📖 docs: add guide for configuring TLS profile by zhujian7 · Pull Request #555 · open-cluster-management-io/open-cluster-management-io.github.io

zhujian7 · 2026-04-07T07:17:09Z

Summary

Add documentation for configuring the TLS profile (minimum TLS version and cipher suites) for OCM hub components via the ocm-tls-profile ConfigMap
Covers supported TLS versions, cipher suites, how the configuration propagates to hub components, and practical examples
Placed under Getting Started > Administration alongside existing operational guides

Related issue(s)

[doc] add a doc for configuring the tls profile ocm#1460

🤖 Generated with Claude Code

Summary by CodeRabbit

Documentation
- Added a guide for configuring OCM TLS profiles: how to set minimum TLS versions and cipher suites, supported values and defaults, TLS 1.3 behavior, addon propagation, component coverage, and kubectl examples for enforcing TLS 1.3, restricting TLS 1.2 cipher suites, and reverting to defaults.

Add documentation for configuring the TLS profile (minimum TLS version and cipher suites) for OCM hub components via the ocm-tls-profile ConfigMap. Ref: open-cluster-management-io/ocm#1460 Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com>

netlify · 2026-04-07T07:17:16Z

✅ Deploy Preview for open-cluster-management ready!

Name	Link
🔨 Latest commit	`a500378`
🔍 Latest deploy log	https://app.netlify.com/projects/open-cluster-management/deploys/69d4b2322ab6d90008ced997
😎 Deploy Preview	https://deploy-preview-555--open-cluster-management.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

coderabbitai · 2026-04-07T07:17:29Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 83f44d7f-d21f-4422-9219-b902bb765f41

📥 Commits

Reviewing files that changed from the base of the PR and between 7ef307a and a500378.

📒 Files selected for processing (1)

content/en/docs/getting-started/administration/tls-profile.md

✅ Files skipped from review due to trivial changes (1)

content/en/docs/getting-started/administration/tls-profile.md

Walkthrough

Added a new documentation page describing how to configure OCM TLS profiles via an ocm-tls-profile ConfigMap, covering operator behavior, supported minTLSVersion values, cipherSuites format and semantics, addon handling, component coverage, and kubectl examples.

Changes

Cohort / File(s)	Summary
Documentation `content/en/docs/getting-started/administration/tls-profile.md`	New documentation file explaining TLS profile configuration via an `ocm-tls-profile` `ConfigMap` for hub/spoke operators. Documents `minTLSVersion` and `cipherSuites` fields, supported TLS versions, Go TLS 1.3 behavior, operator restart/apply mechanics, addon copying, component coverage table, and example `kubectl` commands.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title mentions 'configuring TLS profile' which directly matches the documentation addition for TLS profile configuration via ConfigMap, aligning with the main objective.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@content/en/docs/getting-started/administration/tls-profile.md`:
- Around line 41-44: Add a clear security warning immediately before or after
the TLS versions table stating that VersionTLS10/VersionTLS11 (TLSv1.0/TLSv1.1)
are deprecated, insecure, and non‑compliant in many environments and should not
be used; explicitly recommend using VersionTLS12/TLSv1.2 or higher (TLSv1.2+ as
the default) and note that only TLS 1.2+ is supported/recommended for production
to meet modern security standards. Reference the existing symbols VersionTLS10,
VersionTLS11, TLSv1.0, TLSv1.1, and VersionTLS12/TLSv1.2 so readers know which
entries are affected.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 97772870-a52b-492b-b393-5b7f7d268b76

📥 Commits

Reviewing files that changed from the base of the PR and between d3fe08f and 7ef307a.

📒 Files selected for processing (1)

content/en/docs/getting-started/administration/tls-profile.md

coderabbitai · 2026-04-07T07:26:17Z

+| `VersionTLS10` or `TLSv1.0` | TLS 1.0 |
+| `VersionTLS11` or `TLSv1.1` | TLS 1.1 |
+| `VersionTLS12` or `TLSv1.2` | TLS 1.2 (**default**) |
+| `VersionTLS13` or `TLSv1.3` | TLS 1.3 |


⚠️ Potential issue | 🟠 Major

Add an explicit security warning for TLS 1.0/1.1.

These values are listed as supported, but the doc should clearly discourage them (deprecated/legacy, non-compliant in many environments) and recommend TLS 1.2+ by default.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed. In `@content/en/docs/getting-started/administration/tls-profile.md` around lines 41 - 44, Add a clear security warning immediately before or after the TLS versions table stating that VersionTLS10/VersionTLS11 (TLSv1.0/TLSv1.1) are deprecated, insecure, and non‑compliant in many environments and should not be used; explicitly recommend using VersionTLS12/TLSv1.2 or higher (TLSv1.2+ as the default) and note that only TLS 1.2+ is supported/recommended for production to meet modern security standards. Reference the existing symbols VersionTLS10, VersionTLS11, TLSv1.0, TLSv1.1, and VersionTLS12/TLSv1.2 so readers know which entries are affected.

Add spoke cluster configuration, addon agent integration, and component coverage table. Fix markdown lint warnings. Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com>

xuezhaojun · 2026-04-08T08:35:00Z

/lgtm

xuezhaojun · 2026-04-08T08:35:07Z

/approve

openshift-ci · 2026-04-08T08:35:12Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: xuezhaojun, zhujian7

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [xuezhaojun]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci Bot requested review from mikeshng and xuezhaojun April 7, 2026 07:17

coderabbitai Bot reviewed Apr 7, 2026

View reviewed changes

docs: update TLS profile guide to cover hub and spoke components

a500378

Add spoke cluster configuration, addon agent integration, and component coverage table. Fix markdown lint warnings. Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com>

openshift-ci Bot assigned xuezhaojun Apr 8, 2026

openshift-ci Bot added the lgtm label Apr 8, 2026

openshift-ci Bot added the approved label Apr 8, 2026

openshift-merge-bot Bot merged commit a4c8ad9 into open-cluster-management-io:main Apr 8, 2026
8 checks passed

Navigation Menu

Uh oh!

📖 docs: add guide for configuring TLS profile - #555

📖 docs: add guide for configuring TLS profile#555
openshift-merge-bot[bot] merged 2 commits into
open-cluster-management-io:mainfrom
zhujian7:docs/add-tls-profile-configuration

zhujian7 commented Apr 7, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

netlify Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Apr 7, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot Apr 7, 2026

Uh oh!

xuezhaojun commented Apr 8, 2026

Uh oh!

xuezhaojun commented Apr 8, 2026

Uh oh!

openshift-ci Bot commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

zhujian7 commented Apr 7, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Related issue(s)

Summary by CodeRabbit

Uh oh!

netlify Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for open-cluster-management ready!

Uh oh!

coderabbitai Bot commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Estimated code review effort

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot Apr 7, 2026

Choose a reason for hiding this comment

Uh oh!

xuezhaojun commented Apr 8, 2026

Uh oh!

xuezhaojun commented Apr 8, 2026

Uh oh!

openshift-ci Bot commented Apr 8, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

zhujian7 commented Apr 7, 2026 •

edited by coderabbitai Bot

Loading

netlify Bot commented Apr 7, 2026 •

edited

Loading

coderabbitai Bot commented Apr 7, 2026 •

edited

Loading