@@ -22,6 +22,7 @@ import (
2222 "errors"
2323 "flag"
2424 "os"
25+ "strings"
2526 "time"
2627
2728 "github.com/spf13/pflag"
@@ -34,6 +35,7 @@ import (
3435 "k8s.io/apimachinery/pkg/runtime"
3536 utilruntime "k8s.io/apimachinery/pkg/util/runtime"
3637 clientgoscheme "k8s.io/client-go/kubernetes/scheme"
38+ cliflag "k8s.io/component-base/cli/flag"
3739 "k8s.io/component-base/config"
3840 "k8s.io/component-base/config/options"
3941 "k8s.io/klog/v2"
@@ -56,6 +58,7 @@ import (
5658 rbacv1 "k8s.io/api/rbac/v1"
5759
5860 "github.com/openshift/cluster-cloud-controller-manager-operator/pkg/controllers"
61+ pkgtls "github.com/openshift/cluster-cloud-controller-manager-operator/pkg/tls"
5962 "github.com/openshift/cluster-cloud-controller-manager-operator/pkg/util"
6063 // +kubebuilder:scaffold:imports
6164)
@@ -119,8 +122,16 @@ func main() {
119122 // to allow leader lection flags to be bound
120123 pflag .CommandLine .AddGoFlagSet (flag .CommandLine )
121124 options .BindLeaderElectionFlags (& leaderElectionConfig , pflag .CommandLine )
125+
126+ tlsMinVersionFlag := pflag .String ("tls-min-version" , "" ,
127+ "Minimum TLS version supported. When set, overrides the cluster-wide TLS profile. Possible values: " + strings .Join (cliflag .TLSPossibleVersions (), ", " ))
128+ tlsCipherSuitesFlag := pflag .StringSlice ("tls-cipher-suites" , nil ,
129+ "Comma-separated list of cipher suites for the server. When set, overrides the cluster-wide TLS profile. Possible values: " + strings .Join (cliflag .TLSCipherPossibleValues (), ", " ))
130+
122131 pflag .Parse ()
123132
133+ tlsOverrideFromFlags := * tlsMinVersionFlag != "" || len (* tlsCipherSuitesFlag ) > 0
134+
124135 ctrl .SetLogger (klog .NewKlogr ().WithName ("CCMOperator" ))
125136
126137 restConfig := ctrl .GetConfigOrDie ()
@@ -136,25 +147,13 @@ func main() {
136147 // Ensure the context is cancelled when the program exits.
137148 defer cancel ()
138149
139- k8sClient , err := client .New (restConfig , client.Options {Scheme : scheme })
140- if err != nil {
141- setupLog .Error (err , "unable to create Kubernetes client" )
142- os .Exit (1 )
143- }
144-
145- // Fetch the TLS profile from the APIServer resource.
146- tlsProfileSpec , err := utiltls .FetchAPIServerTLSProfile (ctx , k8sClient )
150+ // Resolve the TLS configuration for the server endpoints.
151+ tlsResult , err := pkgtls .ResolveTLSConfig (ctx , restConfig , * tlsMinVersionFlag , * tlsCipherSuitesFlag )
147152 if err != nil {
148- setupLog .Error (err , "unable to get TLS profile from API server " )
153+ setupLog .Error (err , "unable to configure TLS" )
149154 os .Exit (1 )
150155 }
151-
152- // Create the TLS configuration function for the server endpoints.
153- tlsConfigFunc , unsupportedCiphers := utiltls .NewTLSConfigFromProfile (tlsProfileSpec )
154- if len (unsupportedCiphers ) > 0 {
155- setupLog .Info ("Some ciphers from TLS profile are not supported" , "unsupportedCiphers" , unsupportedCiphers )
156- }
157- tlsOpts := []func (* tls.Config ){tlsConfigFunc }
156+ tlsOpts := []func (* tls.Config ){tlsResult .TLSConfig }
158157
159158 syncPeriod := 10 * time .Minute
160159 mgr , err := ctrl .NewManager (restConfig , ctrl.Options {
@@ -265,26 +264,40 @@ func main() {
265264 Scheme : mgr .GetScheme (),
266265 ImagesFile : * imagesFile ,
267266 FeatureGateAccess : featureGateAccessor ,
268- TLSProfileSpec : tlsProfileSpec ,
267+ TLSConfig : tlsResult . TLSConfig ,
269268 }).SetupWithManager (mgr ); err != nil {
270269 setupLog .Error (err , "unable to create controller" , "controller" , "ClusterOperator" )
271270 os .Exit (1 )
272271 }
273272
274- // Set up the TLS security profile watcher to watch for TLS config changes
275- if err = (& utiltls.SecurityProfileWatcher {
276- Client : mgr .GetClient (),
277- InitialTLSProfileSpec : tlsProfileSpec ,
278- OnProfileChange : func (ctx context.Context , oldTLSProfileSpec , newTLSProfileSpec configv1.TLSProfileSpec ) {
279- klog .Infof ("TLS profile has changed, initiating a shutdown to reload it. %q: %+v, %q: %+v" ,
280- "old profile" , oldTLSProfileSpec ,
281- "new profile" , newTLSProfileSpec ,
282- )
283- cancel ()
284- },
285- }).SetupWithManager (mgr ); err != nil {
286- setupLog .Error (err , "unable to create controller" , "controller" , "TLSSecurityProfileWatcher" )
287- os .Exit (1 )
273+ // Set up the TLS security profile watcher controller.
274+ // When TLS is overridden via CLI flags, the watcher is not needed since
275+ // the component is not reading from apiservers.config.openshift.io/cluster.
276+ if tlsOverrideFromFlags {
277+ setupLog .Info ("TLS security profile watcher disabled because TLS is configured via CLI flags" )
278+ } else {
279+ if err = (& utiltls.SecurityProfileWatcher {
280+ Client : mgr .GetClient (),
281+ InitialTLSAdherencePolicy : tlsResult .TLSAdherencePolicy ,
282+ InitialTLSProfileSpec : tlsResult .TLSProfileSpec ,
283+ OnAdherencePolicyChange : func (ctx context.Context , oldTLSAdherencePolicy , newTLSAdherencePolicy configv1.TLSAdherencePolicy ) {
284+ klog .Infof ("TLS adherence policy has changed, initiating a shutdown to reload it. %q: %+v, %q: %+v" ,
285+ "old adherence policy" , oldTLSAdherencePolicy ,
286+ "new adherence policy" , newTLSAdherencePolicy ,
287+ )
288+ cancel ()
289+ },
290+ OnProfileChange : func (ctx context.Context , oldTLSProfileSpec , newTLSProfileSpec configv1.TLSProfileSpec ) {
291+ klog .Infof ("TLS profile has changed, initiating a shutdown to reload it. %q: %+v, %q: %+v" ,
292+ "old profile" , oldTLSProfileSpec ,
293+ "new profile" , newTLSProfileSpec ,
294+ )
295+ cancel ()
296+ },
297+ }).SetupWithManager (mgr ); err != nil {
298+ setupLog .Error (err , "unable to create controller" , "controller" , "TLSSecurityProfileWatcher" )
299+ os .Exit (1 )
300+ }
288301 }
289302
290303 // +kubebuilder:scaffold:builder
0 commit comments