Skip to content

CM-966: Implement centralized TLS profile fetching and application without istio-csr changes #416

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 14 commits into from
Jun 15, 2026
Merged

CM-966: Implement centralized TLS profile fetching and application without istio-csr changes #416

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
b85ae6a
feat: apply cluster TLS security profile to cert-manager operands
May 20, 2026
9d24230
deps: bump OpenShift and Kubernetes deps for tlsAdherence support
May 20, 2026
8b80dfa
test: add TLS profile coverage and address review feedback
May 20, 2026
2229d50
refactor: move TLS profile deployment hook into controller/common, al…
May 20, 2026
2bd2f32
e2e: use dedicated vaultSetupTimeout for Vault issuer setup
May 26, 2026
a9890e7
e2e: extend Vault pod wait and improve setup failure diagnostics
May 26, 2026
0955f00
fix: resolve TLS profile only when tlsAdherence requires it
Jun 9, 2026
ce89822
Addressed PR review comments.
Jun 9, 2026
23e0f06
fix(istiocsr): recreate deleted RBAC with stable names from status
Jun 10, 2026
4e05373
test: add library-go as direct dependency in test module
Jun 10, 2026
2ceb8a6
fix: let unsupportedConfigOverrides override cluster TLS args
Jun 10, 2026
383d5ac
fix(e2e): use restricted security context for Vault Helm installer pod
Jun 11, 2026
74c7ec7
test(e2e): patch apiserver TLS profile and label TechPreview suite
Jun 11, 2026
78e872e
fix(e2e): set runAsUser on Vault Helm installer pod
Jun 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
6 changes: 3 additions & 3 deletions .golangci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,11 +130,11 @@ linters:
linters:
- godot
# Exclude false positive hardcoded credential warnings (these are paths, not credentials)
- path: pkg/controller/deployment/credentials_request.go
- path: pkg/controller/certmanager/credentials_request.go
text: "gcpCredentialsDir|cloudCredentialsVolumeName"
linters:
- gosec
- path: pkg/controller/deployment/deployment_overrides.go
- path: pkg/controller/certmanager/deployment_overrides.go
text: "boundSATokenDir"
linters:
- gosec
Expand All @@ -150,7 +150,7 @@ linters:
# Exclude unparam for functions that may be part of interfaces
- linters:
- unparam
path: pkg/controller/deployment/
path: pkg/controller/certmanager/
settings:
wrapcheck:
# Ignore errors returned from these packages - they are either internal or
Expand Down
6 changes: 3 additions & 3 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,9 +5,9 @@ This repository contains Cert Manager Operator designed for OpenShift. The opera
## The operator architecture and design assumptions

The Operator uses the [upstream deployment manifests](https://github.com/cert-manager/cert-manager/releases). It divides them into separate files and deploys using 3 controllers:
- [cert_manager_cainjector_deployment.go](pkg/controller/deployment/cert_manager_cainjector_deployment.go)
- [cert_manager_controller_deployment.go](pkg/controller/deployment/cert_manager_controller_deployment.go)
- [cert_manager_webhook_deployment.go](pkg/controller/deployment/cert_manager_webhook_deployment.go)
- [cert_manager_cainjector_deployment.go](pkg/controller/certmanager/cert_manager_cainjector_deployment.go)
- [cert_manager_controller_deployment.go](pkg/controller/certmanager/cert_manager_controller_deployment.go)
- [cert_manager_webhook_deployment.go](pkg/controller/certmanager/cert_manager_webhook_deployment.go)

The Operator automatically deploys a cluster-scoped `CertManager` object named `cluster` if it's missing (with default values).

Expand Down
8 changes: 8 additions & 0 deletions bundle/manifests/cert-manager-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -562,6 +562,14 @@ spec:
- sign
- update
- watch
- apiGroups:
- config.openshift.io
resources:
- apiservers
verbs:
- get
- list
- watch
- apiGroups:
- config.openshift.io
resources:
Expand Down
9 changes: 6 additions & 3 deletions bundle/manifests/operator.openshift.io_certmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,9 +289,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -570,9 +571,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -1165,9 +1167,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion bundle/manifests/operator.openshift.io_istiocsrs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1335,9 +1335,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion bundle/manifests/operator.openshift.io_trustmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1185,9 +1185,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
9 changes: 6 additions & 3 deletions config/crd/bases/operator.openshift.io_certmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -289,9 +289,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -570,9 +571,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down Expand Up @@ -1165,9 +1167,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion config/crd/bases/operator.openshift.io_istiocsrs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1335,9 +1335,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
3 changes: 2 additions & 1 deletion config/crd/bases/operator.openshift.io_trustmanagers.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1185,9 +1185,10 @@ spec:
operator:
description: |-
Operator represents a key's relationship to the value.
Valid operators are Exists and Equal. Defaults to Equal.
Valid operators are Exists, Equal, Lt, and Gt. Defaults to Equal.
Exists is equivalent to wildcard for value, so that a pod can
tolerate all taints of a particular category.
Lt and Gt perform numeric comparisons (requires feature gate TaintTolerationComparisonOperators).
type: string
tolerationSeconds:
description: |-
Expand Down
8 changes: 8 additions & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -153,6 +153,14 @@ rules:
- sign
- update
- watch
- apiGroups:
- config.openshift.io
resources:
- apiservers
verbs:
- get
- list
- watch
- apiGroups:
- config.openshift.io
resources:
Expand Down
37 changes: 19 additions & 18 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,20 +6,20 @@ require (
github.com/cert-manager/cert-manager v1.19.4
github.com/go-logr/logr v1.4.3
github.com/google/go-cmp v0.7.0
github.com/openshift/api v0.0.0-20260105191300-d1c4dc4fd37b
github.com/openshift/client-go v0.0.0-20251205093018-96a6cbc1420c
github.com/openshift/library-go v0.0.0-20251205073205-ab8d51820e0b
github.com/openshift/api v0.0.0-20260423140559-e9fad7d4cba1
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7
github.com/openshift/library-go v0.0.0-20260429151228-ecbc792a4313
github.com/operator-framework/operator-lib v0.19.0
github.com/spf13/cobra v1.10.2
github.com/spf13/pflag v1.0.10
github.com/stretchr/testify v1.11.1
k8s.io/api v0.34.4
k8s.io/apiextensions-apiserver v0.34.4
k8s.io/apimachinery v0.34.4
k8s.io/client-go v0.34.4
k8s.io/component-base v0.34.4
k8s.io/api v0.35.1
k8s.io/apiextensions-apiserver v0.35.1
k8s.io/apimachinery v0.35.1
k8s.io/client-go v0.35.1
k8s.io/component-base v0.35.1
k8s.io/klog/v2 v2.130.1
k8s.io/kubernetes v1.34.4
k8s.io/kubernetes v1.35.1
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/controller-runtime v0.22.4
sigs.k8s.io/structured-merge-diff/v6 v6.3.1
Expand Down Expand Up @@ -86,12 +86,13 @@ require (
github.com/prometheus/common v0.66.1 // indirect
github.com/prometheus/procfs v0.17.0 // indirect
github.com/robfig/cron v1.2.0 // indirect
github.com/robfig/cron/v3 v3.0.1 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/stoewer/go-strcase v1.3.1 // indirect
github.com/x448/float16 v0.8.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.4 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.4 // indirect
go.etcd.io/etcd/client/v3 v3.6.4 // indirect
go.etcd.io/etcd/api/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/pkg/v3 v3.6.5 // indirect
go.etcd.io/etcd/client/v3 v3.6.5 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
Expand Down Expand Up @@ -125,13 +126,13 @@ require (
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/natefinch/lumberjack.v2 v2.2.1 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
k8s.io/apiserver v0.34.4 // indirect
k8s.io/component-helpers v0.34.4 // indirect
k8s.io/controller-manager v0.34.4 // indirect
k8s.io/kms v0.34.4 // indirect
k8s.io/kube-aggregator v0.34.4 // indirect
k8s.io/apiserver v0.35.1 // indirect
k8s.io/component-helpers v0.35.1 // indirect
k8s.io/controller-manager v0.35.1 // indirect
k8s.io/kms v0.35.1 // indirect
k8s.io/kube-aggregator v0.35.1 // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
k8s.io/kubelet v0.34.4 // indirect
k8s.io/kubelet v0.35.1 // indirect
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 // indirect
sigs.k8s.io/gateway-api v1.4.0 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
Expand Down
Loading