CNTRLPLANE-3423: feat: inject centralized TLS into console operand

cmd/bridge/main.go

@@ -765,7 +765,7 @@ func main() {
 		klog.Info("HTTP/2 enabled")
 	}
 
-	listener, err := listen(listenURL.Scheme, listenURL.Host, *fTLSCertFile, *fTLSKeyFile)
+	listener, err := listen(listenURL.Scheme, listenURL.Host, *fTLSCertFile, *fTLSKeyFile, cfg.ServingInfo.MinTLSVersion, cfg.ServingInfo.CipherSuites)
 	if err != nil {
 		klog.Fatalf("error getting listener, %v", err)
 	}
@@ -804,7 +804,7 @@ func main() {
 	httpsrv.Serve(listener)
 }
 
-func listen(scheme, host, certFile, keyFile string) (net.Listener, error) {
+func listen(scheme, host, certFile, keyFile, minTLSVersion string, cipherSuites []string) (net.Listener, error) {
 	klog.Infof("Binding to %s...", host)
 	if scheme == "http" {
 		klog.Info("Not using TLS")
@@ -822,5 +822,26 @@ func listen(scheme, host, certFile, keyFile string) (net.Listener, error) {
 			return &cert, nil
 		},
 	}
+
+	if minTLSVersion != "" {
+		minVersion, err := oscrypto.TLSVersion(minTLSVersion)
+		if err != nil {
+			return nil, fmt.Errorf("invalid minTLSVersion %q: %w", minTLSVersion, err)
+		}
+		tlsConfig.MinVersion = minVersion
+	}
+
+	if len(cipherSuites) > 0 {
+		ciphers := make([]uint16, 0, len(cipherSuites))
+		for _, cipherName := range cipherSuites {
+			cipher, err := oscrypto.CipherSuite(cipherName)
+			if err != nil {
+				return nil, fmt.Errorf("invalid cipher suite %q: %w", cipherName, err)
+			}
+			ciphers = append(ciphers, cipher)
+		}
+		tlsConfig.CipherSuites = ciphers
+	}
+
 	return tls.Listen("tcp", host, tlsConfig)
 }

go.mod

@@ -15,8 +15,8 @@ require (
 	github.com/gorilla/sessions v1.4.0
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
 	github.com/openshift/api v3.9.0+incompatible
-	github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13
-	github.com/openshift/library-go v0.0.0-20231020125034-5a2d9fe760b3
+	github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1
+	github.com/openshift/library-go v0.0.0-20260518122146-385e91fd29b1
 	github.com/operator-framework/api v0.42.0
 	github.com/operator-framework/kubectl-operator v0.6.1-0.20250318134414-b496b1036eaf
 	github.com/operator-framework/operator-controller v1.2.0

go.sum

@@ -434,10 +434,10 @@ github.com/opencontainers/runtime-spec v1.3.0 h1:YZupQUdctfhpZy3TM39nN9Ika5CBWT5
 github.com/opencontainers/runtime-spec v1.3.0/go.mod h1:jwyrGlmzljRJv/Fgzds9SsS/C5hL+LL3ko9hs6T5lQ0=
 github.com/openshift/api v0.0.0-20260114133223-6ab113cb7368 h1:kSr3DOlq0NCrHd65HB2o/pBsks7AfRm+fkpf9RLUPoc=
 github.com/openshift/api v0.0.0-20260114133223-6ab113cb7368/go.mod h1:d5uzF0YN2nQQFA0jIEWzzOZ+edmo6wzlGLvx5Fhz4uY=
-github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13 h1:6rd4zSo2UaWQcAPZfHK9yzKVqH0BnMv1hqMzqXZyTds=
-github.com/openshift/client-go v0.0.0-20260108185524-48f4ccfc4e13/go.mod h1:YvOmPmV7wcJxpfhTDuFqqs2Xpb3M3ovsM6Qs/i2ptq4=
-github.com/openshift/library-go v0.0.0-20231020125034-5a2d9fe760b3 h1:RmbS0Ea69/ejW0HqUoUjO72EfNc/biuVDjODEDl/EnE=
-github.com/openshift/library-go v0.0.0-20231020125034-5a2d9fe760b3/go.mod h1:8UzmrBMCn7+GzouL8DVYkL9COBQTB1Ggd13/mHJQCUg=
+github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1 h1:Hr/R38eg5ZJXfbiaHumjJIN1buDZwhsm4ys4npVCXH0=
+github.com/openshift/client-go v0.0.0-20260317180604-743f664b82d1/go.mod h1:Za51LlH76ALiQ/aKGBYJXmyJNkA//IDJ+I///30CA2M=
+github.com/openshift/library-go v0.0.0-20260518122146-385e91fd29b1 h1:PV/TYEV+otsCxgXPakMaK1KXxcmtZhKPkmoSrU2tMF4=
+github.com/openshift/library-go v0.0.0-20260518122146-385e91fd29b1/go.mod h1:rYGQrSg+t1JEzeEwg6BJw3loPpXg/n3kgRygUpgxavY=
 github.com/operator-framework/api v0.42.0 h1:rkc5V3zW8RxZMjePAe12jdL7Co/hwsYo1pLnkkhuR7s=
 github.com/operator-framework/api v0.42.0/go.mod h1:bMEj+wl/8tGqcGNtxt38cLUYagu9chNsbYzb/5HQaUQ=
 github.com/operator-framework/kubectl-operator v0.6.1-0.20250318134414-b496b1036eaf h1:TsqL/iEVSwf2IUx3wDqD664pYC6vYR9/d/gfVO4cgH8=

pkg/serverconfig/config.go

@@ -236,14 +236,6 @@ func addServingInfo(fs *flag.FlagSet, servingInfo *ServingInfo) (err error) {
 		return errors.New("servingInfo.namedCertificates are not supported")
 	}
 
-	if servingInfo.MinTLSVersion != "" {
-		return errors.New("servingInfo.minTLSVersion is not supported")
-	}
-
-	if len(servingInfo.CipherSuites) > 0 {
-		return errors.New("servingInfo.cipherSuites is not supported")
-	}
-
 	if servingInfo.MaxRequestsInFlight != 0 {
 		return errors.New("servingInfo.maxRequestsInFlight is not supported")
 	}

pkg/serverconfig/types.go

@@ -44,18 +44,18 @@ type ProxyService struct {
 
 // ServingInfo holds configuration for serving HTTP.
 type ServingInfo struct {
-	BindAddress  string `yaml:"bindAddress,omitempty"`
-	CertFile     string `yaml:"certFile,omitempty"`
-	KeyFile      string `yaml:"keyFile,omitempty"`
-	RedirectPort int    `yaml:"redirectPort,omitempty"`
+	BindAddress   string   `yaml:"bindAddress,omitempty"`
+	CertFile      string   `yaml:"certFile,omitempty"`
+	KeyFile       string   `yaml:"keyFile,omitempty"`
+	RedirectPort  int      `yaml:"redirectPort,omitempty"`
+	MinTLSVersion string   `yaml:"minTLSVersion,omitempty"`
+	CipherSuites  []string `yaml:"cipherSuites,omitempty"`
 
 	// These fields are defined in `HTTPServingInfo`, but are not supported for console. Fail if any are specified.
 	// https://github.com/openshift/api/blob/0cb4131a7636e1ada6b2769edc9118f0fe6844c8/config/v1/types.go#L7-L38
 	BindNetwork           string        `yaml:"bindNetwork,omitempty"`
 	ClientCA              string        `yaml:"clientCA,omitempty"`
 	NamedCertificates     []interface{} `yaml:"namedCertificates,omitempty"`
-	MinTLSVersion         string        `yaml:"minTLSVersion,omitempty"`
-	CipherSuites          []string      `yaml:"cipherSuites,omitempty"`
 	MaxRequestsInFlight   int64         `yaml:"maxRequestsInFlight,omitempty"`
 	RequestTimeoutSeconds int64         `yaml:"requestTimeoutSeconds,omitempty"`
 }