kubevirt / hyperconverged-cluster-operator / 29687618926

81%

push

github

netresinjector: Propagate TLS security profile to deploymentCluster tls (#4399)

* netresinjector: Bump image to v1.9.0

ghcr.io/k8snetworkplumbingwg/network-resources-injector:1.8.0
image does not support the TLS CLI flags needed for cluster TLS
security profile integration. It also has a bug [1].

Bump image to version 1.9.0 which includes -tls-min-version
and -tls-cipher-suites support.
It also includes a fix for [1].

[1] https://redhat.atlassian.net/browse/OCPBUGS-96963

Signed-off-by: Nir Dothan <ndothan@redhat.com>

Assisted by: Claude Sonnet 4.5 <noreply@anthropic.com>

* netresinjector: Propagate TLS security profile to deployment

The network-resources-injector webhook needs to honor the cluster's
TLS security profile, just like other HCO-managed endpoints (AIE,
console-plugin, apiserver-proxy).

Read the TLS security profile from the HCO CR, convert cipher names
to IANA format, and pass -tls-min-version and -tls-cipher-suites
args to the webhook container. Cipher suites are omitted when the
minimum TLS version is 1.3 (not configurable in that mode).

Signed-off-by: Nir Dothan <ndothan@redhat.com>

Assisted by: Claude Sonnet 4.5 <noreply@anthropic.com>

23 of 23 new or added lines in 1 file covered. (100.0%)

11532 of 14114 relevant lines covered (81.71%)

2.17 hits per line