feat(cluster-storage-operator): inject centralized TLS configuration

Mount a configmap with an operator config injected with the HCP TLS security
profile.

Author: ingvagabund

control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-storage-operator/controller-config.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cluster-storage-operator-config
+data:
+  config.yaml: ""

control-plane-operator/controllers/hostedcontrolplane/v2/assets/cluster-storage-operator/deployment.yaml

@@ -20,8 +20,10 @@ spec:
       - args:
         - start
         - -v=2
+        - --config=/var/run/configmaps/config/config.yaml
         - --terminate-on-files=/var/run/secrets/serving-cert/tls.crt
         - --terminate-on-files=/var/run/secrets/serving-cert/tls.key
+        - --terminate-on-files=/var/run/configmaps/config/config.yaml
         - --guest-kubeconfig=/etc/guest-kubeconfig/kubeconfig
         command:
         - cluster-storage-operator
@@ -132,6 +134,9 @@ spec:
         volumeMounts:
         - mountPath: /etc/guest-kubeconfig
           name: guest-kubeconfig
+        - mountPath: /var/run/configmaps/config
+          name: config
+          readOnly: true
       securityContext:
         runAsNonRoot: true
         seccompProfile:
@@ -141,3 +146,6 @@ spec:
       - name: guest-kubeconfig
         secret:
           secretName: service-network-admin-kubeconfig
+      - configMap:
+          name: cluster-storage-operator-config
+        name: config

control-plane-operator/controllers/hostedcontrolplane/v2/storage/component.go

@@ -64,6 +64,10 @@ func NewComponent() component.ControlPlaneComponent {
 			component.WithAdaptFunction(adaptAzureCSIFileSecretProvider),
 			component.WithPredicate(isAroHCP),
 		).
+		WithManifestAdapter(
+			"controller-config.yaml",
+			component.WithAdaptFunction(adaptControllerConfig),
+		).
 		WithDependencies(oapiv2.ComponentName).
 		InjectAvailabilityProberContainer(podspec.AvailabilityProberOpts{
 			KubeconfigVolumeName: "guest-kubeconfig",

control-plane-operator/controllers/hostedcontrolplane/v2/storage/deployment.go

@@ -1,15 +1,21 @@
 package storage
 
 import (
+	"encoding/json"
+	"fmt"
 	"strconv"
 
 	"github.com/openshift/hypershift/support/azureutil"
 	"github.com/openshift/hypershift/support/config"
 	component "github.com/openshift/hypershift/support/controlplane-component"
 	"github.com/openshift/hypershift/support/podspec"
 
+	configv1 "github.com/openshift/api/config/v1"
+
 	appsv1 "k8s.io/api/apps/v1"
 	corev1 "k8s.io/api/core/v1"
+
+	"sigs.k8s.io/yaml"
 )
 
 func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Deployment) error {
@@ -41,3 +47,41 @@ func adaptDeployment(cpContext component.WorkloadContext, deployment *appsv1.Dep
 
 	return nil
 }
+
+func adaptControllerConfig(cpContext component.WorkloadContext, cm *corev1.ConfigMap) error {
+	profile := cpContext.HCP.Spec.Configuration.GetTLSSecurityProfile()
+	controllerConfig := configv1.GenericControllerConfig{
+		ServingInfo: configv1.HTTPServingInfo{
+			ServingInfo: configv1.ServingInfo{
+				BindAddress:   ":8443",
+				CipherSuites:  config.CipherSuites(profile),
+				MinTLSVersion: config.MinTLSVersion(profile),
+			},
+		},
+	}
+
+	asJSON, err := json.Marshal(controllerConfig)
+	if err != nil {
+		return fmt.Errorf("failed to json marshal config: %w", err)
+	}
+
+	asMap := map[string]any{}
+	if err := json.Unmarshal(asJSON, &asMap); err != nil {
+		return fmt.Errorf("failed to json unmarshal config: %w", err)
+	}
+
+	asMap["apiVersion"] = configv1.GroupVersion.String()
+	asMap["kind"] = "GenericControllerConfig"
+
+	data, err := yaml.Marshal(asMap)
+	if err != nil {
+		return fmt.Errorf("failed to yaml marshal config: %w", err)
+	}
+
+	if cm.Data == nil {
+		cm.Data = map[string]string{}
+	}
+
+	cm.Data["config.yaml"] = string(data)
+	return nil
+}