CM-966: Implement centralized TLS profile fetching and application without istio-csr changes#416

Open

arun717 wants to merge 25 commits into

openshift:masterfrom

arun717:tls_impl_without_istio-csr

Commits on Apr 16, 2026

feat(tlsprofile): add TLS profile mapping package

Arun Maurya
and
claude
committed
feat(controller): add TLS profile hook for cert-manager deployments

Arun Maurya
and
claude
committed
feat(controller): integrate TLS profile hook into deployment controller

Arun Maurya
and
claude
committed
chore(rbac): add APIServer resource permissions

Arun Maurya
and
claude
committed
docs(api): add certificate-request-minimum-backoff-duration flag example

Arun Maurya
and
claude
committed
style(trustmanager): fix comment formatting

Arun Maurya
and
claude
committed

Commits on Apr 17, 2026

Manual conflict resolution after rebase.
Arun Maurya
committed
fix: move TLS profile hook back to deployment package

Arun Maurya
and
claude
committed
fix(rbac): restrict apiservers resource to read-only permissions

Arun Maurya
and
claude
committed

Commits on Apr 21, 2026

feat(tlsprofile): add ClientTLSConfig for outbound TLS clients
Super User
committed
Removed hardcoding of TLS in test files.
Arun Maurya
committed
wire APIServer TLSSecurityProfile into istio-csr deployment
Arun Maurya
committed
fix(tlsprofile): ClientTLSConfig honors empty spec.Ciphers (nil = Go ciphers)
Arun Maurya
committed

Commits on Apr 24, 2026

after running make update-vendor locally.
Arun Maurya
committed

Commits on Apr 29, 2026

Removing parts dependent on istio-csr upstream changes.
Arun Maurya
committed

Commits on May 6, 2026

Addressing the coderabbit review comment for default case treated as intermediate type.
Arun Maurya
committed
tlsprofile: deep-copy builtin profile cipher slices in EffectiveSpec.
Arun Maurya
committed

Commits on May 7, 2026

Adding nil check to avoid panic before de-referencing.
Arun Maurya
committed

Commits on May 8, 2026

After git rebase with master and go get of openshift api,client-go and library-go with release-4.22
Arun Maurya
committed
Implementation related to tlsAdherence.
Arun Maurya
committed
generated code after running make commands.
Arun Maurya
committed
Resolved conflict manually with go.work.sum
Arun Maurya
committed
Bumping k8s.io/kubernetes and the stray v0.34.4 modules to v1.35.1 / v0.35.1 and running make bundle locally.
Arun Maurya
committed
istiocsr: make nodeSelector error test tolerant of k8s validation wording
Arun Maurya
committed

Commits on May 18, 2026

Resolving PR review comments.
Arun Maurya
committed