Skip to content

CM-966: Implement centralized TLS profile fetching and application without istio-csr changes #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arun717 wants to merge 24 commits into
base: master
Choose a base branch
from
Open

CM-966: Implement centralized TLS profile fetching and application without istio-csr changes #416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
24 commits
Select commit Hold shift + click to select a range
c7e50f4
feat(tlsprofile): add TLS profile mapping package
Apr 16, 2026
858a97e
feat(controller): add TLS profile hook for cert-manager deployments
Apr 16, 2026
3faf0c1
feat(controller): integrate TLS profile hook into deployment controller
Apr 16, 2026
f281414
chore(rbac): add APIServer resource permissions
Apr 16, 2026
6b4998d
docs(api): add certificate-request-minimum-backoff-duration flag example
Apr 16, 2026
f66bfe9
style(trustmanager): fix comment formatting
Apr 16, 2026
f192f5b
Manual conflict resolution after rebase.
Apr 17, 2026
0a34159
fix: move TLS profile hook back to deployment package
Apr 17, 2026
bf387fe
fix(rbac): restrict apiservers resource to read-only permissions
Apr 17, 2026
1bd0c0e
feat(tlsprofile): add ClientTLSConfig for outbound TLS clients
Apr 21, 2026
c8be371
Removed hardcoding of TLS in test files.
Apr 21, 2026
09fe984
wire APIServer TLSSecurityProfile into istio-csr deployment
Apr 21, 2026
f7d2cd6
fix(tlsprofile): ClientTLSConfig honors empty spec.Ciphers (nil = Go …
Apr 21, 2026
2545358
after running make update-vendor locally.
Apr 24, 2026
6ad0cc5
Removing parts dependent on istio-csr upstream changes.
Apr 29, 2026
96b6219
Addressing the coderabbit review comment for default case treated as …
May 6, 2026
91ed391
tlsprofile: deep-copy builtin profile cipher slices in EffectiveSpec.
May 6, 2026
0c5d84a
Adding nil check to avoid panic before de-referencing.
May 7, 2026
09b3700
After git rebase with master and go get of openshift api,client-go an…
May 8, 2026
17b9786
Implementation related to tlsAdherence.
May 8, 2026
04d6f88
generated code after running make commands.
May 8, 2026
772696f
Resolved conflict manually with go.work.sum
May 8, 2026
2fe33fe
Bumping k8s.io/kubernetes and the stray v0.34.4 modules to v1.35.1 / …
May 8, 2026
4c1dcb6
istiocsr: make nodeSelector error test tolerant of k8s validation wor…
May 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
1 change: 1 addition & 0 deletions api/operator/v1alpha1/certmanager_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@ type CertManagerSpec struct {
// - "--acme-http01-solver-nameservers="8.8.8.8:53,1.1.1.1:53"
// - "--dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53"
// - "--dns01-recursive-nameservers-only"
// - "--certificate-request-minimum-backoff-duration=30m"
//
// For OverrideEnvs,
// This field appends values to .spec.template.spec.containers[...].env. The container
Expand Down
8 changes: 8 additions & 0 deletions bundle/manifests/cert-manager-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,6 +562,14 @@ spec:
- sign
- update
- watch
- apiGroups:
- config.openshift.io
resources:
- apiservers
verbs:
- get
- list
- watch
- apiGroups:
- config.openshift.io
resources:
Expand Down
10 changes: 7 additions & 3 deletions bundle/manifests/operator.openshift.io_certmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,9 +289,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -324,6 +325,7 @@ spec:
- "--acme-http01-solver-nameservers="8.8.8.8:53,1.1.1.1:53"
- "--dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53"
- "--dns01-recursive-nameservers-only"
- "--certificate-request-minimum-backoff-duration=30m"

For OverrideEnvs,
This field appends values to .spec.template.spec.containers[...].env. The container
Expand Down Expand Up @@ -570,9 +572,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -1165,9 +1168,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion bundle/manifests/operator.openshift.io_istiocsrs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1335,9 +1335,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion bundle/manifests/operator.openshift.io_trustmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1185,9 +1185,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
10 changes: 7 additions & 3 deletions config/crd/bases/operator.openshift.io_certmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,9 +289,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -324,6 +325,7 @@ spec:
- "--acme-http01-solver-nameservers="8.8.8.8:53,1.1.1.1:53"
- "--dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53"
- "--dns01-recursive-nameservers-only"
- "--certificate-request-minimum-backoff-duration=30m"

For OverrideEnvs,
This field appends values to .spec.template.spec.containers[...].env. The container
Expand Down Expand Up @@ -570,9 +572,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -1165,9 +1168,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion config/crd/bases/operator.openshift.io_istiocsrs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1335,9 +1335,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion config/crd/bases/operator.openshift.io_trustmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1185,9 +1185,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
8 changes: 8 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,14 @@ rules:
- sign
- update
- watch
- apiGroups:
- config.openshift.io
resources:
- apiservers
verbs:
- get
- list
- watch
- apiGroups:
- config.openshift.io
resources:
Expand Down
37 changes: 19 additions & 18 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,20 @@ require (
github.com/cert-manager/cert-manager v1.19.4
github.com/go-logr/logr v1.4.3
github.com/google/go-cmp v0.7.0
github.com/openshift/api v0.0.0-20260105191300-d1c4dc4fd37b
github.com/openshift/client-go v0.0.0-20251205093018-96a6cbc1420c
github.com/openshift/library-go v0.0.0-20251205073205-ab8d51820e0b
github.com/openshift/api v0.0.0-20260423140559-e9fad7d4cba1
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7
github.com/openshift/library-go v0.0.0-20260429151228-ecbc792a4313
github.com/operator-framework/operator-lib v0.19.0
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/stretchr/testify v1.11.1
k8s.io/api v0.34.4
k8s.io/apiextensions-apiserver v0.34.4
k8s.io/apimachinery v0.34.4
k8s.io/client-go v0.34.4
k8s.io/component-base v0.34.4
k8s.io/api v0.35.1
k8s.io/apiextensions-apiserver v0.35.1
k8s.io/apimachinery v0.35.1
k8s.io/client-go v0.35.1
k8s.io/component-base v0.35.1
k8s.io/klog/v2 v2.130.1
k8s.io/kubernetes v1.34.4
k8s.io/kubernetes v1.35.1
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/controller-runtime v0.22.4
sigs.k8s.io/structured-merge-diff/v6 v6.3.1
Expand Down Expand Up @@ -86,12 +86,13 @@ require (
github.com/prometheus/common v0.66.1 // indirect
github.com/prometheus/procfs v0.17.0 // indirect
github.com/robfig/cron v1.2.0 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/stoewer/go-strcase v1.3.1 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.4 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
go.etcd.io/etcd/client/v3 v3.6.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/v3 v3.6.5 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
Expand Down Expand Up @@ -125,13 +126,13 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiserver v0.34.4 // indirect
k8s.io/component-helpers v0.34.4 // indirect
k8s.io/controller-manager v0.34.4 // indirect
k8s.io/kms v0.34.4 // indirect
k8s.io/kube-aggregator v0.34.4 // indirect
k8s.io/apiserver v0.35.1 // indirect
k8s.io/component-helpers v0.35.1 // indirect
k8s.io/controller-manager v0.35.1 // indirect
k8s.io/kms v0.35.1 // indirect
k8s.io/kube-aggregator v0.35.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/kubelet v0.34.4 // indirect
k8s.io/kubelet v0.35.1 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect
sigs.k8s.io/gateway-api v1.4.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
Expand Down
Loading