feat(gitops-console-plugin): Configure SSL protocol and ciphersuites for plugin component#1224
feat(gitops-console-plugin): Configure SSL protocol and ciphersuites for plugin component#1224akhilnittala wants to merge 5 commits into
Conversation
…for plugin component Signed-off-by: akhil nittala <nakhil@redhat.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
Note Reviews pausedIt looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the Use the following commands to manage reviews:
Use the checkboxes below for quick actions:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository YAML (base), Organization UI (inherited) Review profile: CHILL Plan: Enterprise Run ID: 📒 Files selected for processing (1)
🔗 Linked repositories identifiedCodeRabbit considers these linked repositories for cross-repo context during reviews:
🚧 Files skipped from review as they are similar to previous changes (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughTLS settings now flow from the cluster TLS profile into the GitOps service controller, which generates a TLS-aware plugin ConfigMap. ConfigMap content is hashed into Deployment pod-template annotations to trigger updates when plugin configuration changes. ChangesTLS-aware console plugin configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Sequence Diagram(s)sequenceDiagram
participant ClusterTLSProfile
participant ReconcileGitopsService
participant PluginConfigMap
participant Deployment
ClusterTLSProfile->>ReconcileGitopsService: Provide TLSMinVersion and TLSCiphers
ReconcileGitopsService->>PluginConfigMap: Generate TLS-aware httpd.conf
PluginConfigMap-->>ReconcileGitopsService: Return generated ConfigMap
ReconcileGitopsService->>Deployment: Set httpd-cfg-hash on pod template
Suggested reviewers: 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@controllers/consoleplugin.go`:
- Around line 539-540: In ReconcileGitopsService.reconcileConfigMap, update the
existing ConfigMap after copying Data and Labels by passing
existingPluginConfigMap to r.Client.Update instead of the newly generated
newPluginConfigMap, preserving its ResourceVersion.
- Line 437: Initialize existingSpecTemplate.ObjectMeta.Annotations as a writable
map when it is nil before assigning the "httpd-cfg-hash" entry, while preserving
the existing annotation update behavior.
- Around line 529-540: Replace the crypto/md5 import with crypto/sha256 in
controllers/consoleplugin.go at lines 5-5. Update getConfigMapHash at lines
529-540 to create a SHA-256 hash, collect and lexicographically sort cm.Data
keys before writing each key and value, and preserve the existing hexadecimal
string return format.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 23fb09a2-e4fc-4318-898d-224970c23815
📒 Files selected for processing (3)
cmd/main.gocontrollers/consoleplugin.gocontrollers/gitopsservice_controller.go
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
argoproj-labs/argocd-operator(manual)
…for plugin component Signed-off-by: akhil nittala <nakhil@redhat.com>
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@controllers/consoleplugin_test.go`:
- Around line 2000-2020: Update getConfigMapHash to sort the keys of cm.Data
before writing key-value pairs into the hash, ensuring identical ConfigMaps
always produce the same hash and avoiding unnecessary rollouts.
- Around line 1931-1938: Update the TLS configuration logic exercised by the
“TLS 1.2 with cipher suites” test so TLSMinVersion VersionTLS12 emits an
additive protocol range including TLSv1.2 and TLSv1.3, rather than selecting
TLSv1.2 exclusively. Preserve the cipher-suite configuration and existing
behavior for other minimum versions.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: 0729c3de-2de9-4c16-8c30-ff1b5044daa6
📒 Files selected for processing (1)
controllers/consoleplugin_test.go
🔗 Linked repositories identified
CodeRabbit considers these linked repositories for cross-repo context during reviews:
argoproj-labs/argocd-operator(manual)
…for plugin component Signed-off-by: akhil nittala <nakhil@redhat.com>
…for plugin component Signed-off-by: akhil nittala <nakhil@redhat.com>
aali309
left a comment
aali309
left a comment
There was a problem hiding this comment.
Thanks @akhilnittala, the approach looks right, left a comment
…for plugin component Signed-off-by: akhil nittala <nakhil@redhat.com>
2 participants
What type of PR is this?
/kind enhancement
What does this PR do / why we need it:
Configure SSL Protocol and cipher suites based on apiserver tls minversion and ciphersuites
Have you updated the necessary documentation?
Which issue(s) this PR fixes:
Fixes #?
https://redhat.atlassian.net/browse/GITOPS-10473
Test acceptance criteria:
How to test changes / Special notes to the reviewer:
deploy gitops operator and verify the ssl connection with apiserver tls minversion and ciphers