SchSeba / sriov-network-operator-1

64%

master: 64%

LAST BUILD ON BRANCH support_post_quantum

branch: support_post_quantum

CHANGE BRANCH

x

Reset

Sync Branches

• support_post_quantum
• add_device_injector_validation
• add_hugepages_func_test
• add_logs
• add_mtu_func_test
• add_predicate_for_nodes
• add_rbac_to_nri
• add_rdma_documentation
• add_resync
• add_retry_on_delete
• allow_to_remove_default_pool
• block_resource_injector
• bug_remove_nic_config_from_host
• bump-dependencies-pr1027
• bump_cni_version
• bump_controller_runtime_0.20.2
• bump_ginkgo_version
• bump_k8s_1.30
• bump_k8s_version_ci
• bump_kube-rbac-proxy_v0.21.2
• bump_mock_package
• bump_ocp_version_4.18
• bumps_1.24
• change_vlan_max
• check_MCP_after_pod_restart
• check_lock_down_on_mlx_plugin
• ci_improvements
• clean_ci_images
• conditions/github-action-update
• conditions/network-crds
• conditions/nodestate
• conditions/operator-config
• conditions/operator-config-v2
• conditions/policy-poolconfig
• conditions/redeploy-script-fix
• create_desing_proposal_template
• create_platform_and_orchestrator_packages
• daemon_redesign
• design_conditions
• design_conditions_implementation
• design_externally_manage
• device_plugin_redesign
• devtask-d6444829-add-corerabbit-yaml-configuration-for-th
• documentation-re-org
• documentation_update
• drain-controller-test-fix
• drain_controller
• drain_daemon
• drain_improve
• enable_delve
• enable_feature_gate
• enable_mtu_test
• extend_time
• externally_manage
• externally_manage_tests
• fast-leader-election
• fix-webhook-image-user
• fix_aws_test
• fix_device_plugin_label
• fix_drain_handler
• fix_drain_issue
• fix_drain_issue_v2
• fix_empty_nodeselector_in_policy
• fix_githubaction_artifact
• fix_ip_link_command_tests
• fix_k8s_ci
• fix_k8s_ci_multus
• fix_k8s_ci_virtual_cluster
• fix_k8s_ci_virtual_cluster_1
• fix_lock_race
• fix_log_test
• fix_matchcondition
• fix_mlx_plugin
• fix_mlx_plugin_1
• fix_mtu_disconnected_test
• fix_mtu_test_1
• fix_ocp_ci
• fix_ocp_ci_login
• fix_policy_order
• fix_race_condition
• fix_rdma_test
• fix_render
• fix_return_error
• fix_root_device_overlap
• fix_sriov_test_for_sno
• fix_status_patch
• fix_test
• fix_unittest
• fix_virtual_cluster_script
• fix_waiting_for_dp_when_no_policy
• fix_webhook
• func_e2e_fixes
• improve_drain_check
• improve_hypershift_check
• improve_logs
• improve_nic_selection
• install_kmod_for_mstfwreset
• interface_redesign
• master
• move_systemd_to_host_package
• multiple_bumps
• ocpbugs-64886
• parallel_drain
• parallel_drain_design
• platform_and_orchestrator_packages_design
• rdma-functest
• rdma-subsytem-mode
• readd_altname_docs
• reduce_rbac_resource_injector
• refs/pull/3/merge
• remove_DP_from_nodestate_spec
• remove_client
• remove_drain_on_none_vfs
• remove_leader_election
• remove_leader_election_test
• remove_timeout
• run_make_bundle
• security_improvements
• skip_drain_on_reboot
• skip_drain_on_reboot_single_node
• skip_virtual_nic_udev
• support_BF2_connectx
• support_PSA
• support_aws
• support_ib_netlink
• support_k8s_cluster_version
• support_vfio_ib_in_webhook
• support_virtual_cluster
• sync-2025-02-03
• systemd
• temp_fix_ocp_ci
• test-separate-daemon-drain-fixes
• unit_test_no_mock
• unit_tests
• unit_tests_1
• update_bundle_to_stable
• update_ci_system
• update_github_actions
• update_ocp_ci_version
• use_context_to_annotate
• virtual_webhook

Build # 27572961038

Build Type

push

github

Committed by SchSeba

Commit Message

Add TLS group/curve preferences support from OpenShift API TLSProfileSpec

Bump openshift/api to release-5.0 which adds the Groups field to
TLSProfileSpec (openshift/api#2583). This allows configuring TLS
supported groups (formerly elliptic curves) for the TLS handshake,
including post-quantum hybrid groups like X25519MLKEM768.

Changes:
- Add CurvePreferences field to consts.TLSConfig and wire it through
  the full TLS configuration pipeline (orchestrator, controller,
  templates, webhook)
- Extract Groups from the OpenShift APIServer TLS profile and propagate
  to operand DaemonSets via --tls-curve-preferences flag
- Operator converts group names to numeric CurveID values before
  passing to the webhook, matching the Kubernetes apiserver pattern
  (fs.Int32SliceVar for --tls-curve-preferences)
- Webhook accepts numeric Go crypto/tls CurveID values directly
  (e.g. 29,23,24) without hardcoded validation; supported values
  depend on the Go version used
- Add TLS_CURVE_PREFERENCES env var for vanilla Kubernetes (Helm values
  and deploy manifest)
- Add CurveNamesToIDs() to convert group names to numeric IDs in the
  operator controller before rendering webhook manifests
- Add ParseCurvePreferencesFromIDs() for the webhook to parse numeric
  CurveID values into []tls.CurveID
- Add TODO for kube-rbac-proxy curve preferences support (blocked on
  kube-rbac-proxy/kube-rbac-proxy#414)
- Update test CRD to CustomNoUpgrade variant with groups field
- Refactor conformance tests: extract operandTLSTarget list and
  assertAllOperandsHaveTLSArgs helper to reduce duplication
- Add unit tests for curve preferences in utils, orchestrator, and
  controller packages

Signed-off-by: Sebastian Sch <sebassch@gmail.com>

Coverage Stats

66 of 113 new or added lines in 4 files covered. (58.41%)

13 existing lines in 5 files now uncovered.

9657 of 15191 relevant lines covered (63.57%)

0.71 hits per line