OCPCLOUD-3346: tls: use centralized TLS by RadekManak · Pull Request #1456 · openshift/machine-api-operator

RadekManak · 2026-01-26T13:17:05Z

Summary

Replace the MAO metrics kube‑rbac‑proxy sidecar with direct HTTPS in the operator binary, using the serving cert mounted from the MAO secret.
Watch the APIServer TLS profile and trigger a controlled shutdown so MAO restarts and picks up TLS changes.
Propagate the APIServer TLS profile into machine-api-controllers kube‑rbac‑proxy args (cipher suites + min TLS), with unit coverage.

Details

Direct MAO metrics TLS
- MAO now listens on :8443 and serves /metrics via ListenAndServeTLS using /etc/tls/private/tls.crt|tls.key.
- The deployment drops the kube‑rbac‑proxy sidecar, mounts the serving cert into /etc/tls/private, and exposes port 8443.
- RBAC is updated to allow reading apiservers for TLS profile fetch.
TLS profile reload
- MAO fetches the APIServer TLS profile at startup and builds a tls.Config.
- A config informer watches APIServer updates and triggers shutdown on profile changes.
Centralized proxy TLS for controllers
- OperatorConfig now carries the TLS profile.
- machine-api-controllers kube‑rbac‑proxy args are generated from the profile (--tls-cipher-suites, --tls-min-version),
- Tests updated to include APIServer presence and TLS profile expectations; a focused test validates proxy TLS args.

Remove the kube-rbac-proxy sidecar, mount the serving cert, and restart the operator on APIServer TLS profile changes.

Capture the APIServer TLS profile in operator config and use it to configure kube-rbac-proxy TLS args, with unit coverage.

openshift-ci-robot · 2026-01-26T13:17:10Z

@RadekManak: This pull request references OCPCLOUD-3346 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Summary

Replace the MAO metrics kube‑rbac‑proxy sidecar with direct HTTPS in the operator binary, using the serving cert mounted from the MAO secret.

Watch the APIServer TLS profile and trigger a controlled shutdown so MAO restarts and picks up TLS changes.

Propagate the APIServer TLS profile into machine-api-controllers kube‑rbac‑proxy args (cipher suites + min TLS), with unit coverage.

Details

Direct MAO metrics TLS

MAO now listens on :8443 and serves /metrics via ListenAndServeTLS using /etc/tls/private/tls.crt|tls.key.

The deployment drops the kube‑rbac‑proxy sidecar, mounts the serving cert into /etc/tls/private, and exposes port 8443.

RBAC is updated to allow reading apiservers for TLS profile fetch.

TLS profile reload

MAO fetches the APIServer TLS profile at startup and builds a tls.Config.

A config informer watches APIServer updates and triggers shutdown on profile changes.

Centralized proxy TLS for controllers

OperatorConfig now carries the TLS profile.

machine-api-controllers kube‑rbac‑proxy args are generated from the profile (--tls-cipher-suites, --tls-min-version),

Tests updated to include APIServer presence and TLS profile expectations; a focused test validates proxy TLS args.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

RadekManak · 2026-01-26T13:17:18Z

/assign @damdo

damdo

Thanks! Looks good, a couple of minor points.

damdo · 2026-01-26T13:30:03Z

pkg/operator/operator.go

+	var tlsProfile *osconfigv1.TLSProfileSpec
+	apiServer, err := optr.osClient.ConfigV1().APIServers().Get(context.Background(), "cluster", metav1.GetOptions{})
+	if err != nil {
+		klog.Warningf("Failed to fetch APIServer, using default TLS profile: %v", err)


Shouldn't we return here?
What would happen otherwise?

damdo · 2026-01-26T13:31:47Z

pkg/operator/operator.go

+	} else {
+		profile, err := utiltls.GetTLSProfileSpec(apiServer.Spec.TLSSecurityProfile)
+		if err != nil {
+			klog.Warningf("Failed to get TLS profile spec, using defaults: %v", err)


Shouldn't we return here?
What would happen otherwise?

damdo · 2026-01-26T13:39:58Z

pkg/operator/sync.go

 }

-func newKubeProxyContainers(image string, withMHCProxy bool) []corev1.Container {
+func newKubeProxyContainers(image string, withMHCProxy bool, tlsProfile *configv1.TLSProfileSpec) []corev1.Container {


Let's not pass the pointer but the whole tlsProfile

damdo · 2026-01-26T13:40:08Z

pkg/operator/sync.go

+	// Use defaults if no profile provided
+	ciphers := utiltls.DefaultTLSCiphers
+	minVersion := utiltls.DefaultMinTLSVersion


Same as above

openshift-ci · 2026-01-27T12:34:44Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please ask for approval from damdo. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Use library-go's TLS utilities to validate the TLS profile and convert cipher suite codes to IANA names. Skip setting cipher suites when the list is empty.

Add unit tests to verify TLS configuration handling in newKubeProxyContainer, including tests for TLS 1.2 with cipher suites and TLS 1.3 without cipher suites.

openshift-ci · 2026-01-28T19:08:02Z

@RadekManak: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ipi	`4e665c0`	link	true	`/test e2e-metal-ipi`
ci/prow/verify-deps	`4e665c0`	link	true	`/test verify-deps`
ci/prow/e2e-metal-ipi-ovn-ipv6	`4e665c0`	link	true	`/test e2e-metal-ipi-ovn-ipv6`
ci/prow/e2e-metal-ipi-virtualmedia	`4e665c0`	link	true	`/test e2e-metal-ipi-virtualmedia`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

RadekManak added 3 commits January 22, 2026 13:57

Vendor library-go

0cebab6

Serve MAO metrics with direct TLS and profile reload.

b6a60be

Remove the kube-rbac-proxy sidecar, mount the serving cert, and restart the operator on APIServer TLS profile changes.

Propagate TLS profile to controller proxies.

4dfdda3

Capture the APIServer TLS profile in operator config and use it to configure kube-rbac-proxy TLS args, with unit coverage.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Jan 26, 2026

openshift-ci bot assigned damdo Jan 26, 2026

openshift-ci bot requested review from damdo and theobarberbany January 26, 2026 13:18

damdo reviewed Jan 26, 2026

View reviewed changes

RadekManak added 2 commits January 27, 2026 13:28

Fix build script

3a20bb9

DNM: dependency fix

83e4156

RadekManak added 4 commits January 27, 2026 15:54

Make tls watcher failure fatal

31f58ed

Fix unit

da4ae01

Use IANA cipher names for kube-rbac-proxy TLS configuration

43d3161

Use library-go's TLS utilities to validate the TLS profile and convert cipher suite codes to IANA names. Skip setting cipher suites when the list is empty.

Add tests for newKubeProxyContainer

4e665c0

Add unit tests to verify TLS configuration handling in newKubeProxyContainer, including tests for TLS 1.2 with cipher suites and TLS 1.3 without cipher suites.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPCLOUD-3346: tls: use centralized TLS#1456

OCPCLOUD-3346: tls: use centralized TLS#1456
RadekManak wants to merge 9 commits intoopenshift:mainfrom
RadekManak:feature-centralized-tsl-endpoints

RadekManak commented Jan 26, 2026

Uh oh!

openshift-ci-robot commented Jan 26, 2026 •

edited by openshift-ci bot

Loading

Summary

Details

Uh oh!

RadekManak commented Jan 26, 2026

Uh oh!

damdo left a comment

Uh oh!

damdo Jan 26, 2026

Uh oh!

damdo Jan 26, 2026

Uh oh!

damdo Jan 26, 2026

Uh oh!

damdo Jan 26, 2026

Uh oh!

openshift-ci bot commented Jan 27, 2026

Uh oh!

openshift-ci bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

RadekManak commented Jan 26, 2026

Summary

Details

Uh oh!

openshift-ci-robot commented Jan 26, 2026 • edited by openshift-ci bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Details

Uh oh!

RadekManak commented Jan 26, 2026

Uh oh!

damdo left a comment

Choose a reason for hiding this comment

Uh oh!

damdo Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

damdo Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

damdo Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

damdo Jan 26, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Jan 27, 2026

Uh oh!

openshift-ci bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

openshift-ci-robot commented Jan 26, 2026 •

edited by openshift-ci bot

Loading