refactor(grpc): simplify CipherSuites to a comma-separated string

Change CipherSuites from []string to string, eliminating the
split-then-join round-trip between ApplyTLSFlags and validateCipherSuites.
The string is passed directly to pkgtls.ParseCipherSuites without
intermediate conversions.

Signed-off-by: Jia Zhu <jiazhu@redhat.com>
Signed-off-by: zhujian <jiazhu@redhat.com>

Author: zhujian7

pkg/server/grpc/options.go

@@ -5,7 +5,6 @@ import (
 	"fmt"
 	"math"
 	"os"
-	"strings"
 	"time"
 
 	"github.com/spf13/pflag"
@@ -21,7 +20,7 @@ type GRPCServerOptions struct {
 	ClientCAFile            string        `json:"client_ca_file" yaml:"client_ca_file"`
 	TLSMinVersion           uint16        `json:"tls_min_version" yaml:"tls_min_version"`
 	TLSMaxVersion           uint16        `json:"tls_max_version" yaml:"tls_max_version"`
-	CipherSuites            []string      `json:"cipher_suites" yaml:"cipher_suites"`
+	CipherSuites            string        `json:"cipher_suites" yaml:"cipher_suites"`
 	ServerBindPort          string        `json:"server_bind_port" yaml:"server_bind_port"`
 	MaxConcurrentStreams    uint32        `json:"max_concurrent_streams" yaml:"max_concurrent_streams"`
 	MaxReceiveMessageSize   int           `json:"max_receive_message_size" yaml:"max_receive_message_size"`
@@ -118,7 +117,7 @@ func (o *GRPCServerOptions) Validate() error {
 		return fmt.Errorf("cert_watch_interval (%v) must be greater than 30 seconds", o.CertWatchInterval)
 	}
 
-	return o.validateCipherSuites()
+	return o.parseCipherSuiteIDs()
 }
 
 // ApplyTLSFlags overrides TLS settings loaded from the config file with values
@@ -133,22 +132,18 @@ func (o *GRPCServerOptions) ApplyTLSFlags(minVersion, cipherSuites string) error
 		o.TLSMinVersion = ver
 	}
 	if cipherSuites != "" {
-		o.CipherSuites = strings.Split(cipherSuites, ",")
-		for i := range o.CipherSuites {
-			o.CipherSuites[i] = strings.TrimSpace(o.CipherSuites[i])
-		}
+		o.CipherSuites = cipherSuites
 	}
 	return o.Validate()
 }
 
-// validateCipherSuites parses CipherSuites IANA names into uint16 IDs
+// parseCipherSuiteIDs converts the CipherSuites IANA names into uint16 IDs
 // using the shared pkg/tls parsing utilities.
-func (o *GRPCServerOptions) validateCipherSuites() error {
-	if len(o.CipherSuites) == 0 {
+func (o *GRPCServerOptions) parseCipherSuiteIDs() error {
+	if o.CipherSuites == "" {
 		return nil
 	}
-	cipherString := strings.Join(o.CipherSuites, ",")
-	ids, unsupported := pkgtls.ParseCipherSuites(cipherString)
+	ids, unsupported := pkgtls.ParseCipherSuites(o.CipherSuites)
 	if len(unsupported) > 0 {
 		return fmt.Errorf("unrecognized cipher suite: %s", unsupported[0])
 	}

pkg/server/grpc/options_test.go

@@ -248,7 +248,7 @@ func TestApplyTLSFlags(t *testing.T) {
 		expectErr       bool
 		errorContains   string
 		expectedMinVer  uint16
-		expectedCiphers []string
+		expectedCipherCount int
 	}{
 		{
 			name:           "valid min version override",
@@ -264,7 +264,7 @@ func TestApplyTLSFlags(t *testing.T) {
 			name:            "valid cipher suite override",
 			cipherSuites:    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 			expectedMinVer:  tls.VersionTLS12,
-			expectedCiphers: []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"},
+			expectedCipherCount: 2,
 		},
 		{
 			name:          "invalid min version",
@@ -283,7 +283,7 @@ func TestApplyTLSFlags(t *testing.T) {
 			minVersion:      "VersionTLS12",
 			cipherSuites:    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 			expectedMinVer:  tls.VersionTLS12,
-			expectedCiphers: []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"},
+			expectedCipherCount: 1,
 		},
 		{
 			name:           "empty strings are no-ops",
@@ -296,7 +296,7 @@ func TestApplyTLSFlags(t *testing.T) {
 			minVersion:      "VersionTLS12",
 			cipherSuites:    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
 			expectedMinVer:  tls.VersionTLS12,
-			expectedCiphers: []string{"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"},
+			expectedCipherCount: 1,
 		},
 	}
 
@@ -324,12 +324,9 @@ func TestApplyTLSFlags(t *testing.T) {
 				t.Errorf("expected TLSMinVersion %d, got %d", tt.expectedMinVer, opts.TLSMinVersion)
 			}
 
-			if len(tt.expectedCiphers) > 0 {
-				if len(opts.CipherSuites) != len(tt.expectedCiphers) {
-					t.Errorf("expected %d cipher suites, got %d", len(tt.expectedCiphers), len(opts.CipherSuites))
-				}
-				if len(opts.cipherSuiteIDs) != len(tt.expectedCiphers) {
-					t.Errorf("expected %d parsed cipher IDs, got %d", len(tt.expectedCiphers), len(opts.cipherSuiteIDs))
+			if tt.expectedCipherCount > 0 {
+				if len(opts.cipherSuiteIDs) != tt.expectedCipherCount {
+					t.Errorf("expected %d parsed cipher IDs, got %d", tt.expectedCipherCount, len(opts.cipherSuiteIDs))
 				}
 			}
 		})
@@ -340,7 +337,7 @@ func TestApplyTLSFlags_OverridesConfigFile(t *testing.T) {
 	opts := NewGRPCServerOptions()
 	// Simulate config file values
 	opts.TLSMinVersion = tls.VersionTLS12
-	opts.CipherSuites = []string{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"}
+	opts.CipherSuites = "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
 
 	// Flags override
 	err := opts.ApplyTLSFlags("VersionTLS13",
@@ -352,9 +349,6 @@ func TestApplyTLSFlags_OverridesConfigFile(t *testing.T) {
 	if opts.TLSMinVersion != tls.VersionTLS13 {
 		t.Errorf("expected TLSMinVersion TLS 1.3, got %d", opts.TLSMinVersion)
 	}
-	if len(opts.CipherSuites) != 2 {
-		t.Errorf("expected 2 cipher suites, got %d", len(opts.CipherSuites))
-	}
 	if len(opts.cipherSuiteIDs) != 2 {
 		t.Errorf("expected 2 parsed cipher IDs, got %d", len(opts.cipherSuiteIDs))
 	}