Retrieve TLS config from apiserver for OpenShift

TLS_ADHERENCE_TEST_PLAN.md

@@ -0,0 +1,139 @@
+# TLS Adherence Feature Test Plan
+
+Tests that DevWorkspace Operator honors the cluster TLS profile when `tlsAdherence: StrictAllComponents` is set.
+
+## Prerequisites
+
+```bash
+# Verify OpenShift cluster and DWO installation
+oc get deployment -n openshift-operators devworkspace-controller-manager
+oc get deployment -n openshift-operators devworkspace-webhook-server
+```
+
+## Test 1: Default Behavior (No Adherence Policy)
+
+By default, `tlsAdherence` is not set and DWO uses Go's default TLS config.
+
+```bash
+# Check current policy (should be empty)
+oc get apiserver cluster -o jsonpath='{.spec.tlsAdherence}{"\n"}'
+
+# Check controller logs
+CONTROLLER_POD=$(oc get pods -n openshift-operators -l app.kubernetes.io/name=devworkspace-controller -o jsonpath='{.items[0].metadata.name}')
+oc logs -n openshift-operators $CONTROLLER_POD -c devworkspace-controller | grep -i "tls"
+```
+
+**Expected**: Log shows `"using Go default TLS configuration"` with empty or no policy.
+
+## Test 2: Enable StrictAllComponents
+
+Enable strict adherence and verify DWO applies the cluster TLS profile.
+
+```bash
+# Set StrictAllComponents with a TLS profile
+oc patch apiserver cluster --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Intermediate","intermediate":{}},"tlsAdherence":"StrictAllComponents"}}'
+
+# Delete controller pod to pick up new policy
+oc delete pod -n openshift-operators -l app.kubernetes.io/name=devworkspace-controller
+
+# Wait for new pod
+sleep 10
+
+# Check logs
+CONTROLLER_POD=$(oc get pods -n openshift-operators -l app.kubernetes.io/name=devworkspace-controller -o jsonpath='{.items[0].metadata.name}')
+oc logs -n openshift-operators $CONTROLLER_POD -c devworkspace-controller | grep -A3 "Applying cluster TLS profile"
+```
+
+**Expected**: Log shows:
+```
+"Applying cluster TLS profile to metrics and webhook servers"
+ minTLSVersion="VersionTLS12"
+ adherencePolicy="StrictAllComponents"
+```
+
+## Test 3: Profile Change Detection
+
+Verify controller restarts when TLS profile changes.
+
+```bash
+# Change to a different profile (e.g., Modern)
+oc patch apiserver cluster --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Modern","modern":{}}}}'
+
+# Wait for automatic restart
+sleep 20
+
+# Get new pod and check logs
+CONTROLLER_POD=$(oc get pods -n openshift-operators -l app.kubernetes.io/name=devworkspace-controller -o jsonpath='{.items[0].metadata.name}')
+oc logs -n openshift-operators $CONTROLLER_POD -c devworkspace-controller | grep -A3 "Applying cluster TLS profile"
+```
+
+**Expected**: Log shows `minTLSVersion="VersionTLS13"` (Modern profile) and a restart message like `"TLS security profile changed; initiating graceful restart"`.
+
+## Test 4: Policy Change Detection
+
+Verify controller restarts when adherence policy changes.
+
+```bash
+# Change policy to LegacyAdheringComponentsOnly (does not honor profile)
+oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"LegacyAdheringComponentsOnly"}}'
+
+# Wait for automatic restart
+sleep 20
+
+# Check logs
+CONTROLLER_POD=$(oc get pods -n openshift-operators -l app.kubernetes.io/name=devworkspace-controller -o jsonpath='{.items[0].metadata.name}')
+oc logs -n openshift-operators $CONTROLLER_POD -c devworkspace-controller | grep -i "tls"
+```
+
+**Expected**: Log shows `"using Go default TLS configuration"` with `policy="LegacyAdheringComponentsOnly"` and a restart message like `"TLS adherence policy changed; initiating graceful restart"`.
+
+## Test 5: Smoke Test
+
+Verify controller functions correctly with TLS adherence enabled.
+
+```bash
+# Re-enable StrictAllComponents
+oc patch apiserver cluster --type=merge -p '{"spec":{"tlsAdherence":"StrictAllComponents"}}'
+
+# Wait for automatic restart
+sleep 20
+
+# Create test workspace
+cat <<EOF | oc apply -f -
+apiVersion: workspace.devfile.io/v1alpha2
+kind: DevWorkspace
+metadata:
+ name: tls-test-workspace
+ namespace: default
+spec:
+ started: true
+ template:
+ components:
+ - name: tooling
+ container:
+ image: quay.io/devfile/universal-developer-image:ubi8-latest
+EOF
+
+# Wait for workspace to start
+oc get devworkspace tls-test-workspace -n default -w
+
+# Clean up
+oc delete devworkspace tls-test-workspace -n default
+```
+
+**Expected**: Workspace reaches `Running` phase.
+
+## Cleanup
+
+```bash
+# Remove tlsAdherence and tlsSecurityProfile
+oc patch apiserver cluster --type=json -p '[{"op":"remove","path":"/spec/tlsAdherence"},{"op":"remove","path":"/spec/tlsSecurityProfile"}]'
+
+# Delete controller pod to reset to defaults
+oc delete pod -n openshift-operators -l app.kubernetes.io/name=devworkspace-controller
+```
+
+## Notes
+
+- **OLM-managed deployment**: DWO is managed by OLM (Operator Lifecycle Manager), so use `oc delete pod` instead of `oc rollout restart` to force a restart.
+- **Automatic restarts**: Tests 3 and 4 verify the controller automatically restarts when the TLS profile or adherence policy changes (no manual restart needed).

controllers/workspace/devworkspace_controller.go

@@ -96,6 +96,7 @@ type DevWorkspaceReconciler struct {
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=clusterroles;clusterrolebindings,verbs=get;list;watch;create;update
 // +kubebuilder:rbac:groups=rbac.authorization.k8s.io,resources=roles;rolebindings,verbs=get;list;watch;create;update;delete
 // +kubebuilder:rbac:groups=oauth.openshift.io,resources=oauthclients,verbs=get;list;watch;create;update;patch;delete;deletecollection
+// +kubebuilder:rbac:groups=config.openshift.io,resources=apiservers,verbs=get;list;watch
 // +kubebuilder:rbac:groups=monitoring.coreos.com,resources=servicemonitors,verbs=get;create
 // +kubebuilder:rbac:groups=config.openshift.io,resources=proxies,verbs=get,resourceNames=cluster
 // +kubebuilder:rbac:groups=apps,resourceNames=devworkspace-controller,resources=deployments/finalizers,verbs=update

deploy/templates/components/rbac/role.yaml

@@ -133,6 +133,14 @@ rules:
  - patch
  - update
  - watch
+- apiGroups:
+ - config.openshift.io
+ resources:
+ - apiservers
+ verbs:
+ - get
+ - list
+ - watch
 - apiGroups:
  - config.openshift.io
  resourceNames:

go.mod

@@ -12,9 +12,10 @@ require (
 	github.com/google/gofuzz v1.2.0
 	github.com/google/uuid v1.6.0
 	github.com/kevinburke/ssh_config v1.2.0
-	github.com/onsi/ginkgo/v2 v2.27.4
-	github.com/onsi/gomega v1.39.0
-	github.com/openshift/api v0.0.0-20200205133042-34f0ec8dab87
+	github.com/onsi/ginkgo/v2 v2.28.1
+	github.com/onsi/gomega v1.39.1
+	github.com/openshift/api v0.0.0-20260317165824-54a3998d81eb
+	github.com/openshift/controller-runtime-common v0.0.0-20260428152732-64ee174f5e2e
 	github.com/operator-framework/operator-lib v0.11.0
 	github.com/prometheus/client_golang v1.23.2
 	github.com/robfig/cron/v3 v3.0.0
@@ -60,11 +61,10 @@ require (
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
-	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/google/cel-go v0.29.0 // indirect
 	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 // indirect
+	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.7 // indirect
 	github.com/hashicorp/errwrap v1.0.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
@@ -78,6 +78,7 @@ require (
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/openshift/library-go v0.0.0-20260213153706-03f1709971c5 // indirect
 	github.com/pjbgf/sha1cd v0.6.0 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
 	github.com/prometheus/client_model v0.6.2 // indirect