tlssetup

Documentation

Overview

Package tlssetup builds TLS options for controller-runtime servers from the OpenShift APIServer TLS profile.

Index

• func RegisterSecurityProfileWatcher(mgr manager.Manager, serverTLS ServerTLS, onCancel context.CancelFunc, ...) error
• type ServerTLS
  • func BuildServerTLSOptions(ctx context.Context, cfg *rest.Config, scheme *k8sruntime.Scheme, ...) (ServerTLS, error)

Functions

func RegisterSecurityProfileWatcher

func RegisterSecurityProfileWatcher(mgr manager.Manager, serverTLS ServerTLS, onCancel context.CancelFunc, log logr.Logger) error

RegisterSecurityProfileWatcher watches the APIServer TLS profile and adherence policy. Calls onCancel to trigger restart when either changes. No-op on non-OpenShift.

Types

type ServerTLS

type ServerTLS struct {
	TLSOpts                   []func(*tls.Config)
	InitialTLSProfileSpec     configv1.TLSProfileSpec
	InitialTLSAdherencePolicy configv1.TLSAdherencePolicy
}

ServerTLS holds TLS options and the initial APIServer profile/adherence policy for watching.

func BuildServerTLSOptions

func BuildServerTLSOptions(ctx context.Context, cfg *rest.Config, scheme *k8sruntime.Scheme, log logr.Logger) (ServerTLS, error)

BuildServerTLSOptions fetches TLS profile and adherence policy from cluster. Returns TLS config functions when adherence policy requires strict compliance. Falls back to the library-go default TLS profile on transient API server errors or when adherence policy does not require strict compliance. Returns empty ServerTLS on non-OpenShift clusters.