feat: Integrate cluster TLS profile with graceful fallback#6567
Merged
Conversation
Read the cluster TLS profile from apiservers.config.openshift.io/cluster at startup. Apply MinVersion, CipherSuites, and NextProtos to webhook and metrics server TLS configs. Fail closed on unexpected errors. Use Intermediate defaults on non-OpenShift clusters. This ensures the feast-operator honors the cluster-wide TLS security profile, which is required for OCP 5.0. The implementation gracefully falls back to hardened defaults (TLS 1.2, ECDHE ciphers) on non-OpenShift clusters, so it does not break vanilla Kubernetes deployments. Signed-off-by: Ugo Giordano <ugiordan@redhat.com> Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
5 tasks
ntkathole
approved these changes
Jun 29, 2026
5 tasks
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 7, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 7, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 7, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 7, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 8, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 9, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ntkathole
pushed a commit
to ugiordan/feast
that referenced
this pull request
Jul 14, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
ugiordan
added a commit
to ugiordan/feast
that referenced
this pull request
Jul 16, 2026
…sient errors Follow-up to feast-dev#6567. Two fixes: 1. Move NewTLSConfigFromProfile outside the if/else so it runs on all code paths. Previously, error paths skipped TLS configuration entirely, leaving the operator running with Go's bare defaults (no MinVersion, no cipher restrictions). Now all error paths explicitly fall back to the Intermediate TLS profile. 2. Handle transient API errors (ServiceUnavailable, Timeout, TooManyRequests) gracefully instead of crashing with os.Exit(1). These set tlsProfileFetched=true so the SecurityProfileWatcher self-heals when the API recovers. Also adds a 10-second context timeout on bootstrap API calls and applies the same transient error handling to the TLS adherence policy fetch. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Signed-off-by: Ugo Giordano <ugiordan@redhat.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Integrate the feast-operator with the cluster-wide TLS security profile from
apiservers.config.openshift.io/cluster, with graceful fallback for non-OpenShift clusters.On OpenShift clusters, the operator reads the admin-configured TLS profile (MinVersion, CipherSuites) and applies it to webhook and metrics servers. On vanilla Kubernetes (EKS, GKE, AKS), it falls back to hardened Intermediate defaults (TLS 1.2, ECDHE AEAD ciphers).
Also removes the
enableHTTP2flag since CVE-2023-44487 (HTTP/2 Rapid Reset) is fixed in Go 1.21.3+ and feast uses Go 1.25+.Changes
cmd/main.go: Fetch TLS profile at startup, apply to webhook and metrics servers, register SecurityProfileWatcher for profile changes, always enable HTTP/2 with NextProtosconfig/rbac/role.yaml: Add RBAC forconfig.openshift.io/apiserversget/list/watchgo.mod/go.sum: Addcontroller-runtime-commondependencyinternal/controller/featurestore_controller.go: RemoveenableHTTP2conditional, always set NextProtosNon-OpenShift behavior
Graceful fallback via
IsNoMatchError/IsNotFoundhandling. No behavior change for vanilla Kubernetes deployments. No new hard dependencies on OpenShift APIs.Test plan