Add pluggable ClusterTLSPolicy extension point - #243
Open
mytreya-rh wants to merge 3 commits into
Open
Conversation
Adds internal/cmd/ansible-operator/run/tlspolicy.go: a ClusterTLSPolicy interface (Apply/Watch) plus RegisterClusterTLSPolicy, and wires it into run/cmd.go: - run() now uses a cancellable context (derived from signals.SetupSignalHandler()) so a registered policy can trigger a graceful shutdown/restart. - If a policy is registered, Apply() is called after f.ToManagerOptions() and before manager.New() so it can augment manager.Options (e.g. metrics server TLSOpts). - If a policy is registered, Watch() is called once the manager exists and before mgr.Start(ctx), so it can react to policy changes at runtime. No policy is registered by default (registeredTLSPolicy is nil), so this is a no-op, backward-compatible change with zero new dependencies. This is intended as a generic extension point that distributions (e.g. OpenShift's downstream fork) can hook into to enforce a centralized TLS policy without needing to carry a diff to cmd.go/run.go itself. Co-authored-by: Cursor <cursoragent@cursor.com>
internal/cmd/ansible-operator/run/tlspolicy_test.go covers the ClusterTLSPolicy hook: registration, overwriting a previously registered policy, the no-op default (nothing registered), and the fail-open contract (Apply may return an error; callers are expected to log it and continue with the input options unchanged). Co-authored-by: Cursor <cursoragent@cursor.com>
4 tasks
Bumps [cryptography](https://github.com/pyca/cryptography) from 49.0.0 to 50.0.0. - [Changelog](https://github.com/pyca/cryptography/blob/main/CHANGELOG.rst) - [Commits](pyca/cryptography@49.0.0...50.0.0) --- updated-dependencies: - dependency-name: cryptography dependency-version: 50.0.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
internal/cmd/ansible-operator/run/tlspolicy.go: aClusterTLSPolicyinterface (Apply/Watch) plusRegisterClusterTLSPolicy, and wires it intorun/cmd.go:run()now uses a cancellable context (derived fromsignals.SetupSignalHandler()) so a registered policy can trigger a graceful shutdown/restart.Apply()is called afterf.ToManagerOptions()and beforemanager.New()so it can augmentmanager.Options(e.g. metrics serverTLSOpts).Watch()is called once the manager exists and beforemgr.Start(ctx), so it can react to policy changes at runtime.registeredTLSPolicyisnil), so this is a no-op, backward-compatible change with zero new dependencies.cmd.go/run.goitself.Test plan
go build ./...go vet ./...go test ./internal/cmd/ansible-operator/run/...(newtlspolicy_test.gocovers registration, overwrite, no-op default, and the fail-open contract)Made with Cursor