CMP-4147: Use OpenShift API server TLS configuration#1106
CMP-4147: Use OpenShift API server TLS configuration#1106rhmdnd wants to merge 3 commits intoComplianceAsCode:masterfrom
Conversation
|
@rhmdnd: This pull request references CMP-4147 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhmdnd The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| } | ||
| return nil | ||
| } | ||
|
|
|
🤖 To deploy this PR, run the following command: |
|
This PR depends on #2114 and #7635. Which add the tlsAdherence helpers and API fields. |
We need to vendor in updated versions of the openshift/api and openshift/librar-go so we can implement TLS consistency. Specifically so that the Compliance Operator looks to the OpenShift API server for its TLS settings. We need to update some areas of our code affected by API changes in the new dependencies. - Update MakeSelfSignedCAConfig: The library-go MakeSelfSignedCAConfig function arguments changed. Use the correct type based on the latest versions of library-go, which which time.Duration instead of an int. - Fix prometheus label types in e2e tests: Newer versions of prometheus changed Label types. This commit updates the test code we use so that we can bump the dependency and pull in newer versions of prometheus. - Bumped the version of MCO to be compatible with newer versions of the OpenShift API, which removed several feature gate constants that MCO was using. Assisted-By: Claude Code (Opus 4.6)
The dependency updates for openshift/api and openshift/library-go pulled in new versions of structured-merge-diff (v4 -> v6), which is apparently more strict and fails with how we're using MCO in unit tests. This commit uses WithObjectTracker to bypass field management in unit tests. It also uses constants for various assertions instead of the returned objects kind or group values (which are getting reset to "" after calling Get(), which is a new behavior on controller-runtime to be consistent with what the OpenShift API server does).
Look to the OpenShift API server for TLS configuration settings instead of hardcoding our own. This makes the operator respect cluster-wide TLS settings when configured to do so.
|
🤖 To deploy this PR, run the following command: |
|
@rhmdnd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Look to the OpenShift API server for TLS configuration settings instead
of hardcoding our own. This makes the operator respect cluster-wide TLS
settings when configured to do so.