Skip to content

OpenShift Tls profile compliance rsync-tls#1955

Open
tesshuflower wants to merge 2 commits intobackube:mainfrom
tesshuflower:tls_profile_compliance_rsync-tls
Open

OpenShift Tls profile compliance rsync-tls#1955
tesshuflower wants to merge 2 commits intobackube:mainfrom
tesshuflower:tls_profile_compliance_rsync-tls

Conversation

@tesshuflower
Copy link
Contributor

Describe what this PR does

TLS Profile compliance for OpenShift clusters - updates for rsync-tls mover

  • destination side only - if the tlsProfileSpec from openshift dictates minTLSVersion and ciphers, these may get used for rsync-tls in setting up the stunnel.conf
    Notes:
  • stunnel allows for setting TLS 1.3 ciphersuites via the "ciphersuites" setting in stunnel.conf
  • the old cipher=PSK is only used for TLS 1.2
  • only 3 out of the 5 ciphersuites seem to be available to use with stunnel/openssl (not sure which governs this), and additionally it looks like this cipher suite: TLS_AES_256_GCM_SHA384 does not appear to work when testing with stunnel & PSK.
  • So when building the ciphersuites to use for sTunnel, if the list only includes invalid ciphers, we will not set ciphersuites and let it default (to avoid an issue that will prevent rsync-tls from working entirely if the global ciphersuites are not setup correctly).
  • Should be no issue currently with the default available TLSPRofileSpec configs (e.g. intermediate or modern).

Is there anything that requires special attention?

Related issues:

Signed-off-by: Tesshu Flower <tflower@redhat.com>
Signed-off-by: Tesshu Flower <tflower@redhat.com>
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Mar 20, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tesshuflower

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@sonarqubecloud
Copy link

@tesshuflower
Copy link
Contributor Author

/retest

@codecov
Copy link

codecov bot commented Mar 24, 2026

Codecov Report

❌ Patch coverage is 56.09756% with 18 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.8%. Comparing base (6ff0a72) to head (9108902).
⚠️ Report is 12 commits behind head on main.

Files with missing lines Patch % Lines
internal/controller/mover/rsynctls/mover.go 5.2% 16 Missing and 2 partials ⚠️
Additional details and impacted files
@@           Coverage Diff           @@
##            main   #1955     +/-   ##
=======================================
- Coverage   68.9%   68.8%   -0.1%     
=======================================
  Files         58      58             
  Lines       6072    6113     +41     
=======================================
+ Hits        4186    4209     +23     
- Misses      1574    1590     +16     
- Partials     312     314      +2     
Files with missing lines Coverage Δ
internal/controller/platform/tlsprofile.go 81.0% <100.0%> (+11.5%) ⬆️
internal/controller/mover/rsynctls/mover.go 69.0% <5.2%> (-4.1%) ⬇️
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant