SchSeba / sriov-network-operator-1 / 27367055133

64%

master: 64%

Build Type

push

github

Committed by SchSeba

Commit Message

Add TLS group/curve preferences support from OpenShift API TLSProfileSpec

Bump openshift/api to release-5.0 which adds the Groups field to
TLSProfileSpec (openshift/api#2583). This allows configuring TLS
supported groups (formerly elliptic curves) for the TLS handshake,
including post-quantum hybrid groups like X25519MLKEM768.

Changes:
- Add CurvePreferences field to consts.TLSConfig and wire it through
  the full TLS configuration pipeline (orchestrator, controller,
  templates, webhook)
- Extract Groups from the OpenShift APIServer TLS profile and propagate
  to operand DaemonSets via --tls-curve-preferences flag
- Add TLS_CURVE_PREFERENCES env var for vanilla Kubernetes (Helm values
  and deploy manifest)
- Add ParseCurvePreferences() using openshift/api TLSGroup constants
  to map group names to tls.CurveID values
- Add TODO for kube-rbac-proxy curve preferences support (blocked on
  kube-rbac-proxy/kube-rbac-proxy#414)
- Update test CRD to CustomNoUpgrade variant with groups field
- Refactor conformance tests: extract operandTLSTarget list and
  assertAllOperandsHaveTLSArgs helper to reduce duplication
- Add unit tests for curve preferences in utils, orchestrator, and
  controller packages

Signed-off-by: Sebastian Sch <sebassch@gmail.com>

Coverage Stats

47 of 87 new or added lines in 4 files covered. (54.02%)

6 existing lines in 2 files now uncovered.

9649 of 15165 relevant lines covered (63.63%)

0.71 hits per line