STOR-2954: inject TLS adherence from API to vsphere problem detector configmap - #718
STOR-2954: inject TLS adherence from API to vsphere problem detector configmap#718dfajmon wants to merge 2 commits into
Conversation
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci-robot
added
the
jira/valid-reference
|
@dfajmon: This pull request references STOR-2954 which is a valid jira issue. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: openshift/coderabbit/.coderabbit.yaml Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (3)
🚧 Files skipped from review as they are similar to previous changes (3)
WalkthroughThe change exports shared TLS configuration helpers, updates CSI driver controllers to use them, and adds vSphere problem detector ConfigMap reconciliation. The deployment mounts the generated configuration and passes its path to the operator. ChangesvSphere TLS configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant VSphereProblemDetectorStarter
participant APIServer
participant TLSHelpers
participant KubernetesAPI
participant ProblemDetector
VSphereProblemDetectorStarter->>APIServer: read cluster TLS security profile
VSphereProblemDetectorStarter->>TLSHelpers: generate TLS settings and config.yaml
VSphereProblemDetectorStarter->>KubernetesAPI: apply operator ConfigMap
ProblemDetector->>KubernetesAPI: read mounted config.yaml
ProblemDetector->>ProblemDetector: start with configured TLS settings
Suggested reviewers: 🚥 Pre-merge checks | ✅ 14 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (14 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: dfajmon The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
pkg/operator/tls/tls.go (1)
19-24: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick winHandle partially populated custom TLS profiles here.
TLSSecurityProfile.Customcan arrive withMinTLSVersionorCiphersunset, and this branch returns empty settings instead of the Intermediate defaults. Fall back when either field is missing, or reject the profile earlier; add tests for missing version, missing ciphers, and both.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@pkg/operator/tls/tls.go` around lines 19 - 24, Update the custom-profile handling in the TLS security profile logic to use the Intermediate profile defaults whenever either Custom.MinTLSVersion or Custom.Ciphers is unset, while preserving explicitly provided values. Add coverage for missing version, missing ciphers, and both fields missing.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@pkg/operator/vsphereproblemdetector/vsphere_problem_detector_starter.go`:
- Around line 245-249: Update the APIServer lookup handling in the controller
reconciliation flow around apiServerLister.Get("cluster") to return or propagate
the lookup error instead of assigning an empty configv1.APIServer and continuing
with the Intermediate TLS profile. Preserve the last reconciled ConfigMap and
allow controller retry behavior; only apply the TLS policy after a successful
lookup.
---
Outside diff comments:
In `@pkg/operator/tls/tls.go`:
- Around line 19-24: Update the custom-profile handling in the TLS security
profile logic to use the Intermediate profile defaults whenever either
Custom.MinTLSVersion or Custom.Ciphers is unset, while preserving explicitly
provided values. Add coverage for missing version, missing ciphers, and both
fields missing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 85e3b965-aa96-4a42-930b-bf1c9ae76933
📒 Files selected for processing (6)
assets/vsphere_problem_detector/07_deployment.yamlassets/vsphere_problem_detector/08_operator_config.yamlpkg/operator/csidriveroperator/deploymentcontroller.gopkg/operator/csidriveroperator/hypershift_deployment_controller.gopkg/operator/tls/tls.gopkg/operator/vsphereproblemdetector/vsphere_problem_detector_starter.go
|
/retest-required |
1 similar comment
|
/retest-required |
|
/lgtm |
|
Scheduling required tests: |
|
/retest-required |
|
@dfajmon: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
/retest-required |
4 participants
https://redhat.atlassian.net/browse/STOR-2954
Summary by CodeRabbit