[cluster-proxy] Support setting tls profile#285
Merged
xuezhaojun merged 6 commits intoApr 25, 2026
Conversation
- update sdk-go in go.mod to include pkg/tls library - add TLS profile ConfigMap watcher to user-server - add POD_NAMESPACE env var to user-server deployment Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Tesshu Flower <tflower@redhat.com>
- health probes are using HTTP however the setup of the server sets a default TLSConfig anyway - to reduce confusion, pass through our custom TLSConfig rather than hardcoding a default. Signed-off-by: Tesshu Flower <tflower@redhat.com>
- Add TLS ConfigMap watcher to service-proxy using sdk-go pkg/tls - Add POD_NAMESPACE env var to service-proxy container via downward API - Add configmap get/list/watch permissions to addon-agent role Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Tesshu Flower <tflower@redhat.com>
- Watch the ocm-tls-profile ConfigMap via StartTLSConfigMapWatcher and pass cipher suites to the ANP proxy-server deployment. The addon-manager restarts on ConfigMap changes, consistent with user-server and service-proxy. - TLS min version support for anp-server is prepared but commented out pending upstream ANP support for --tls-min-version. - unit test for args to anp-server - including new tlsconfig args (will also need to be updated once ANP has support for tls-min-version) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Tesshu Flower <tflower@redhat.com>
The ensure function only updated resources when the ManagedProxyConfiguration CR generation bumped, so TLS config changes from the ocm-tls-profile ConfigMap were never applied to the proxy-server deployment. Add a TLS config hash annotation to the deployment and trigger updates when the hash differs. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> Signed-off-by: Tesshu Flower <tflower@redhat.com>
WalkthroughAdds dynamic TLS ConfigMap watching and propagation: pods get Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~45 minutes Possibly related issues
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: tesshuflower The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
Contributor
Author
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (9)
test/integration/controllers/suite_test.go (1)
125-125: Integration test covers only the nil-TLSConfig path.Passing
nilfor the newtlsConfig *sdktls.TLSConfigkeeps the existing behavior but leaves the non-nil branch (which drivesAnnotationKeyTLSConfigHashcomputation and deployment updates) untested at the integration level. Consider adding a case that passes a stub*sdktls.TLSConfigand asserts the hash annotation appears on the rendered proxy-server Deployment.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@test/integration/controllers/suite_test.go` at line 125, Add an integration test that exercises the non-nil tlsConfig branch used by RegisterClusterManagementAddonReconciler: construct a stub sdktls.TLSConfig, pass it instead of nil to RegisterClusterManagementAddonReconciler, trigger reconciliation, then fetch the rendered proxy-server Deployment and assert that the AnnotationKeyTLSConfigHash annotation is present and equals the expected hash; locate the test around suite_test.go where RegisterClusterManagementAddonReconciler is called and add the new case verifying TLSConfig-driven annotation on the proxy-server Deployment.cmd/addon-manager/main.go (1)
169-175: Minor:klog.Fatalfafterdefer cancel()skips the deferred cancel.
klog.Fatalfcallsos.Exit(1), which bypasses the deferredcancel()above. Not functionally harmful here (the process is exiting), but for consistency with the error handling below (which usessetupLog.Error+os.Exit(1)), consider the same pattern:- podNamespace := os.Getenv("POD_NAMESPACE") - if len(podNamespace) == 0 { - klog.Fatalf("Pod namespace is empty, please set the ENV for POD_NAMESPACE") - } + podNamespace := os.Getenv("POD_NAMESPACE") + if len(podNamespace) == 0 { + setupLog.Error(nil, "POD_NAMESPACE env var must be set") + os.Exit(1) + }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@cmd/addon-manager/main.go` around lines 169 - 175, The current early exit uses klog.Fatalf which bypasses the deferred cancel() (ctx, cancel) — instead, replace the klog.Fatalf("Pod namespace is empty...") call with a non-fatal log using setupLog.Error (or setupLog.ErrorS) to report the empty POD_NAMESPACE and then call os.Exit(1) so the defer cancel() runs; locate the podNamespace check around variables ctx and cancel and update the error path (replace klog.Fatalf with setupLog.Error + os.Exit(1)) to match the pattern used elsewhere.pkg/proxyagent/agent/manifests/charts/addon-agent/templates/addon-agent-role.yaml (1)
13-20: Narrow the configmap rule to the TLS ConfigMap usingresourceNames.The current rule permits
get/list/watchon all configmaps in the namespace. The TLS watcher targets onlyocm-tls-profilevia a field-selector watch (metadata.name=ocm-tls-profile), so this can be tightened to:- apiGroups: - "" resources: - configmaps resourceNames: - ocm-tls-profile verbs: - get - list - watchThis narrows permissions to the specific ConfigMap and aligns with least-privilege RBAC principles.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/proxyagent/agent/manifests/charts/addon-agent/templates/addon-agent-role.yaml` around lines 13 - 20, The Role rule currently grants get/list/watch on all configmaps; restrict it to the TLS ConfigMap by adding resourceNames with the value "ocm-tls-profile" under the configmaps rule so the rule becomes limited to the specific resource (keep apiGroups: [""], resources: ["configmaps"], resourceNames: ["ocm-tls-profile"], verbs: ["get","list","watch"]); update the rule in the addon-agent-role.yaml template where configmaps are defined.pkg/proxyserver/controllers/manifests_test.go (1)
35-114: Good coverage ofproxyServerArgsandtlsConfigHashbehaviors.Nice and focused. Optional: consider also adding a small test against
newProxyServerDeploymentitself that assertscommon.AnnotationKeyTLSConfigHashends up on the returned Deployment'sObjectMeta.Annotationsonly when a non-nil TLS config is supplied — that's the contract the reconciler inmanagedproxyconfiguration_controller.go(lines 277-280) actually relies on, and it isn't directly exercised by the current tests.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/proxyserver/controllers/manifests_test.go` around lines 35 - 114, Add a unit test for newProxyServerDeployment that verifies it sets common.AnnotationKeyTLSConfigHash in the returned Deployment.ObjectMeta.Annotations only when a non-nil TLS config is passed: call newProxyServerDeployment with a nil TLS config and assert the annotation is absent, then call it with a populated sdktls.TLSConfig and assert the annotation exists and is non-empty; reference newProxyServerDeployment and common.AnnotationKeyTLSConfigHash to locate code and inspect the Deployment's ObjectMeta.Annotations for the assertions.pkg/userserver/user_server.go (2)
247-250: Minor: duplicatectrl.GetConfigOrDie()call.
init(ctx)(line 151) already builds anaddonClientfromctrl.GetConfigOrDie(). Constructing a second rest config here is harmless but easy to consolidate (e.g., build the rest.Config once ininit()and reuse it for both clients).🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/userserver/user_server.go` around lines 247 - 250, The code calls ctrl.GetConfigOrDie() twice; consolidate by obtaining the REST config once in init(ctx) and reuse it when creating both the addon client and the kube client. Modify init(ctx) to assign ctrl.GetConfigOrDie() to a cfg variable (or a field) used to create addonClient, and then replace the second ctrl.GetConfigOrDie() in the kubernetes.NewForConfig call (used to create kubeClient) with that same cfg so kubernetes.NewForConfig(cfg) reuses the single rest.Config instance.
251-257: Consider graceful shutdown instead ofos.Exit(0)on TLS reload.Calling
os.Exit(0)from the watcher callback abruptly terminates the process while long-lived proxy connections (e.g.,kubectl exec/port-forwardthrough the tunnel) and in-flight HTTP responses are still in flight. A cleaner approach is to cancel a parent context and lethttp.Server.Shutdowndrain existing connections before exiting; the kubelet will then restart the pod and the new TLS profile takes effect.The same pattern is used in
pkg/serviceproxy/service_proxy.go(lines 231-237) — both would benefit from the change.🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/userserver/user_server.go` around lines 251 - 257, Replace the abrupt os.Exit(0) in the sdktls.StartTLSConfigMapWatcher callback with a graceful shutdown: create a cancellable parent context (e.g., ctx, cancel := context.WithCancel(...)) used by the HTTP server, pass a callback that calls cancel() instead of os.Exit(0), and ensure the main goroutine listens for ctx.Done() and calls server.Shutdown(gracefulCtx) to drain connections before exit; update the sdktls.StartTLSConfigMapWatcher invocation in user_server.go (and mirror the same pattern from pkg/serviceproxy/service_proxy.go) to use cancel() so TLS reload triggers a controlled shutdown rather than an immediate process exit.pkg/proxyserver/controllers/manifests.go (1)
262-270: Add a separator between hash inputs to avoid theoretical collision.
CipherSuitesToString(...)andVersionToString(...)are written back-to-back, so two distinct configs whose serializations happen to concatenate identically would hash the same. Real-world collision is extremely unlikely given the constrained formats, but injecting a delimiter is free and removes the ambiguity.♻️ Proposed tweak
func tlsConfigHash(tlsConfig *sdktls.TLSConfig) string { if tlsConfig == nil { return "" } h := sha256.New() h.Write([]byte(sdktls.CipherSuitesToString(tlsConfig.CipherSuites))) + h.Write([]byte{0}) h.Write([]byte(sdktls.VersionToString(tlsConfig.MinVersion))) return fmt.Sprintf("%x", h.Sum(nil))[:16] }🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/proxyserver/controllers/manifests.go` around lines 262 - 270, The tlsConfigHash function currently concatenates sdktls.CipherSuitesToString(tlsConfig.CipherSuites) and sdktls.VersionToString(tlsConfig.MinVersion) without a separator which can create a theoretical collision; update tlsConfigHash to write a clear delimiter (e.g., a single byte like 0x00 or a character such as ':') between the two writes to the SHA-256 hasher after the CipherSuites string and before the Version string so the two fields cannot ambiguously concatenate.pkg/proxyserver/controllers/managedproxyconfiguration_controller.go (1)
134-134: Minor:tlsConfigis both a field and a passed argument.
c.tlsConfigis stored on the reconciler inRegisterClusterManagementAddonReconciler(line 80), yetdeployProxyServeraccepts it as a parameter (line 172) and the only caller passesc.tlsConfig(line 134). Either drop the parameter and readc.tlsConfiginsidedeployProxyServer, or drop the field and keep the parameter — having both invites drift.Also applies to: 172-172
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/proxyserver/controllers/managedproxyconfiguration_controller.go` at line 134, The code passes c.tlsConfig into deployProxyServer while also storing tlsConfig as a reconciler field, which duplicates state; pick one approach — I suggest removing the parameter from deployProxyServer and referencing the reconciler field directly: update the deployProxyServer method signature to no longer accept tlsConfig, replace any use of the parameter inside deployProxyServer with c.tlsConfig, and update all callers (e.g., the call from where isModified, err := c.deployProxyServer(config, c.tlsConfig) is made) to call c.deployProxyServer(config) instead; alternatively, if you prefer the parameter approach, remove the tlsConfig field set in RegisterClusterManagementAddonReconciler and ensure callers pass the tlsConfig explicitly.pkg/utils/utils.go (1)
156-178: Document the currently-unusedtlsConfigparameter on the exported function.The inline comment on line 173 explains the situation, but
ServeHealthProbesis exported and the newtlsConfigargument has no observable effect today (the server starts viaListenAndServe, notListenAndServeTLS). Consider promoting the note to the function-level Godoc so callers don't assume passing a non-niltlsConfigenables TLS for/healthz.-// ServeHealthProbes serves health probes and configchecker. +// ServeHealthProbes serves health probes and configchecker over HTTP. +// +// NOTE: tlsConfig is accepted for forward compatibility but is currently +// unused, since the server is started via ListenAndServe(). It will take +// effect when this function switches to ListenAndServeTLS. func ServeHealthProbes(healthProbeBindAddress string, tlsConfig *tls.Config, customChecks ...healthz.Checker) error {🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/utils/utils.go` around lines 156 - 178, Exported function ServeHealthProbes currently accepts a tlsConfig parameter that is unused because the function calls server.ListenAndServe(); update the function-level Godoc for ServeHealthProbes to document that tlsConfig is currently ignored and does not enable TLS (callers must use a different API or modify the function to call ListenAndServeTLS if TLS is desired), and keep the existing inline comment or remove it after adding the Godoc note; reference the tlsConfig parameter and the server.ListenAndServe call in the comment so callers understand the current behavior.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Line 11: The go.mod currently pins the vulnerable module
"google.golang.org/grpc v1.76.0"; update that dependency to v1.79.3 or later
(replace the version string "google.golang.org/grpc v1.76.0" with
"google.golang.org/grpc v1.79.3" or higher), run `go get
google.golang.org/grpc@v1.79.3` (or `go get ./...`) to update go.sum, then run
`go mod tidy` and your test suite to ensure no breaking changes; ensure any CI
caching or vendoring is refreshed so the updated "google.golang.org/grpc"
version is used.
---
Nitpick comments:
In `@cmd/addon-manager/main.go`:
- Around line 169-175: The current early exit uses klog.Fatalf which bypasses
the deferred cancel() (ctx, cancel) — instead, replace the klog.Fatalf("Pod
namespace is empty...") call with a non-fatal log using setupLog.Error (or
setupLog.ErrorS) to report the empty POD_NAMESPACE and then call os.Exit(1) so
the defer cancel() runs; locate the podNamespace check around variables ctx and
cancel and update the error path (replace klog.Fatalf with setupLog.Error +
os.Exit(1)) to match the pattern used elsewhere.
In
`@pkg/proxyagent/agent/manifests/charts/addon-agent/templates/addon-agent-role.yaml`:
- Around line 13-20: The Role rule currently grants get/list/watch on all
configmaps; restrict it to the TLS ConfigMap by adding resourceNames with the
value "ocm-tls-profile" under the configmaps rule so the rule becomes limited to
the specific resource (keep apiGroups: [""], resources: ["configmaps"],
resourceNames: ["ocm-tls-profile"], verbs: ["get","list","watch"]); update the
rule in the addon-agent-role.yaml template where configmaps are defined.
In `@pkg/proxyserver/controllers/managedproxyconfiguration_controller.go`:
- Line 134: The code passes c.tlsConfig into deployProxyServer while also
storing tlsConfig as a reconciler field, which duplicates state; pick one
approach — I suggest removing the parameter from deployProxyServer and
referencing the reconciler field directly: update the deployProxyServer method
signature to no longer accept tlsConfig, replace any use of the parameter inside
deployProxyServer with c.tlsConfig, and update all callers (e.g., the call from
where isModified, err := c.deployProxyServer(config, c.tlsConfig) is made) to
call c.deployProxyServer(config) instead; alternatively, if you prefer the
parameter approach, remove the tlsConfig field set in
RegisterClusterManagementAddonReconciler and ensure callers pass the tlsConfig
explicitly.
In `@pkg/proxyserver/controllers/manifests_test.go`:
- Around line 35-114: Add a unit test for newProxyServerDeployment that verifies
it sets common.AnnotationKeyTLSConfigHash in the returned
Deployment.ObjectMeta.Annotations only when a non-nil TLS config is passed: call
newProxyServerDeployment with a nil TLS config and assert the annotation is
absent, then call it with a populated sdktls.TLSConfig and assert the annotation
exists and is non-empty; reference newProxyServerDeployment and
common.AnnotationKeyTLSConfigHash to locate code and inspect the Deployment's
ObjectMeta.Annotations for the assertions.
In `@pkg/proxyserver/controllers/manifests.go`:
- Around line 262-270: The tlsConfigHash function currently concatenates
sdktls.CipherSuitesToString(tlsConfig.CipherSuites) and
sdktls.VersionToString(tlsConfig.MinVersion) without a separator which can
create a theoretical collision; update tlsConfigHash to write a clear delimiter
(e.g., a single byte like 0x00 or a character such as ':') between the two
writes to the SHA-256 hasher after the CipherSuites string and before the
Version string so the two fields cannot ambiguously concatenate.
In `@pkg/userserver/user_server.go`:
- Around line 247-250: The code calls ctrl.GetConfigOrDie() twice; consolidate
by obtaining the REST config once in init(ctx) and reuse it when creating both
the addon client and the kube client. Modify init(ctx) to assign
ctrl.GetConfigOrDie() to a cfg variable (or a field) used to create addonClient,
and then replace the second ctrl.GetConfigOrDie() in the kubernetes.NewForConfig
call (used to create kubeClient) with that same cfg so
kubernetes.NewForConfig(cfg) reuses the single rest.Config instance.
- Around line 251-257: Replace the abrupt os.Exit(0) in the
sdktls.StartTLSConfigMapWatcher callback with a graceful shutdown: create a
cancellable parent context (e.g., ctx, cancel := context.WithCancel(...)) used
by the HTTP server, pass a callback that calls cancel() instead of os.Exit(0),
and ensure the main goroutine listens for ctx.Done() and calls
server.Shutdown(gracefulCtx) to drain connections before exit; update the
sdktls.StartTLSConfigMapWatcher invocation in user_server.go (and mirror the
same pattern from pkg/serviceproxy/service_proxy.go) to use cancel() so TLS
reload triggers a controlled shutdown rather than an immediate process exit.
In `@pkg/utils/utils.go`:
- Around line 156-178: Exported function ServeHealthProbes currently accepts a
tlsConfig parameter that is unused because the function calls
server.ListenAndServe(); update the function-level Godoc for ServeHealthProbes
to document that tlsConfig is currently ignored and does not enable TLS (callers
must use a different API or modify the function to call ListenAndServeTLS if TLS
is desired), and keep the existing inline comment or remove it after adding the
Godoc note; reference the tlsConfig parameter and the server.ListenAndServe call
in the comment so callers understand the current behavior.
In `@test/integration/controllers/suite_test.go`:
- Line 125: Add an integration test that exercises the non-nil tlsConfig branch
used by RegisterClusterManagementAddonReconciler: construct a stub
sdktls.TLSConfig, pass it instead of nil to
RegisterClusterManagementAddonReconciler, trigger reconciliation, then fetch the
rendered proxy-server Deployment and assert that the AnnotationKeyTLSConfigHash
annotation is present and equals the expected hash; locate the test around
suite_test.go where RegisterClusterManagementAddonReconciler is called and add
the new case verifying TLSConfig-driven annotation on the proxy-server
Deployment.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 35361373-2260-493b-890a-f3898134d11c
⛔ Files ignored due to path filters (286)
go.sumis excluded by!**/*.sumvendor/github.com/gogo/protobuf/AUTHORSis excluded by!vendor/**vendor/github.com/gogo/protobuf/CONTRIBUTORSis excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/Makefileis excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/clone.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/custom_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/decode.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/deprecated.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/discard.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/duration.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/duration_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/encode.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/encode_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/equal.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/extensions.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/extensions_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/lib.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/lib_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/message_set.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/pointer_reflect.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/pointer_reflect_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/pointer_unsafe.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/pointer_unsafe_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/properties.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/properties_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/skip_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/table_marshal.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/table_marshal_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/table_merge.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/table_unmarshal.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/table_unmarshal_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/text.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/text_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/text_parser.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/timestamp.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/timestamp_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/wrappers.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/proto/wrappers_gogo.gois excluded by!vendor/**vendor/github.com/gogo/protobuf/sortkeys/sortkeys.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/.gitignoreis excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/README.mdis excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/core_dsl.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/decorator_dsl.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/deprecated_dsl.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/formatter/formatter.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/README.mdis excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/automaxprocs.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroup.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cgroups2.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_linux.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/cpu_quota_unsupported.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/errors.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/mountpoint.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/runtime.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/automaxprocs/subsys.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/build/build_command.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/command/abort.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/command/command.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/command/program.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/compile.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/gocovmerge.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/profiles_and_reports.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/internal/run.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/main.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/outline/outline.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/run/run_command.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/dependencies.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo/watch/watch_command.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/ginkgo_t_dsl.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/around_node.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/failer.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/focus.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/group.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/interrupt_handler/interrupt_handler.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/node.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/ordering.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/output_interceptor_unix.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/client_server.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_client.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/http_server.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_client.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/rpc_server.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/parallel_support/server_handler.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/progress_report.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/report_entry.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_event_writer.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/reporters/gojson_reporter.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/spec_context.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/suite.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/testingtproxy/testing_t_proxy.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/internal/writer.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/reporters/default_reporter.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/reporters/gojson_report.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/reporters/junit_report.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/reporters/teamcity_report.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/reporting_dsl.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/table_dsl.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/around_node.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/config.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/deprecated_types.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/errors.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/flags.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/label_filter.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/report_entry.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/semver_filter.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/types.gois excluded by!vendor/**vendor/github.com/onsi/ginkgo/v2/types/version.gois excluded by!vendor/**vendor/github.com/onsi/gomega/CHANGELOG.mdis excluded by!vendor/**vendor/github.com/onsi/gomega/format/format.gois excluded by!vendor/**vendor/github.com/onsi/gomega/gomega_dsl.gois excluded by!vendor/**vendor/github.com/onsi/gomega/internal/assertion.gois excluded by!vendor/**vendor/github.com/onsi/gomega/internal/async_assertion.gois excluded by!vendor/**vendor/github.com/onsi/gomega/internal/duration_bundle.gois excluded by!vendor/**vendor/github.com/onsi/gomega/internal/gomega.gois excluded by!vendor/**vendor/github.com/onsi/gomega/internal/polling_signal_error.gois excluded by!vendor/**vendor/github.com/onsi/gomega/internal/vetoptdesc.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/and.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/assignable_to_type_of_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_a_directory.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_a_regular_file.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_an_existing_file.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_closed_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_comparable_to_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_element_of_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_empty_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_equivalent_to_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_false_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_identical_to.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_key_of_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_nil_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_numerically_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_sent_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_temporally_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_true_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/be_zero_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/consist_of.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/contain_element_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/contain_elements_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/contain_substring_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/equal_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_cap_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_each_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_exact_elements.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_existing_field_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_field.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_http_body_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_http_header_with_value_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_http_status_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_key_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_key_with_value_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_len_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_occurred_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_prefix_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_suffix_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/have_value.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/match_error_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/match_json_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/match_regexp_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/match_xml_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/match_yaml_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/not.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/or.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/panic_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/receive_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/satisfy_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/semi_structured_data_support.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/succeed_matcher.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/support/goraph/bipartitegraph/bipartitegraph.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/support/goraph/node/node.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/type_support.gois excluded by!vendor/**vendor/github.com/onsi/gomega/matchers/with_transform.gois excluded by!vendor/**vendor/github.com/onsi/gomega/types/types.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/desc.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/internal/difflib.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/internal/go_runtime_metrics.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/labels.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/metric.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/process_collector_darwin.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/process_collector_mem_nocgo_darwin.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/process_collector_procfsenabled.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/promhttp/instrument_server.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/vec.gois excluded by!vendor/**vendor/github.com/prometheus/client_golang/prometheus/wrap.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/decode.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/encode.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/expfmt.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/fuzz.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/openmetrics_create.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/text_create.gois excluded by!vendor/**vendor/github.com/prometheus/common/expfmt/text_parse.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/labels.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/labelset.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/metric.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/time.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/value.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/value_histogram.gois excluded by!vendor/**vendor/github.com/prometheus/common/model/value_type.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/.golangci.ymlis excluded by!vendor/**vendor/github.com/prometheus/procfs/Makefile.commonis excluded by!vendor/**vendor/github.com/prometheus/procfs/README.mdis excluded by!vendor/**vendor/github.com/prometheus/procfs/arp.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/fs.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/fs_statfs_notype.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/fscache.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/internal/fs/fs.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/internal/util/parse.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/internal/util/sysreadfile.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/mountstats.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/net_dev_snmp6.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/net_ip_socket.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/net_protocols.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/net_tcp.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/net_unix.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_cgroup.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_io.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_netstat.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_smaps.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_snmp.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_snmp6.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_status.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/proc_sys.gois excluded by!vendor/**vendor/github.com/prometheus/procfs/softirqs.gois excluded by!vendor/**vendor/golang.org/x/mod/LICENSEis excluded by!vendor/**vendor/golang.org/x/mod/PATENTSis excluded by!vendor/**vendor/golang.org/x/mod/semver/semver.gois excluded by!vendor/**vendor/golang.org/x/net/context/context.gois excluded by!vendor/**vendor/golang.org/x/tools/go/gcexportdata/gcexportdata.gois excluded by!vendor/**vendor/golang.org/x/tools/go/gcexportdata/importer.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/doc.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/external.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/golist.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/golist_overlay.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/loadmode_string.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/packages.gois excluded by!vendor/**vendor/golang.org/x/tools/go/packages/visit.gois excluded by!vendor/**vendor/golang.org/x/tools/go/types/objectpath/objectpath.gois excluded by!vendor/**vendor/golang.org/x/tools/go/types/typeutil/callee.gois excluded by!vendor/**vendor/golang.org/x/tools/go/types/typeutil/imports.gois excluded by!vendor/**vendor/golang.org/x/tools/go/types/typeutil/map.gois excluded by!vendor/**vendor/golang.org/x/tools/go/types/typeutil/methodsetcache.gois excluded by!vendor/**vendor/golang.org/x/tools/go/types/typeutil/ui.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/aliases/aliases_go122.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/core/event.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/core/export.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/core/fast.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/doc.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/event.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/keys/keys.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/keys/standard.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/keys/util.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/event/label/label.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/bimport.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/exportdata.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/gcimporter.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/iexport.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/iimport.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/predeclared.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/support.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gocommand/invoke.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gocommand/invoke_notunix.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gocommand/invoke_unix.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gocommand/vendor.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/gocommand/version.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/packagesinternal/packages.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/codes.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/decoder.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/doc.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/encoder.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/flags.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/reloc.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/support.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/sync.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/syncmarker_string.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/pkgbits/version.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/stdlib/deps.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/stdlib/import.gois excluded by!vendor/**vendor/golang.org/x/tools/internal/stdlib/manifest.gois excluded by!vendor/**
📒 Files selected for processing (14)
charts/cluster-proxy/templates/manager-deployment.yamlcharts/cluster-proxy/templates/user-deployment.yamlcmd/addon-manager/main.gogo.modpkg/common/constants.gopkg/proxyagent/agent/manifests/charts/addon-agent/templates/addon-agent-deployment.yamlpkg/proxyagent/agent/manifests/charts/addon-agent/templates/addon-agent-role.yamlpkg/proxyserver/controllers/managedproxyconfiguration_controller.gopkg/proxyserver/controllers/manifests.gopkg/proxyserver/controllers/manifests_test.gopkg/serviceproxy/service_proxy.gopkg/userserver/user_server.gopkg/utils/utils.gotest/integration/controllers/suite_test.go
Comment on lines
+177
to
+191
| // Using common code to watch for the TLS Profile configmap and restart. | ||
| // Note that technically this addon-manager does not serve any thing with tls directly and only | ||
| // updates the configuration in the proxyServer via the RegisterClusterManagementAddonReconciler. | ||
| // So we could alternatively add a watch there on the configmap and simply reconcile. | ||
| // This way keeps it simpler with common code, but does restart when the configmap changes | ||
| sdkTLSConfig, err := sdktls.StartTLSConfigMapWatcher(ctx, nativeClient, podNamespace, func() { | ||
| klog.Info("TLS ConfigMap changed, restarting") | ||
| os.Exit(0) | ||
| }) | ||
| if err != nil { | ||
| setupLog.Error(err, "failed to start TLS ConfigMap watcher") | ||
| os.Exit(1) | ||
| } | ||
| klog.Infof("TLS config loaded: minVersion=%s, ciphersuites=%s", sdktls.VersionToString(sdkTLSConfig.MinVersion), | ||
| sdktls.CipherSuitesToString(sdkTLSConfig.CipherSuites)) |
There was a problem hiding this comment.
Restart-on-change semantics rely on leader election / replica count.
os.Exit(0) on ConfigMap change is fine for a single-replica Deployment, but if replicas > 1 or leader election is enabled (--leader-elect=true per the chart), only the pod whose watcher fires will exit — other replicas may still run with stale TLS config for up to the informer resync interval. Since this addon-manager runs leader-elected and doesn't itself terminate TLS, the practical impact is low (it only influences the rendered proxy-server Deployment via the hash annotation, which each replica would recompute on its own watcher event). Worth a comment clarifying the assumption, or verifying all replicas observe the event promptly.
| github.com/openshift/library-go v0.0.0-20250711143941-47604345e7ea | ||
| github.com/pkg/errors v0.9.1 | ||
| github.com/stretchr/testify v1.11.1 | ||
| google.golang.org/grpc v1.76.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
curl -s https://api.osv.dev/v1/query -d '{"package":{"name":"google.golang.org/grpc","ecosystem":"Go"},"version":"1.76.0"}' | jq '.vulns[] | {id, summary, affected: .affected[0].ranges}'Repository: open-cluster-management-io/cluster-proxy
Length of output: 700
🏁 Script executed:
cat -n go.mod | head -20Repository: open-cluster-management-io/cluster-proxy
Length of output: 933
Critical: grpc v1.76.0 has a known authorization bypass vulnerability.
google.golang.org/grpc v1.76.0 is affected by GO-2026-4762 / GHSA-p77j-4mvh-x3m3 (authorization bypass via missing leading slash in :path). Bump to v1.79.3 or later.
🧰 Tools
🪛 OSV Scanner (2.3.5)
[CRITICAL] 11-11: google.golang.org/grpc 1.76.0: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc
(GO-2026-4762)
[CRITICAL] 11-11: google.golang.org/grpc 1.76.0: gRPC-Go has an authorization bypass via missing leading slash in :path
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` at line 11, The go.mod currently pins the vulnerable module
"google.golang.org/grpc v1.76.0"; update that dependency to v1.79.3 or later
(replace the version string "google.golang.org/grpc v1.76.0" with
"google.golang.org/grpc v1.79.3" or higher), run `go get
google.golang.org/grpc@v1.79.3` (or `go get ./...`) to update go.sum, then run
`go mod tidy` and your test suite to ensure no breaking changes; ensure any CI
caching or vendoring is refreshed so the updated "google.golang.org/grpc"
version is used.
Signed-off-by: Tesshu Flower <tflower@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
pkg/proxyserver/controllers/manifests.go (1)
253-256: Link the upstream tracker directly in the commented-out block.The existing
TODO(ocm#1447)at lines 129–130 gives a good high-level pointer, but a reader landing on this commented block won't see it. Adding the upstream anp issue/PR number here would make it trivial to know when it's safe to uncomment.✏️ Suggested comment tweak
- // Uncomment once --tls-min-version is supported by the apiserver-network-proxy + // TODO(ocm#1447): Uncomment once --tls-min-version is supported by + // apiserver-network-proxy (tracking: <upstream-issue-or-PR-url>). //if tlsConfig.MinVersion != 0 { // args = append(args, "--tls-min-version="+sdktls.VersionToString(tlsConfig.MinVersion)) //}🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@pkg/proxyserver/controllers/manifests.go` around lines 253 - 256, Update the commented-out TLS min-version block to include a direct link to the upstream apiserver-network-proxy issue/PR so readers know when to re-enable it; locate the block that references tlsConfig.MinVersion, args and sdktls.VersionToString (the three commented lines) and append a short comment like "TODO(ocm#1447): see https://github.com/kubernetes-sigs/apiserver-network-proxy/issues/NNN" (replace NNN with the actual upstream issue/PR number) immediately above or within the commented block.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@pkg/proxyserver/controllers/manifests.go`:
- Around line 236-260: The proxyServerArgs function is currently appending a
--cipher-suites flag when tlsConfig.CipherSuites is non-empty which the
proxy-server binary does not support; remove the code that appends
"--cipher-suites="+sdktls.CipherSuitesToString(tlsConfig.CipherSuites) (i.e.,
delete the if block that checks len(tlsConfig.CipherSuites) and its append) so
proxyServerArgs no longer injects an unsupported flag; keep the existing TODO
about --tls-min-version as a note for upstream support and do not add any other
TLS-related flags until the proxy-server binary gains support.
---
Nitpick comments:
In `@pkg/proxyserver/controllers/manifests.go`:
- Around line 253-256: Update the commented-out TLS min-version block to include
a direct link to the upstream apiserver-network-proxy issue/PR so readers know
when to re-enable it; locate the block that references tlsConfig.MinVersion,
args and sdktls.VersionToString (the three commented lines) and append a short
comment like "TODO(ocm#1447): see
https://github.com/kubernetes-sigs/apiserver-network-proxy/issues/NNN" (replace
NNN with the actual upstream issue/PR number) immediately above or within the
commented block.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 6d58e823-2aa3-4964-b3d0-c524afe7926d
📒 Files selected for processing (2)
pkg/proxyserver/controllers/managedproxyconfiguration_controller.gopkg/proxyserver/controllers/manifests.go
Comment on lines
+236
to
+260
| func proxyServerArgs(config *proxyv1alpha1.ManagedProxyConfiguration, tlsConfig *sdktls.TLSConfig) []string { | ||
| args := append([]string{ | ||
| "--server-count=" + strconv.Itoa(int(config.Spec.ProxyServer.Replicas)), | ||
| "--proxy-strategies=destHost", | ||
| "--server-ca-cert=/etc/server-ca-pki/ca.crt", | ||
| "--server-cert=/etc/server-pki/tls.crt", | ||
| "--server-key=/etc/server-pki/tls.key", | ||
| "--cluster-ca-cert=/etc/server-ca-pki/ca.crt", | ||
| "--cluster-cert=/etc/agent-pki/tls.crt", | ||
| "--cluster-key=/etc/agent-pki/tls.key", | ||
| }, config.Spec.ProxyServer.AdditionalArgs...) | ||
|
|
||
| if tlsConfig != nil { | ||
| if len(tlsConfig.CipherSuites) > 0 { | ||
| args = append(args, "--cipher-suites="+sdktls.CipherSuitesToString(tlsConfig.CipherSuites)) | ||
| } | ||
|
|
||
| // Uncomment once --tls-min-version is supported by the apiserver-network-proxy | ||
| //if tlsConfig.MinVersion != 0 { | ||
| // args = append(args, "--tls-min-version="+sdktls.VersionToString(tlsConfig.MinVersion)) | ||
| //} | ||
| } | ||
|
|
||
| return args | ||
| } |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Inspect the upstream anp flag names the project currently pins.
rg -nP -C2 '(apiserver-network-proxy|cipher-suites|tls-min-version|tls-cipher-suites)' go.mod go.sum 2>/dev/null
fd -t f -e go . vendor/sigs.k8s.io/apiserver-network-proxy 2>/dev/null | head -50
fd -t f -e go 'options' vendor/sigs.k8s.io/apiserver-network-proxy 2>/dev/null | xargs rg -nP -C1 '(cipher-suites|tls-min-version|CipherSuites|MinVersion|flag\.String|flags\.String)'Repository: open-cluster-management-io/cluster-proxy
Length of output: 42555
🌐 Web query:
Does the apiserver-network-proxy proxy-serverbinary support a--cipher-suites command-line flag? What is the exact flag name?
💡 Result:
No. The apiserver-network-proxy proxy-server binary does not support a --cipher-suites flag. There is no --cipher-suites flag name in the project’s documented proxy-server arguments, and none appears in the CLI flag definitions for the server binary. Flag name: none (no --cipher-suites flag exists).
Citations:
- 1: https://github.com/kubernetes-sigs/apiserver-network-proxy
- 2: https://github.com/kubernetes-sigs/apiserver-network-proxy/blob/master/README.md
- 3: https://github.com/kubernetes-sigs/apiserver-network-proxy/blob/master/pkg/server/server.go
🏁 Script executed:
# Find the main proxy-server entry point and flag definitions
find vendor/sigs.k8s.io/apiserver-network-proxy -name "server.go" -o -name "main.go" | head -5
# Search for flag registrations in the proxy-server code
rg -A 3 "flags\.String|flag\.String" vendor/sigs.k8s.io/apiserver-network-proxy/pkg/server/ 2>/dev/null | head -100
# Look for "cipher" references in the entire ANP vendor tree
rg -i "cipher" vendor/sigs.k8s.io/apiserver-network-proxy/ 2>/dev/null | head -20Repository: open-cluster-management-io/cluster-proxy
Length of output: 732
🏁 Script executed:
# Find the proxy-server main function and all flag definitions
find vendor/sigs.k8s.io/apiserver-network-proxy -type f -name "*.go" | xargs grep -l "func main\|flagset\|flag.String\|flag.Bool" | head -10
# Look at the server.go file directly
find vendor/sigs.k8s.io/apiserver-network-proxy/pkg/server -name "*.go" -exec grep -l "flagset\|flag\." {} \;
# Search for any command-line argument parsing in the server package
rg "flag\.|flagset|StringVar|BoolVar" vendor/sigs.k8s.io/apiserver-network-proxy/pkg/server/ -A 2 | head -80Repository: open-cluster-management-io/cluster-proxy
Length of output: 268
🏁 Script executed:
# List the actual structure in the vendor directory
find vendor/sigs.k8s.io/apiserver-network-proxy -type d | head -20
# Find all Go files in the vendor directory
find vendor/sigs.k8s.io/apiserver-network-proxy -name "*.go" | head -20
# Look for any main() function
rg "func main\(" vendor/sigs.k8s.io/apiserver-network-proxy/ -l
# Search for all flag definitions across the entire ANP vendor tree
rg "StringVar|BoolVar|flag\.String|flag\.Bool" vendor/sigs.k8s.io/apiserver-network-proxy/ -B 2 -A 1 | head -100Repository: open-cluster-management-io/cluster-proxy
Length of output: 1781
🏁 Script executed:
# The vendor directory only has client code. Let's check the flags.go file
cat vendor/sigs.k8s.io/apiserver-network-proxy/pkg/util/flags.go
# Also check net.go to understand cipher handling in ANP
cat vendor/sigs.k8s.io/apiserver-network-proxy/pkg/util/net.goRepository: open-cluster-management-io/cluster-proxy
Length of output: 2774
🏁 Script executed:
# Check if there's any upstream PR or issue reference about --cipher-suites support
rg "TODO|FIXME|PR|upstream" pkg/proxyserver/controllers/manifests.go -B 2 -A 2
# Look at the actual implementation to understand what's happening
cat -n pkg/proxyserver/controllers/manifests.go | sed -n '236,260p'
# Check the test expectations
cat pkg/proxyserver/controllers/manifests_test.go | grep -A 30 "TestProxyServerArgs_WithCipherSuites"Repository: open-cluster-management-io/cluster-proxy
Length of output: 2940
🏁 Script executed:
# Search for any references to proxy-server flag documentation in the repo
rg "proxy-server" . --type md | grep -i "flag\|arg" | head -10
# Check if there are any comments or documentation about supported flags
rg "server-count|proxy-strategies" . --type md
# Look for any recent changes or PRs related to cipher-suites
git log --oneline --all -S "cipher-suites" 2>/dev/null | head -5
# Check upstream ANP releases/tags to see if this flag was added
rg "cipher.suites|ciphersuites" . --type go -l | grep -v vendor | head -5Repository: open-cluster-management-io/cluster-proxy
Length of output: 170
Remove the --cipher-suites flag—the proxy-server binary does not support it.
The apiserver-network-proxy proxy-server binary (v0.33.0, which this chart depends on) does not accept a --cipher-suites command-line flag. Passing this flag at line 250 will cause the Deployment to crash-loop on argument parsing whenever a TLS profile is set.
This mirrors the --tls-min-version situation already flagged in the TODO at line 129—the upstream project does not yet support TLS configuration flags on the proxy-server binary. Either remove the cipher suite injection entirely, or document that TLS profile enforcement on the proxy-server awaits an upstream enhancement.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pkg/proxyserver/controllers/manifests.go` around lines 236 - 260, The
proxyServerArgs function is currently appending a --cipher-suites flag when
tlsConfig.CipherSuites is non-empty which the proxy-server binary does not
support; remove the code that appends
"--cipher-suites="+sdktls.CipherSuitesToString(tlsConfig.CipherSuites) (i.e.,
delete the if block that checks len(tlsConfig.CipherSuites) and its append) so
proxyServerArgs no longer injects an unsupported flag; keep the existing TODO
about --tls-min-version as a note for upstream support and do not add any other
TLS-related flags until the proxy-server binary gains support.
Contributor
Author
There was a problem hiding this comment.
This isn't correct - the Dockerfile actually uses v0.30.2 to build apiserver-network-binary, which does expose the --cipher-suites flag (as of PR kubernetes-sigs/apiserver-network-proxy#282). Additionally this was manually tested in my kind env.
There was a problem hiding this comment.
Only users with a collaborator, contributor, member, or owner role can interact with CodeRabbit.
Codecov Report❌ Patch coverage is Additional details and impacted files@@ Coverage Diff @@
## main #285 +/- ##
==========================================
+ Coverage 17.60% 18.27% +0.66%
==========================================
Files 36 36
Lines 2153 2200 +47
==========================================
+ Hits 379 402 +23
- Misses 1750 1774 +24
Partials 24 24
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
xuezhaojun
merged commit ff1a90c
into
open-cluster-management-io:main
8 of 9 checks passed
6 tasks
Merged
3 tasks
Member
|
@qiujian16 @xuezhaojun the vendor folder file diffs is quite large 2k+ files. Is this normal? |
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds TLS profile support to all cluster-proxy HTTPS-serving components, implementing ocm#1447.
Each component watches the ocm-tls-profile ConfigMap in its deployed namespace using sdk-go/pkg/tls.StartTLSConfigMapWatcher. When the ConfigMap is absent, components use defaults (TLS 1.2,
Go default cipher suites) — preserving existing behavior. When the ConfigMap changes, the affected container restarts via os.Exit(0) and picks up the new settings.
Components updated
--cipher-suites=so far as anp upstream still needs to be updated to allow passing through--tls-min-versionNotes/Special Considerations
outbound communications have not been modified as we're relying on the servers to set these.
On the
ManagedProxyConfigurationReconcilera TLS config hash annotation on the Deployment ensures ensure() updates the deployment even when the ManagedProxyConfiguration CR generation hasn't changed. The ensure() function would otherwise not update the deployment unless the ManagedProxyConfiguration CR was modified. Note this may still be a concern, the various CRs can currently get out of sync if they are modified and ManagedProxyConfigurationCR is not touched.Note that the addon-manager didn't strictly need a restart following updates to the tls configmap as it only needs to update the deployment above - but used the common sdk-go/pkg/tls.StartTLSConfigMapWatcher for consistency rather than doing a watch on the confimap itself.
Helm chart changes - Some helm charts were modified as components needed the pod's namespace in order to be able to lookup the tls configmap.
Added POD_NAMESPACE env var (downward API) to manager-deployment.yaml, user-deployment.yaml, and addon-agent-deployment.yaml (spoke service-proxy container)
Added RBAC for ConfigMap get/list/watch in the spoke addon-agent role
Not done yet:
Add --tls-min-version and --tls-cipher-suites flags to anp-server(hub)
There is a PR upstream for anp-server to add the tls-min-version flag: feat: add --tls-min-version flag to proxy server kubernetes-sigs/apiserver-network-proxy#820
Testing
For: open-cluster-management-io/ocm#1447
Summary by CodeRabbit
New Features
Improvements
Dependencies