ACM-30168 Add cluster TLS profile and use it for managers and webhook#1492
ACM-30168 Add cluster TLS profile and use it for managers and webhook#1492xiangjingli merged 2 commits intomainfrom
Conversation
Introduce pkg/utils/tlsconfig to read the OpenShift cluster APIServer tlsSecurityProfile and cache a matching crypto/tls.Config for the process. Initialize that config at startup in the subscription, appsubsummary, and placementrule managers, and wire the webhook listener to use GetClusterTLSConfig(). If the APIServer resource is missing or the cluster is not OpenShift, fall back to the Intermediate TLS profile. Log profile type, MinTLSVersion, and cipher suite count after reading APIServer. Signed-off-by: Yupeng Chang <yupchang@redhat.com>
Signed-off-by: Yupeng Chang <yupchang@redhat.com>
|
@fmt47: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: fmt47, xiangjingli The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
2 participants
Jira ticket: https://redhat.atlassian.net/browse/ACM-30168
Introduce pkg/utils/tlsconfig to read the OpenShift cluster APIServer tlsSecurityProfile and cache a matching crypto/tls.Config for the process. Initialize that config at startup in the subscription, appsubsummary, and placementrule managers, and wire the webhook listener to use GetClusterTLSConfig(). If the APIServer resource is missing or the cluster is not OpenShift, fall back to the Intermediate TLS profile. Log profile type, MinTLSVersion, and cipher suite count after reading APIServer.