1818
github.com/openshift/client-go v0.0.0-20240523113335-452272e0496d
19+
github.com/openshift/library-go v0.0.0-20230503173034-95ca3c14e50a
1920
github.com/sigstore/cosign/v2 v2.6.2
2021
github.com/spf13/cobra v1.10.2
2122
github.com/spf13/viper v1.21.0
@@ -141,10 +142,12 @@ require (
141142
github.com/dustin/go-humanize v1.0.1 // indirect
142143
github.com/emicklei/go-restful/v3 v3.13.0 // indirect
143144
github.com/emicklei/proto v1.14.2 // indirect
145+
github.com/evanphx/json-patch v5.9.0+incompatible // indirect
144146
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
145147
github.com/felixge/httpsnoop v1.0.4 // indirect
146148
github.com/fsnotify/fsnotify v1.9.0 // indirect
147149
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
150+
github.com/ghodss/yaml v1.0.0 // indirect
148151
github.com/go-chi/chi/v5 v5.2.4 // indirect
149152
github.com/go-ini/ini v1.67.0 // indirect
150153
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
@@ -199,6 +202,7 @@ require (
199202
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
200203
github.com/hashicorp/golang-lru v1.0.2 // indirect
201204
github.com/henvic/httpretty v0.0.6 // indirect
205+
github.com/imdario/mergo v0.3.11 // indirect
202206
github.com/in-toto/attestation v1.1.2 // indirect
203207
github.com/in-toto/in-toto-golang v0.9.0 // indirect
204208
github.com/inconshreveable/mousetrap v1.1.0 // indirect
@@ -250,6 +254,7 @@ require (
250254
github.com/protocolbuffers/txtpbfmt v0.0.0-20251016062345-16587c79cd91 // indirect
251255
github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
252256
github.com/rivo/uniseg v0.4.7 // indirect
257+
github.com/robfig/cron v1.2.0 // indirect
253258
github.com/rogpeppe/go-internal v1.14.1 // indirect
254259
github.com/sagikazarmark/locafero v0.11.0 // indirect
255260
github.com/sassoftware/relic v7.2.1+incompatible // indirect
@@ -316,13 +321,17 @@ require (
316321
gopkg.in/inf.v0 v0.9.1 // indirect
317322
gopkg.in/ini.v1 v1.67.1 // indirect
318323
gopkg.in/yaml.v2 v2.4.0 // indirect
324+
k8s.io/apiserver v0.34.1 // indirect
325+
k8s.io/component-base v0.34.1 // indirect
319326
k8s.io/gengo/v2 v2.0.0-20250820003526-c297c0c1eb9d // indirect
320327
k8s.io/klog/v2 v2.130.1 // indirect
328+
k8s.io/kube-aggregator v0.34.1 // indirect
321329
k8s.io/kube-openapi v0.0.0-20251125145642-4e65d59e963e // indirect
322330
knative.dev/hack v0.0.0-20250331013814-c577ed9f7775 // indirect
323331
sigs.k8s.io/controller-runtime v0.22.4 // indirect
324332
sigs.k8s.io/gateway-api v1.4.1 // indirect
325333
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
334+
sigs.k8s.io/kube-storage-version-migrator v0.0.4 // indirect
326335
sigs.k8s.io/randfill v1.0.0 // indirect
327336
sigs.k8s.io/release-utils v0.12.3 // indirect
328337
sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect

0 commit comments

Comments
 (0)