Skip to content

Commit 0792a91

Browse files
tmshorttmshort
committed
Add support for TLS profiles
Use Mozilla's profiles to define TLS profiles for operator-controller and catalogd. These are configured via command-line options, and can be customized. The idea is that downstream, cluster-olm-operator will be able to glean the appropriate configuration, and provide that to the components. There is a semi-automatic method to update the profiles, if that ever happens (`make update-tls-profiles`). This adds `gojq` via bingo, which is a golang implementation of jq for the update-tls-profiles target. Signed-off-by: Todd Short <tshort@redhat.com>
1 parent 5f37a67 commit 0792a91

17 files changed

+668
-3
lines changed

‎.bingo/Variables.mk‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ $(CRD_REF_DOCS): $(BINGO_DIR)/crd-ref-docs.mod
4141
@echo "(re)installing $(GOBIN)/crd-ref-docs-v0.1.0"
4242
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=crd-ref-docs.mod -o=$(GOBIN)/crd-ref-docs-v0.1.0 "github.com/elastic/crd-ref-docs"
4343

44+
GOJQ := $(GOBIN)/gojq-v0.12.17
45+
$(GOJQ): $(BINGO_DIR)/gojq.mod
46+
@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
47+
@echo "(re)installing $(GOBIN)/gojq-v0.12.17"
48+
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gojq.mod -o=$(GOBIN)/gojq-v0.12.17 "github.com/itchyny/gojq/cmd/gojq"
49+
4450
GOLANGCI_LINT := $(GOBIN)/golangci-lint-v2.1.6
4551
$(GOLANGCI_LINT): $(BINGO_DIR)/golangci-lint.mod
4652
@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.

‎.bingo/gojq.mod‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
2+
3+
go 1.24.4
4+
5+
require github.com/itchyny/gojq v0.12.17 // cmd/gojq

‎.bingo/gojq.sum‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
github.com/itchyny/gojq v0.12.17 h1:8av8eGduDb5+rvEdaOO+zQUjA04MS0m3Ps8HiD+fceg=
2+
github.com/itchyny/gojq v0.12.17/go.mod h1:WBrEMkgAfAGO1LUcGOckBl5O726KPp+OlkKug0I/FEY=
3+
github.com/itchyny/timefmt-go v0.1.6 h1:ia3s54iciXDdzWzwaVKXZPbiXzxxnv1SPGFfM/myJ5Q=
4+
github.com/itchyny/timefmt-go v0.1.6/go.mod h1:RRDZYC5s9ErkjQvTvvU7keJjxUYzIISJGxm9/mAERQg=
5+
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
6+
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
7+
github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
8+
github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
9+
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
10+
github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
11+
github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
12+
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
13+
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
14+
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
15+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
16+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
17+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎.bingo/variables.env‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ CRD_DIFF="${GOBIN}/crd-diff-v0.2.0"
1616

1717
CRD_REF_DOCS="${GOBIN}/crd-ref-docs-v0.1.0"
1818

19+
GOJQ="${GOBIN}/gojq-v0.12.17"
20+
1921
GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.1.6"
2022

2123
GORELEASER="${GOBIN}/goreleaser-v1.26.2"

‎Makefile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ generate: $(CONTROLLER_GEN) #EXHELP Generate code containing DeepCopy, DeepCopyI
178178
$(CONTROLLER_GEN) --load-build-tags=$(GO_BUILD_TAGS) object:headerFile="hack/boilerplate.go.txt" paths="./..."
179179

180180
.PHONY: verify
181-
verify: k8s-pin kind-verify-versions fmt generate manifests crd-ref-docs #HELP Verify all generated code is up-to-date. Runs k8s-pin instead of just tidy.
181+
verify: k8s-pin kind-verify-versions fmt generate manifests update-tls-profiles crd-ref-docs #HELP Verify all generated code is up-to-date. Runs k8s-pin instead of just tidy.
182182
git diff --exit-code
183183

184184
.PHONY: fix-lint
@@ -189,6 +189,10 @@ fix-lint: $(GOLANGCI_LINT) #EXHELP Fix lint issues
189189
fmt: #EXHELP Formats code
190190
go fmt ./...
191191

192+
.PHONY: update-tls-profiles
193+
update-tls-profiles: $(GOJQ) #EXHELP Update TLS profiles from the Mozilla wiki
194+
env JQ=$(GOJQ) hack/tools/update-tls-profiles.sh
195+
192196
.PHONY: verify-crd-compatibility
193197
CRD_DIFF_ORIGINAL_REF := git://main?path=
194198
CRD_DIFF_UPDATED_REF := file://

‎cmd/catalogd/main.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ import (
6464
imageutil "github.com/operator-framework/operator-controller/internal/shared/util/image"
6565
"github.com/operator-framework/operator-controller/internal/shared/util/pullsecretcache"
6666
sautil "github.com/operator-framework/operator-controller/internal/shared/util/sa"
67+
"github.com/operator-framework/operator-controller/internal/shared/util/tlsprofiles"
6768
"github.com/operator-framework/operator-controller/internal/shared/version"
6869
)
6970

@@ -142,6 +143,7 @@ func init() {
142143
klog.InitFlags(flag.CommandLine)
143144
flags.AddGoFlagSet(flag.CommandLine)
144145
features.CatalogdFeatureGate.AddFlag(flags)
146+
tlsprofiles.AddFlags(flags)
145147

146148
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
147149
utilruntime.Must(ocv1.AddToScheme(scheme))
@@ -216,12 +218,18 @@ func run(ctx context.Context) error {
216218
// For details, see: https://github.com/kubernetes/kubernetes/issues/121197
217219
config.NextProtos = []string{"http/1.1"}
218220
}
221+
tlsProfile, err := tlsprofiles.GetTLSConfigFunc()
222+
if err != nil {
223+
setupLog.Error(err, "failed to get TLS profile")
224+
return err
225+
}
219226

220227
// Create webhook server and configure TLS
221228
webhookServer := crwebhook.NewServer(crwebhook.Options{
222229
Port: cfg.webhookPort,
223230
TLSOpts: []func(*tls.Config){
224231
tlsOpts,
232+
tlsProfile,
225233
},
226234
})
227235

@@ -233,7 +241,7 @@ func run(ctx context.Context) error {
233241
metricsServerOptions.SecureServing = true
234242
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
235243

236-
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsOpts)
244+
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsOpts, tlsProfile)
237245
} else {
238246
// Note that the metrics server is not serving if the BindAddress is set to "0".
239247
// Therefore, the metrics server is disabled by default. It is only enabled

‎cmd/operator-controller/main.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ import (
8282
imageutil "github.com/operator-framework/operator-controller/internal/shared/util/image"
8383
"github.com/operator-framework/operator-controller/internal/shared/util/pullsecretcache"
8484
sautil "github.com/operator-framework/operator-controller/internal/shared/util/sa"
85+
"github.com/operator-framework/operator-controller/internal/shared/util/tlsprofiles"
8586
"github.com/operator-framework/operator-controller/internal/shared/version"
8687
)
8788

@@ -166,6 +167,9 @@ func init() {
166167
//add feature gate flags to flagset
167168
features.OperatorControllerFeatureGate.AddFlag(flags)
168169

170+
//add TLS flags
171+
tlsprofiles.AddFlags(flags)
172+
169173
ctrl.SetLogger(klog.NewKlogr())
170174
}
171175
func validateMetricsFlags() error {
@@ -274,6 +278,12 @@ func run() error {
274278
// the risks. More info https://github.com/golang/go/issues/63417
275279
config.NextProtos = []string{"http/1.1"}
276280
})
281+
tlsProfile, err := tlsprofiles.GetTLSConfigFunc()
282+
if err != nil {
283+
setupLog.Error(err, "failed to get TLS profile")
284+
return err
285+
}
286+
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsProfile)
277287
} else {
278288
// Note that the metrics server is not serving if the BindAddress is set to "0".
279289
// Therefore, the metrics server is disabled by default. It is only enabled

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ require (
2424
github.com/prometheus/client_golang v1.23.2
2525
github.com/prometheus/common v0.66.1
2626
github.com/spf13/cobra v1.10.1
27+
github.com/spf13/pflag v1.0.10
2728
github.com/stretchr/testify v1.11.1
2829
go.podman.io/image/v5 v5.37.0
2930
golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
@@ -199,7 +200,6 @@ require (
199200
github.com/sirupsen/logrus v1.9.3 // indirect
200201
github.com/smallstep/pkcs7 v0.2.1 // indirect
201202
github.com/spf13/cast v1.7.1 // indirect
202-
github.com/spf13/pflag v1.0.10 // indirect
203203
github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 // indirect
204204
github.com/stoewer/go-strcase v1.3.1 // indirect
205205
github.com/stretchr/objx v0.5.2 // indirect

‎hack/tools/update-tls-profiles.sh‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
#!/bin/env bash
2+
3+
set -e
4+
5+
if [ -z "${JQ}" ]; then
6+
echo "JQ not defined"
7+
exit 1
8+
fi
9+
10+
OUTPUT=internal/shared/util/tlsprofiles/mozilla_data.go
11+
INPUT=https://ssl-config.mozilla.org/guidelines/latest.json
12+
13+
TMPFILE="$(mktemp)"
14+
trap 'rm -rf "$TMPFILE"' EXIT
15+
16+
curl -L -s ${INPUT} > ${TMPFILE}
17+
18+
version=$(${JQ} -r '.version' ${TMPFILE})
19+
20+
cat > ${OUTPUT} <<EOF
21+
package tlsprofiles
22+
23+
// DO NOT EDIT, GENERATED BY ${0}
24+
// DATA SOURCE: ${INPUT}
25+
// DATA VERSION: ${version}
26+
27+
import (
28+
"crypto/tls"
29+
)
30+
EOF
31+
32+
function generate_profile {
33+
cat >> ${OUTPUT} <<EOF
34+
35+
var ${1}TLSProfile = tlsProfile{
36+
ciphers: cipherSlice{
37+
cipherNums: []uint16{
38+
EOF
39+
40+
${JQ} -r ".configurations.$1.ciphersuites.[] | . |= \"tls.\" + . + \",\"" ${TMPFILE} >> ${OUTPUT}
41+
${JQ} -r ".configurations.$1.ciphers.go[] | . |= \"tls.\" + . + \",\"" ${TMPFILE} >> ${OUTPUT}
42+
43+
cat >> ${OUTPUT} <<EOF
44+
},
45+
},
46+
curves: curveSlice{
47+
curveNums: []tls.CurveID{
48+
EOF
49+
50+
${JQ} -r ".configurations.$1.tls_curves[] | . |= . + \",\"" ${TMPFILE} >> ${OUTPUT}
51+
52+
version=$(${JQ} -r ".configurations.$1.tls_versions[0]" ${TMPFILE})
53+
version=${version/TLSv1./tls.VersionTLS1}
54+
version=${version/TLSv1/tls.VersionTLS10}
55+
56+
cat >> ${OUTPUT} <<EOF
57+
},
58+
},
59+
minTLSVersion: ${version},
60+
}
61+
EOF
62+
}
63+
64+
generate_profile "modern"
65+
generate_profile "intermediate"
66+
generate_profile "old"
67+
68+
# Make go happy
69+
go fmt ${OUTPUT}

‎helm/olmv1/templates/deployment-olmv1-system-catalogd-controller-manager.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ spec:
5353
- --v=${LOG_VERBOSITY}
5454
- --global-pull-secret=openshift-config/pull-secret
5555
{{- end }}
56+
{{- if and .Values.options.e2e.enabled (not .Values.options.openshift.enabled) }}
57+
{{- /* This is effectively modern with the CHACHA cipher removed */}}
58+
- --tls-profile=custom
59+
- --tls-custom-version=TLSv1.3
60+
- --tls-custom-ciphers=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384
61+
{{- end }}
5662
command:
5763
- ./catalogd
5864
{{- if or .Values.options.e2e.enabled .Values.options.openshift.enabled }}

0 commit comments

Comments
 (0)