[feat]Add centrally managed TLS configuration for console-plugin nginx

[jkhelil]

Summary

Enables the console-plugin nginx server to inherit TLS settings from the centrally managed APIServer TLS Profile for Post-Quantum Cryptography (PQC) readiness compliance.

Changes

• Modified: pkg/reconciler/openshift/tektonconfig/console_plugin_reconciler.go

  • Added TLS parameters support (TLS_MIN_VERSION, TLS_CIPHER_SUITES, TLS_CURVE_PREFERENCES)
  • Implemented nginx.conf transformation to inject TLS directives
  • Added fail-safe defaults when env vars are not set
  • Cipher suites intentionally skipped (using nginx secure defaults)

• Modified: pkg/reconciler/openshift/tektonconfig/console_plugin_reconciler_test.go

  • Added comprehensive unit tests for TLS configuration
  • 22 test cases covering all scenarios (default, partial, full config)

Test Results

Test 1: Default Configuration (No Env Vars)

Environment:

• No TLS environment variables set

Generated nginx.conf:

server {
    ssl_protocols TLSv1.2 TLSv1.3;
    listen              8443 ssl;
    listen              [::]:8443 ssl;
    ssl_certificate     /var/cert/tls.crt;
    ssl_certificate_key /var/cert/tls.key;
    root                /usr/share/nginx/html;
}

Result: ✅ Pod starts successfully, TLS 1.3 negotiated, no errors

---

Test 2: With TLS Environment Variables

Environment:

TLS_MIN_VERSION=VersionTLS13
TLS_CURVE_PREFERENCES=X25519,prime256v1,secp384r1

Generated nginx.conf:

server {
    ssl_protocols TLSv1.3;
    ssl_ecdh_curve X25519:prime256v1:secp384r1;
    listen              8443 ssl;
    listen              [::]:8443 ssl;
    ssl_certificate     /var/cert/tls.crt;
    ssl_certificate_key /var/cert/tls.key;
    root                /usr/share/nginx/html;
}

Result: ✅ Pod starts successfully, TLS 1.3 negotiated, curves applied, no errors

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Run make test lint before submitting a PR
• Includes tests (if functionality changed/added)
• Includes docs (if user facing)
• Commit messages follow commit message best practices

See the contribution guide for more details.

Release Notes

The console-plugin nginx server now inherits TLS settings from the centrally managed APIServer TLS Profile, improving Post-Quantum Cryptography (PQC) readiness compliance on OpenShift.
The nginx server reads TLS configuration from api server profile (TLS_MIN_VERSION, TLS_CIPHER_SUITES, TLS_CURVE_PREFERENCES) and injects them into nginx.conf at runtime.
When no tls paramters are set, the server falls back to secure defaults (TLSv1.2 and TLSv1.3).
Cipher suites are intentionally delegated to nginx's built-in secure defaults.

[jkhelil]

Manual Validation — TLS Propagation from APIServer Profile to nginx

Tested on OCP cluster: api.ci-ln-sbyz8bb-76ef8.aws-4.ci.openshift.org:6443

Setup

kubectl patch tektonconfig config --type=merge \
  -p '{"spec":{"platforms":{"openShift":{"enableCentralTLSConfig":true}}}}'

Test 1 — Intermediate Profile (default, no tlsSecurityProfile set)

APIServer TLS Profile:

{"intermediate":{},"type":"Intermediate"}

Generated nginx.conf (server block):

  server {
    ssl_protocols TLSv1.2 TLSv1.3;
    listen              8443 ssl;
    listen              [::]:8443 ssl;
    ssl_certificate     /var/cert/tls.crt;
    ssl_certificate_key /var/cert/tls.key;
    root                /usr/share/nginx/html;
  }

✅ ssl_protocols TLSv1.2 TLSv1.3 correctly reflects Intermediate profile

---

Test 2 — Old Profile (TLS 1.0+)

kubectl patch apiserver cluster --type=merge \
  -p '{"spec":{"tlsSecurityProfile":{"type":"Old","old":{}}}}'

Generated nginx.conf (server block) after reconcile:

  server {
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2 TLSv1.3;
    listen              8443 ssl;
    ...
  }

✅ ssl_protocols updated dynamically — InstallerSet recreated automatically

---

Observations

• TLS profile changes propagate without operator restart — the hash-based reconcile loop detects the change and recreates the console plugin InstallerSet
• TektonConfig status remains Ready: True throughout
• ssl_protocols indentation matches the rest of the nginx server block (4 spaces)
• Cipher suites are intentionally not configured (nginx TLS 1.3 secure defaults apply)

TektonConfig state: enableCentralTLSConfig: true, Ready: True
InstallerSet: tekton-config-console-plugin-manifests-xjwtk True

[jkhelil]

/kind feature

[anithapriyanatarajan]

@jkhelil - NIT - PR description mentions about injecting VARS whereas the actual implementation is by setting the SSL directives of niginx conf. Thank you.

[anithapriyanatarajan]

@jkhelil - featurewise, this PR was assessed by following the below steps:

oc -n openshift-pipelines port-forward svc/pipelines-console-plugin 8443:8443 &

# Highest version probe
echo | openssl s_client -connect localhost:8443 -tls1_3 2>&1 | grep -E 'Protocol|Server Temp Key'
# Expected: Protocol: TLSv1.3, Server Temp Key: X25519MLKEM768 (the PQC group!) (PASSED)

# Force PQC only — proves the server picks it
echo | openssl s_client -connect localhost:8443 -tls1_3 -groups X25519MLKEM768 2>&1 | grep -E 'Server Temp Key|handshake failure'
# Expected: Server Temp Key: X25519MLKEM768 (no failure) (PASSED)

# Force pre-TLS1.2 — must be rejected when profile is Modern/Intermediate
echo | openssl s_client -connect localhost:8443 -tls1_1 2>&1 \
   | grep -Eo 'handshake failure|no protocols|alert'
# Expected: handshake failure  (PASSED)

The nginx image upstream is supportive of the expected directive and ML-KEM in openssl gropus

We need make sure of these while doing downstream build as well . Thank you

[anithapriyanatarajan]

/lgtm

[pratap0007]

/lgtm

[anithapriyanatarajan]

/approve

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: anithapriyanatarajan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [anithapriyanatarajan]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment