Skip to content

Commit ce2557d

Browse files
tmshorttmshort
committed
Add support for TLS profiles
Use Mozilla's profiles to define TLS profiles for operator-controller and catalogd. These are configured via command-line options, and can be customized. The idea is that downstream, cluster-olm-operator will be able to glean the appropriate configuration, and provide that to the components. There is a semi-automatic method to update the profiles, if that ever happens (`make update-tls-profiles`). This adds `gojq` via bingo, which is a golang implementation of jq for the update-tls-profiles target. Signed-off-by: Todd Short <tshort@redhat.com>
1 parent 5f37a67 commit ce2557d

File tree

10 files changed

+372
-1
lines changed

10 files changed

+372
-1
lines changed

‎.bingo/Variables.mk‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,12 @@ $(CRD_REF_DOCS): $(BINGO_DIR)/crd-ref-docs.mod
4141
@echo "(re)installing $(GOBIN)/crd-ref-docs-v0.1.0"
4242
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=crd-ref-docs.mod -o=$(GOBIN)/crd-ref-docs-v0.1.0 "github.com/elastic/crd-ref-docs"
4343

44+
GOJQ := $(GOBIN)/gojq-v0.12.17
45+
$(GOJQ): $(BINGO_DIR)/gojq.mod
46+
@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.
47+
@echo "(re)installing $(GOBIN)/gojq-v0.12.17"
48+
@cd $(BINGO_DIR) && GOWORK=off $(GO) build -mod=mod -modfile=gojq.mod -o=$(GOBIN)/gojq-v0.12.17 "github.com/itchyny/gojq/cmd/gojq"
49+
4450
GOLANGCI_LINT := $(GOBIN)/golangci-lint-v2.1.6
4551
$(GOLANGCI_LINT): $(BINGO_DIR)/golangci-lint.mod
4652
@# Install binary/ries using Go 1.14+ build command. This is using bwplotka/bingo-controlled, separate go module with pinned dependencies.

‎.bingo/gojq.mod‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
module _ // Auto generated by https://github.com/bwplotka/bingo. DO NOT EDIT
2+
3+
go 1.24.4
4+
5+
require github.com/itchyny/gojq v0.12.17 // cmd/gojq

‎.bingo/gojq.sum‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
github.com/itchyny/gojq v0.12.17 h1:8av8eGduDb5+rvEdaOO+zQUjA04MS0m3Ps8HiD+fceg=
2+
github.com/itchyny/gojq v0.12.17/go.mod h1:WBrEMkgAfAGO1LUcGOckBl5O726KPp+OlkKug0I/FEY=
3+
github.com/itchyny/timefmt-go v0.1.6 h1:ia3s54iciXDdzWzwaVKXZPbiXzxxnv1SPGFfM/myJ5Q=
4+
github.com/itchyny/timefmt-go v0.1.6/go.mod h1:RRDZYC5s9ErkjQvTvvU7keJjxUYzIISJGxm9/mAERQg=
5+
github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
6+
github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
7+
github.com/mattn/go-runewidth v0.0.15 h1:UNAjwbU9l54TA3KzvqLGxwWjHmMgBUVhBiTjelZgg3U=
8+
github.com/mattn/go-runewidth v0.0.15/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w=
9+
github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc=
10+
github.com/rivo/uniseg v0.4.7 h1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=
11+
github.com/rivo/uniseg v0.4.7/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88=
12+
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
13+
golang.org/x/sys v0.20.0 h1:Od9JTbYCk261bKm4M/mw7AklTlFYIa0bIp9BgSm1S8Y=
14+
golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
15+
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
16+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
17+
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

‎.bingo/variables.env‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ CRD_DIFF="${GOBIN}/crd-diff-v0.2.0"
1616

1717
CRD_REF_DOCS="${GOBIN}/crd-ref-docs-v0.1.0"
1818

19+
GOJQ="${GOBIN}/gojq-v0.12.17"
20+
1921
GOLANGCI_LINT="${GOBIN}/golangci-lint-v2.1.6"
2022

2123
GORELEASER="${GOBIN}/goreleaser-v1.26.2"

‎Makefile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,10 @@ fix-lint: $(GOLANGCI_LINT) #EXHELP Fix lint issues
189189
fmt: #EXHELP Formats code
190190
go fmt ./...
191191

192+
.PHONY: update-tls-profiles
193+
update-tls-profiles: $(GOJQ) #EXHELP Update TLS profiles from the Mozilla wiki
194+
env JQ=$(GOJQ) hack/tools/update-tls-profiles.sh
195+
192196
.PHONY: verify-crd-compatibility
193197
CRD_DIFF_ORIGINAL_REF := git://main?path=
194198
CRD_DIFF_UPDATED_REF := file://

‎cmd/catalogd/main.go‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,7 @@ import (
6464
imageutil "github.com/operator-framework/operator-controller/internal/shared/util/image"
6565
"github.com/operator-framework/operator-controller/internal/shared/util/pullsecretcache"
6666
sautil "github.com/operator-framework/operator-controller/internal/shared/util/sa"
67+
"github.com/operator-framework/operator-controller/internal/shared/util/tlsprofiles"
6768
"github.com/operator-framework/operator-controller/internal/shared/version"
6869
)
6970

@@ -142,6 +143,7 @@ func init() {
142143
klog.InitFlags(flag.CommandLine)
143144
flags.AddGoFlagSet(flag.CommandLine)
144145
features.CatalogdFeatureGate.AddFlag(flags)
146+
tlsprofiles.AddFlags(flags)
145147

146148
utilruntime.Must(clientgoscheme.AddToScheme(scheme))
147149
utilruntime.Must(ocv1.AddToScheme(scheme))
@@ -216,12 +218,18 @@ func run(ctx context.Context) error {
216218
// For details, see: https://github.com/kubernetes/kubernetes/issues/121197
217219
config.NextProtos = []string{"http/1.1"}
218220
}
221+
tlsProfile, err := tlsprofiles.GetTLSConfigFunc()
222+
if err != nil {
223+
setupLog.Error(err, "failed to get TLS profile")
224+
return err
225+
}
219226

220227
// Create webhook server and configure TLS
221228
webhookServer := crwebhook.NewServer(crwebhook.Options{
222229
Port: cfg.webhookPort,
223230
TLSOpts: []func(*tls.Config){
224231
tlsOpts,
232+
tlsProfile,
225233
},
226234
})
227235

@@ -233,7 +241,7 @@ func run(ctx context.Context) error {
233241
metricsServerOptions.SecureServing = true
234242
metricsServerOptions.FilterProvider = filters.WithAuthenticationAndAuthorization
235243

236-
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsOpts)
244+
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsOpts, tlsProfile)
237245
} else {
238246
// Note that the metrics server is not serving if the BindAddress is set to "0".
239247
// Therefore, the metrics server is disabled by default. It is only enabled

‎cmd/operator-controller/main.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,7 @@ import (
8282
imageutil "github.com/operator-framework/operator-controller/internal/shared/util/image"
8383
"github.com/operator-framework/operator-controller/internal/shared/util/pullsecretcache"
8484
sautil "github.com/operator-framework/operator-controller/internal/shared/util/sa"
85+
"github.com/operator-framework/operator-controller/internal/shared/util/tlsprofiles"
8586
"github.com/operator-framework/operator-controller/internal/shared/version"
8687
)
8788

@@ -166,6 +167,9 @@ func init() {
166167
//add feature gate flags to flagset
167168
features.OperatorControllerFeatureGate.AddFlag(flags)
168169

170+
//add TLS flags
171+
tlsprofiles.AddFlags(flags)
172+
169173
ctrl.SetLogger(klog.NewKlogr())
170174
}
171175
func validateMetricsFlags() error {
@@ -274,6 +278,12 @@ func run() error {
274278
// the risks. More info https://github.com/golang/go/issues/63417
275279
config.NextProtos = []string{"http/1.1"}
276280
})
281+
tlsProfile, err := tlsprofiles.GetTLSConfigFunc()
282+
if err != nil {
283+
setupLog.Error(err, "failed to get TLS profile")
284+
return err
285+
}
286+
metricsServerOptions.TLSOpts = append(metricsServerOptions.TLSOpts, tlsProfile)
277287
} else {
278288
// Note that the metrics server is not serving if the BindAddress is set to "0".
279289
// Therefore, the metrics server is disabled by default. It is only enabled

‎hack/tools/update-tls-profiles.sh‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/bin/env bash
2+
3+
set -e
4+
5+
if [ -z "${JQ}" ]; then
6+
echo "JQ not defined"
7+
exit 1
8+
fi
9+
10+
OUTPUT=internal/shared/util/tlsprofiles/tlsprofiles_data.go
11+
INPUT=https://ssl-config.mozilla.org/guidelines/latest.json
12+
13+
TMPFILE="$(mktemp)"
14+
trap 'rm -rf "$TMPFILE"' EXIT
15+
16+
curl -L -s ${INPUT} > ${TMPFILE}
17+
18+
version=$(${JQ} -r '.version' ${TMPFILE})
19+
20+
cat > ${OUTPUT} <<EOF
21+
package tlsprofiles
22+
23+
// DO NOT EDIT, GENERATED BY ${0}
24+
// DATA SOURCE: ${INPUT}
25+
// DATA VERSION: ${version}
26+
27+
import (
28+
"crypto/tls"
29+
)
30+
31+
var modernCiphers = []uint16{
32+
EOF
33+
${JQ} -r '.configurations.modern.ciphersuites.[] | . |= "tls." + . + ","' ${TMPFILE} >> ${OUTPUT}
34+
cat >> ${OUTPUT} <<EOF
35+
}
36+
37+
var intermediateCiphers = []uint16{
38+
EOF
39+
40+
${JQ} -r '.configurations.intermediate.ciphersuites[] | . |= "tls." + . + ","' ${TMPFILE} >> ${OUTPUT}
41+
${JQ} -r '.configurations.intermediate.ciphers.go[] | . |= "tls." + . + ","' ${TMPFILE} >> ${OUTPUT}
42+
cat >> ${OUTPUT} <<EOF
43+
}
44+
45+
var oldCiphers = []uint16{
46+
EOF
47+
48+
${JQ} -r '.configurations.old.ciphersuites[] | . |= "tls." + . + ","' ${TMPFILE} >> ${OUTPUT}
49+
${JQ} -r '.configurations.old.ciphers.go[] | . |= "tls." + . + ","' ${TMPFILE} >> ${OUTPUT}
50+
51+
cat >> ${OUTPUT} <<EOF
52+
}
53+
EOF
54+
55+
# Make go happy
56+
go fmt ${OUTPUT}

0 commit comments

Comments
 (0)