Skip to content

feat: Configuring TLS options from Central TLS Profile #1184

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
akhilnittala wants to merge 11 commits into
base: master
Choose a base branch
from
Open

feat: Configuring TLS options from Central TLS Profile #1184

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
f227e75
Configuring TLS options from Central TLS Profile and ArgoCD CR
akhilnittala Jun 4, 2026
8ac93d3
Configuring TLS options from Central TLS Profile and ArgoCD CR
akhilnittala Jun 4, 2026
a5aa76e
Configuring TLS options from Central TLS Profile and ArgoCD CR
akhilnittala Jun 4, 2026
d15c5a1
Configuring TLS options from Central TLS Profile and ArgoCD CR
akhilnittala Jun 4, 2026
22f5319
Configuring TLS options from Central TLS Profile and ArgoCD CR
akhilnittala Jun 4, 2026
44ed6b4
Configuring TLS options from Central TLS Profile and ArgoCD CR
akhilnittala Jun 9, 2026
4c0b6a7
Configuring TLS options from Central TLS Profile
akhilnittala Jun 18, 2026
d80dd4b
Configuring TLS options from Central TLS Profile
akhilnittala Jun 22, 2026
82cf637
Configuring TLS options from Central TLS Profile
akhilnittala Jun 22, 2026
c9ee8b3
Configuring TLS options from Central TLS Profile
akhilnittala Jun 22, 2026
23d0911
Configuring TLS options from Central TLS Profile
akhilnittala Jun 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion bundle/manifests/gitops-operator.clusterserviceversion.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,7 +190,7 @@ metadata:
capabilities: Deep Insights
console.openshift.io/plugins: '["gitops-plugin"]'
containerImage: quay.io/redhat-developer/gitops-operator
createdAt: "2026-06-11T15:05:37Z"
createdAt: "2026-06-22T08:56:51Z"
description: Enables teams to adopt GitOps principles for managing cluster configurations
and application delivery across hybrid multi-cluster Kubernetes environments.
features.operators.openshift.io/disconnected: "true"
Expand Down Expand Up @@ -590,6 +590,7 @@ spec:
- apiGroups:
- config.openshift.io
resources:
- apiservers
- authentications
- clusterversions
- ingresses
Expand Down Expand Up @@ -873,6 +874,8 @@ spec:
- name: OPERATOR_NAME
value: gitops-operator
- name: LABEL_SELECTOR
- name: DISABLE_CLUSTER_TLS_PROFILE
value: "false"
- name: ENABLE_CONVERSION_WEBHOOK
value: "true"
image: quay.io/redhat-developer/gitops-operator:latest
Expand Down
69 changes: 63 additions & 6 deletions cmd/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ limitations under the License.
package main

import (
"context"
"crypto/tls"
"flag"
"fmt"
Expand Down Expand Up @@ -64,6 +65,7 @@ import (
"sigs.k8s.io/controller-runtime/pkg/manager"
"sigs.k8s.io/controller-runtime/pkg/webhook"

tlspkg "github.com/openshift/controller-runtime-common/pkg/tls"
pipelinesv1alpha1 "github.com/redhat-developer/gitops-operator/api/v1alpha1"
"github.com/redhat-developer/gitops-operator/common"
"github.com/redhat-developer/gitops-operator/controllers"
Expand Down Expand Up @@ -94,6 +96,7 @@ func main() {

var enableHTTP2 = false
var skipControllerNameValidation = true
var disableClusterTLSProfile = false

var labelSelectorFlag string
flag.StringVar(&metricsAddr, "metrics-bind-address", ":8080", "The address the metric endpoint binds to.")
Expand All @@ -103,7 +106,7 @@ func main() {
"Enable leader election for controller manager. "+
"Enabling this will ensure there is only one active controller manager.")
flag.BoolVar(&enableHTTP2, "enable-http2", enableHTTP2, "If HTTP/2 should be enabled for the metrics and webhook servers.")

flag.BoolVar(&disableClusterTLSProfile, "disable-cluster-tls-profile", false, "Disable use of the cluster TLS security profile")
//Configure log level
logLevelStr := strings.ToLower(os.Getenv("LOG_LEVEL"))
logLevel := zapcore.InfoLevel
Expand All @@ -129,9 +132,12 @@ func main() {
}
opts.BindFlags(flag.CommandLine)
flag.Parse()

if strings.EqualFold(os.Getenv("DISABLE_CLUSTER_TLS_PROFILE"), "true") {
disableClusterTLSProfile = true
}
ctrl.SetLogger(zap.New(zap.UseFlagOptions(&opts)))

ctx, cancel := context.WithCancel(ctrl.SetupSignalHandler())
defer cancel()
if err := util.InspectCluster(); err != nil {
setupLog.Error(err, "unable to inspect cluster")
}
Expand All @@ -142,15 +148,40 @@ func main() {
}
c.NextProtos = []string{"http/1.1"}
}
var profile configv1.TLSProfileSpec
var err error
tlsOpts := []func(*tls.Config){disableHTTP2}
if util.IsConfigAPIFound() && !disableClusterTLSProfile {
utilruntime.Must(configv1.Install(scheme))
bootstrapClient, err := crclient.New(ctrl.GetConfigOrDie(), crclient.Options{
Scheme: scheme,
})
if err != nil {
setupLog.Error(err, "unable to create bootstrap client")
os.Exit(1)
}
profile, err = tlspkg.FetchAPIServerTLSProfile(ctx, bootstrapClient)
if err != nil {
Comment thread
coderabbitai[bot] marked this conversation as resolved.
setupLog.Error(err, "unable to fetch cluster TLS profile")
os.Exit(1)
}

tlsConfigFn, unsupported := tlspkg.NewTLSConfigFromProfile(profile)
if len(unsupported) > 0 {
setupLog.Info("TLS profile contains unsupported Go cipher suites", "ciphers", unsupported)
}

tlsOpts = append(tlsOpts, tlsConfigFn)
}
webhookServerOptions := webhook.Options{
TLSOpts: []func(config *tls.Config){disableHTTP2},
TLSOpts: tlsOpts,
Port: 9443,
}
webhookServer := webhook.NewServer(webhookServerOptions)

metricsServerOptions := metricsserver.Options{
BindAddress: metricsAddr,
TLSOpts: []func(*tls.Config){disableHTTP2},
TLSOpts: tlsOpts,
FilterProvider: filters.WithAuthenticationAndAuthorization,
}

Expand Down Expand Up @@ -198,6 +229,27 @@ func main() {
client = mgr.GetClient()
}

if util.IsConfigAPIFound() && !disableClusterTLSProfile {
watcher := &tlspkg.SecurityProfileWatcher{
Client: mgr.GetClient(),
InitialTLSProfileSpec: profile,
OnProfileChange: func(_ context.Context, oldProfile, newProfile configv1.TLSProfileSpec) {
if reflect.DeepEqual(oldProfile, newProfile) {
return
}
setupLog.Info(
"cluster TLS profile changed, restarting operator",
"oldProfileMinVersion", oldProfile.MinTLSVersion,
"newProfileMinVersion", newProfile.MinTLSVersion,
)
cancel()
},
}
if err := watcher.SetupWithManager(mgr); err != nil {
setupLog.Error(err, "unable to setup TLS security profile watcher")
os.Exit(1)
}
}
// Setup Scheme for OpenShift Console if available (verified by InspectCluster)
if util.IsConsoleAPIFound() {
registerComponentOrExit(mgr, console.AddToScheme)
Expand Down Expand Up @@ -314,6 +366,11 @@ func main() {
K8sClient: k8sClient,
LocalUsers: argocdprovisioner.NewLocalUsersInfo(),
FipsConfigChecker: argoutil.NewLinuxFipsConfigChecker(),
CentralTLSConfigProfile: argocdprovisioner.TLSConfigProfile{
DisableClusterTLSProfile: disableClusterTLSProfile,
MinVersion: profile.MinTLSVersion,
Ciphers: profile.Ciphers,
},
}).SetupWithManager(mgr); err != nil {
setupLog.Error(err, "unable to create controller", "controller", "Argo CD")
os.Exit(1)
Expand Down Expand Up @@ -362,7 +419,7 @@ func main() {
}

setupLog.Info("starting manager")
if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
if err := mgr.Start(ctx); err != nil {
setupLog.Error(err, "problem running manager")
os.Exit(1)
}
Expand Down
4 changes: 3 additions & 1 deletion config/manager/manager.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,8 +36,10 @@ spec:
value: openshift-gitops
- name: OPERATOR_NAME
value: gitops-operator
- name : LABEL_SELECTOR
- name: LABEL_SELECTOR
value: ""
- name: DISABLE_CLUSTER_TLS_PROFILE
value: "false"
image: controller:latest
livenessProbe:
httpGet:
Expand Down
1 change: 1 addition & 0 deletions config/rbac/role.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,7 @@ rules:
- apiGroups:
- config.openshift.io
resources:
- apiservers
- authentications
- clusterversions
- ingresses
Expand Down
5 changes: 3 additions & 2 deletions controllers/argocd_metrics_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -397,8 +397,9 @@ func (r *ArgoCDMetricsReconciler) reconcileOperatorMetricsServiceMonitor(reqLogg
return nil
}

if existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName != desiredMetricsServerName {
existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName = desiredMetricsServerName
currentServerName := existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName
if currentServerName == nil || *currentServerName != desiredMetricsServerName {
existingServiceMonitor.Spec.Endpoints[0].TLSConfig.ServerName = &desiredMetricsServerName
return r.Client.Update(context.TODO(), existingServiceMonitor)
}

Expand Down
1 change: 1 addition & 0 deletions controllers/gitopsservice_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -216,6 +216,7 @@ type ReconcileGitopsService struct {
//+kubebuilder:rbac:groups="argoproj.io",resources=namespacemanagements;namespacemanagements/status,verbs=create;get;list;watch;update;patch;delete;deletecollection
//+kubebuilder:rbac:groups="config.openshift.io",resources=ingresses,verbs=get;list;watch
//+kubebuilder:rbac:groups="",resources=serviceaccounts/token,verbs=create
//+kubebuilder:rbac:groups="config.openshift.io",resources=apiservers,verbs=get;list;watch

// Reconcile reads that state of the cluster for a GitopsService object and makes changes based on the state read
// and what is in the GitopsService.Spec
Expand Down
18 changes: 10 additions & 8 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,30 +5,31 @@ go 1.26.2
require (
github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb
github.com/argoproj-labs/argocd-image-updater v1.2.1
github.com/argoproj-labs/argocd-operator v0.17.0-rc1.0.20260603181030-3beeabb300f9
github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260622070321-1b1e16e25546
github.com/argoproj/argo-cd/gitops-engine v0.7.1-0.20250908182407-97ad5b59a627
github.com/argoproj/argo-cd/v3 v3.4.2
github.com/go-logr/logr v1.4.3
github.com/google/go-cmp v0.7.0
github.com/google/uuid v1.6.1-0.20241114170450-2d3c2a9cc518
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
github.com/hashicorp/go-version v1.7.0
github.com/onsi/ginkgo/v2 v2.29.0
github.com/onsi/gomega v1.41.0
github.com/openshift/api v0.0.0-20240906151052-5d963dce87aa
github.com/onsi/ginkgo/v2 v2.31.0
github.com/onsi/gomega v1.42.0
github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb
github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e
github.com/operator-framework/api v0.17.5
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.73.2
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0
github.com/stretchr/testify v1.11.1
go.uber.org/zap v1.28.0
golang.org/x/mod v0.36.0
golang.org/x/mod v0.37.0
gopkg.in/yaml.v3 v3.0.1
gotest.tools v2.2.0+incompatible
k8s.io/api v0.35.2
k8s.io/apiextensions-apiserver v0.35.2
k8s.io/apimachinery v0.35.2
k8s.io/client-go v0.35.2
k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2
sigs.k8s.io/controller-runtime v0.23.1
sigs.k8s.io/controller-runtime v0.23.3
sigs.k8s.io/yaml v1.6.0
)

Expand Down Expand Up @@ -130,6 +131,7 @@ require (
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5 // indirect
github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible // indirect
github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
github.com/pjbgf/sha1cd v0.6.0 // indirect
Expand Down Expand Up @@ -179,7 +181,7 @@ require (
golang.org/x/term v0.42.0 // indirect
golang.org/x/text v0.36.0 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.44.0 // indirect
golang.org/x/tools v0.45.0 // indirect
gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
google.golang.org/genproto v0.0.0-20240401170217-c3f982113cda // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260209200024-4cfbd4190f57 // indirect
Expand Down
32 changes: 18 additions & 14 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,8 +43,8 @@ github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb
github.com/argoproj-labs/argo-rollouts-manager v0.0.9-0.20260505092152-3e07addcb2cb/go.mod h1:Ouqjtkj48SPJhW6r00CYqJ4uM7QDy3D4tinKIK9Y69Q=
github.com/argoproj-labs/argocd-image-updater v1.2.1 h1:yaJdmpFOOKTkC9688/a7jjOBLpCREj7Wdnmn4A3v1nU=
github.com/argoproj-labs/argocd-image-updater v1.2.1/go.mod h1:sBS1JqoM9R0QhIDVD4bdWS/GejDQaFwdFUV+yE9TzjA=
github.com/argoproj-labs/argocd-operator v0.17.0-rc1.0.20260603181030-3beeabb300f9 h1:Muu/NZnaNmhP1RANUAZChR/wpaKBgbsYatWgbTE3w9k=
github.com/argoproj-labs/argocd-operator v0.17.0-rc1.0.20260603181030-3beeabb300f9/go.mod h1:dTFgVAMjVy+6CGtzwHTNhYIKYUZx5r9+2yI9zTd6rn8=
github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260622070321-1b1e16e25546 h1:OafSQHM3lStVRkoSG4Ygpv90TX3jYak0YVdVCIF6oKo=
github.com/argoproj-labs/argocd-operator v0.19.0-rc1.0.20260622070321-1b1e16e25546/go.mod h1:BacHJFUuwHvGQwQgM0Nbew0MeTeDundJsiA6jU0GoYI=
github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5 h1:IMzPK0gt1lZRDHtiKGzU0VAez0FmT2veytxlmE2AwyU=
github.com/argoproj/argo-cd/gitops-engine v0.0.0-20260512203152-0dc6b1b57dd5/go.mod h1:6Q1KZzkeKlnCpzzZ1Fu72+WPMAt+ZeMD9KOO6aMjW68=
github.com/argoproj/argo-cd/v3 v3.4.2 h1:S3j0K34uGW4geWiM88+0cHcCEtInn2Sa9U7/Sa18L7Y=
Expand Down Expand Up @@ -344,8 +344,8 @@ github.com/onsi/ginkgo/v2 v2.3.0/go.mod h1:Eew0uilEqZmIEZr8JrvYlvOM7Rr6xzTmMV8Ay
github.com/onsi/ginkgo/v2 v2.4.0/go.mod h1:iHkDK1fKGcBoEHT5W7YBq4RFWaQulw+caOMkAt4OrFo=
github.com/onsi/ginkgo/v2 v2.5.0/go.mod h1:Luc4sArBICYCS8THh8v3i3i5CuSZO+RaQRaJoeNwomw=
github.com/onsi/ginkgo/v2 v2.7.0/go.mod h1:yjiuMwPokqY1XauOgju45q3sJt6VzQ/Fict1LFVcsAo=
github.com/onsi/ginkgo/v2 v2.29.0 h1:rfh+ZFjgJhYWRoIqVf3Uwx/W20yLrcrE2h2GmYVRaag=
github.com/onsi/ginkgo/v2 v2.29.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
github.com/onsi/ginkgo/v2 v2.31.0 h1:GtuJos5DFUV9EerYJo8RhYxosYNGvOdDE5haKq6Grfs=
github.com/onsi/ginkgo/v2 v2.31.0/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7JYyY=
github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
github.com/onsi/gomega v1.17.0/go.mod h1:HnhC7FXeEQY45zxNK3PPoIUhzk/80Xly9PcubAlGdZY=
Expand All @@ -356,14 +356,18 @@ github.com/onsi/gomega v1.22.1/go.mod h1:x6n7VNe4hw0vkyYUM4mjIXx3JbLiPaBPNgB7PRQ
github.com/onsi/gomega v1.24.0/go.mod h1:Z/NWtiqwBrwUt4/2loMmHL63EDLnYHmVbuBpDr2vQAg=
github.com/onsi/gomega v1.24.1/go.mod h1:3AOiACssS3/MajrniINInwbfOOtfZvplPzuRSmvt1jM=
github.com/onsi/gomega v1.25.0/go.mod h1:r+zV744Re+DiYCIPRlYOTxn0YkOLcAnW8k1xXdMPGhM=
github.com/onsi/gomega v1.41.0 h1:OwKp4pXNgVxf6sCplzYo794OFNuoL2q2SBMU5NSWOjA=
github.com/onsi/gomega v1.41.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
github.com/onsi/gomega v1.42.0 h1:CJby8u36xb7v34W78F8WKvqTQP7PCMIPB78IVDB73l4=
github.com/onsi/gomega v1.42.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
github.com/openshift/api v0.0.0-20240906151052-5d963dce87aa h1:RMI6Xa+l8KriyoxsRO/swMDPyCwrxJNA9H67K0Jod/w=
github.com/openshift/api v0.0.0-20240906151052-5d963dce87aa/go.mod h1:yimSGmjsI+XF1mr+AKBs2//fSXIOhhetHGbMlBEfXbs=
github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb h1:iwBR3mzmyE3EMFx7R3CQ9lOccTS0dNht8TW82aGITg0=
github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e h1:k89oIo2EjX0PRSdi1kesktCyWp50SC9WwKurvupvRGs=
github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e/go.mod h1:XGabTMnNbz0M5Oa7IbscZp/jmcc7aHobvOCUWwkzKvM=
github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5 h1:9Pe6iVOMjt9CdA/vaKBNUSoEIjIe1po5Ha3ABRYXLJI=
github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5/go.mod h1:K3FoNLgNBFYbFuG+Kr8usAnQxj1w84XogyUp2M8rK8k=
github.com/operator-framework/api v0.17.5 h1:9d0pc6m1Vp4QeS8i5dhl/B0nifhKQdtw+iFsNx0An0Q=
github.com/operator-framework/api v0.17.5/go.mod h1:l/cuwtPxkVUY7fzYgdust2m9tlmb8I4pOvbsUufRb24=
github.com/patrickmn/go-cache v2.1.1-0.20191004192108-46f407853014+incompatible h1:IWzUvJ72xMjmrjR9q3H1PF+jwdN0uNQiR2t1BLNalyo=
Expand All @@ -379,8 +383,8 @@ github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINE
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.73.2 h1:GwlGJPK6vf1UIohpc72KJVkKYlzki1UgE3xC4bWbf20=
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.73.2/go.mod h1:yJ3CawR/A5qEYFEeCOUVYLTwYxmacfHQhJS+b/2QiaM=
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0 h1:AHzMWDxNiAVscJL6+4wkvFRTpMnJqiaZFEKA/osaBXE=
github.com/prometheus-operator/prometheus-operator/pkg/apis/monitoring v0.74.0/go.mod h1:wAR5JopumPtAZnu0Cjv2PSqV4p4QB09LMhc6fZZTXuA=
github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=
github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg=
github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
Expand Down Expand Up @@ -514,8 +518,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
Expand Down Expand Up @@ -701,8 +705,8 @@ oras.land/oras-go/v2 v2.6.0 h1:X4ELRsiGkrbeox69+9tzTu492FMUu7zJQW6eJU+I2oc=
oras.land/oras-go/v2 v2.6.0/go.mod h1:magiQDfG6H1O9APp+rOsvCPcW1GD2MM7vgnKY0Y+u1o=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0 h1:qPrZsv1cwQiFeieFlRqT627fVZ+tyfou/+S5S0H5ua0=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.33.0/go.mod h1:Ve9uj1L+deCXFrPOk1LpFXqTg7LCFzFso6PA48q/XZw=
sigs.k8s.io/controller-runtime v0.23.1 h1:TjJSM80Nf43Mg21+RCy3J70aj/W6KyvDtOlpKf+PupE=
sigs.k8s.io/controller-runtime v0.23.1/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
sigs.k8s.io/controller-runtime v0.23.3 h1:VjB/vhoPoA9l1kEKZHBMnQF33tdCLQKJtydy4iqwZ80=
sigs.k8s.io/controller-runtime v0.23.3/go.mod h1:B6COOxKptp+YaUT5q4l6LqUJTRpizbgf9KSRNdQGns0=
sigs.k8s.io/gateway-api v1.5.0 h1:duoo14Ky/fJXpjpmyMISE2RTBGnfCg8zICfTYLTnBJA=
sigs.k8s.io/gateway-api v1.5.0/go.mod h1:GvCETiaMAlLym5CovLxGjS0NysqFk3+Yuq3/rh6QL2o=
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
Expand Down
2 changes: 1 addition & 1 deletion test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -143,7 +143,7 @@ var _ = Describe("GitOps Operator Parallel E2E Tests", func() {

By("expecting redis-server to have desired container process command/arguments")

expectedString := "--save \"\" --appendonly no --aclfile /app/config/redis-auth/users.acl --tls-port 6379 --port 0 --tls-cert-file /app/config/redis/tls/tls.crt --tls-key-file /app/config/redis/tls/tls.key --tls-auth-clients no"
expectedString := "--save \"\" --appendonly no --aclfile /app/config/redis-auth/users.acl --tls-protocols TLSv1.2 --tls-ciphers TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 --tls-ciphersuites TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 --tls-port 6379 --port 0 --tls-cert-file /app/config/redis/tls/tls.crt --tls-key-file /app/config/redis/tls/tls.key --tls-auth-clients no"

@coderabbitai coderabbitai Bot Jun 22, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | 🏗️ Heavy lift

Make the TLS expectation profile-aware, not hard-coded.

Line 146 locks the test to one cipher/protocol set, so it can fail on clusters with a different APIServer TLS profile even when operator behavior is correct. That also weakens validation of the PR goal (inherit cluster profile dynamically). Build expected Redis TLS flags from the live cluster TLSProfileSpec in-test (or via a shared helper) before asserting deployment args.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@test/openshift/e2e/ginkgo/parallel/1-066_validate_redis_secure_comm_no_autotls_no_ha_test.go`
at line 146, The expectedString variable contains hard-coded TLS cipher and
protocol values that lock the test to one specific TLS profile, making it fail
on clusters with different APIServer TLS profiles even when the operator is
working correctly. Instead of using the hard-coded expectedString, dynamically
read the cluster's live TLSProfileSpec from the APIServer and build the expected
Redis TLS flags (ciphers, protocols, etc.) based on the actual cluster profile
in the test before asserting against the deployment args. This can be done
either inline in the test or via a shared helper function to construct the
expected flags from the cluster's TLS profile.


if !fixture.IsUpstreamOperatorTests() {
// Downstream operator adds these arguments
Expand Down
Loading
Loading