SchSeba / sriov-network-operator-1 / 27572961038

64%

master: 64%

Build Type

push

github

Committed by SchSeba

Commit Message

Add TLS group/curve preferences support from OpenShift API TLSProfileSpec

Bump openshift/api to release-5.0 which adds the Groups field to
TLSProfileSpec (openshift/api#2583). This allows configuring TLS
supported groups (formerly elliptic curves) for the TLS handshake,
including post-quantum hybrid groups like X25519MLKEM768.

Changes:
- Add CurvePreferences field to consts.TLSConfig and wire it through
  the full TLS configuration pipeline (orchestrator, controller,
  templates, webhook)
- Extract Groups from the OpenShift APIServer TLS profile and propagate
  to operand DaemonSets via --tls-curve-preferences flag
- Operator converts group names to numeric CurveID values before
  passing to the webhook, matching the Kubernetes apiserver pattern
  (fs.Int32SliceVar for --tls-curve-preferences)
- Webhook accepts numeric Go crypto/tls CurveID values directly
  (e.g. 29,23,24) without hardcoded validation; supported values
  depend on the Go version used
- Add TLS_CURVE_PREFERENCES env var for vanilla Kubernetes (Helm values
  and deploy manifest)
- Add CurveNamesToIDs() to convert group names to numeric IDs in the
  operator controller before rendering webhook manifests
- Add ParseCurvePreferencesFromIDs() for the webhook to parse numeric
  CurveID values into []tls.CurveID
- Add TODO for kube-rbac-proxy curve preferences support (blocked on
  kube-rbac-proxy/kube-rbac-proxy#414)
- Update test CRD to CustomNoUpgrade variant with groups field
- Refactor conformance tests: extract operandTLSTarget list and
  assertAllOperandsHaveTLSArgs helper to reduce duplication
- Add unit tests for curve preferences in utils, orchestrator, and
  controller packages

Signed-off-by: Sebastian Sch <sebassch@gmail.com>

Coverage Stats

66 of 113 new or added lines in 4 files covered. (58.41%)

13 existing lines in 5 files now uncovered.

9657 of 15191 relevant lines covered (63.57%)

0.71 hits per line