feat(gitops-backend): Configure TLS MinVersion and Ciphers by akhilnittala · Pull Request #1227 · redhat-developer/gitops-operator

akhilnittala · 2026-07-21T06:31:27Z

What type of PR is this?
/kind enhancement
What does this PR do / why we need it:

To make gitops backend component complaint with OCP 5.0 goals, making tls minversion and ciphers configurable.

Have you updated the necessary documentation?

Documentation update is required by this PR.
Documentation has been updated.

Which issue(s) this PR fixes:

Fixes #?
https://redhat.atlassian.net/browse/GITOPS-10474
Test acceptance criteria:

Unit Test
E2E Test

How to test changes / Special notes to the reviewer:

deploy gitops operator on ocp cluster, check the apiserver and tls settings accordingly for create and update scenarios.

…nd component Signed-off-by: akhil nittala <nakhil@redhat.com>

coderabbitai · 2026-07-21T06:31:50Z

Warning

Review limit reached

@akhilnittala, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 31 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: df3b7a85-b569-464d-a466-d652f5a7862f

📥 Commits

Reviewing files that changed from the base of the PR and between 2485839 and cd00b10.

📒 Files selected for processing (1)

cmd/main.go

📝 Walkthrough

Walkthrough

The controller now receives a TLS profile and passes its minimum TLS version and cipher suites to the GitOps backend Deployment through environment variables.

Changes

TLS backend configuration

Layer / File(s)	Summary
TLS configuration wiring `controllers/gitopsservice_controller.go`, `cmd/main.go`	`ReconcileGitopsService` stores a TLS profile, startup initializes it, and backend Deployment reconciliation passes it to the Deployment builder.
Backend TLS environment `controllers/gitopsservice_controller.go`, `controllers/gitopsservice_controller_test.go`	Backend deployment creation conditionally adds `TLS_MIN_VERSION` and `TLS_CIPHER_SUITES`, with tests covering TLS versions and cipher-suite formatting.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: anandrkskd, varshab1210

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: configuring backend TLS minimum version and ciphers.
Description check	✅ Passed	The description is directly related to the change and explains the TLS configurability goal for the backend.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

🧹 Nitpick comments (1)

controllers/gitopsservice_controller.go (1)

803-814: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Use a switch statement instead of a map.

To avoid allocating a map on every function call, consider using a switch statement. It is more idiomatic and performs better.

♻️ Proposed refactor

 func TLSVersionToBackend(tlsVersion string) string {
-	versionMap := map[string]string{
-		"VersionTLS12": "1.2",
-		"VersionTLS13": "1.3",
-		"VersionTLS11": "1.1",
-		"VersionTLS10": "1",
-	}
-	if v, ok := versionMap[tlsVersion]; ok {
-		return v
-	}
-	return "" // default fallback
+	switch tlsVersion {
+	case "VersionTLS12":
+		return "1.2"
+	case "VersionTLS13":
+		return "1.3"
+	case "VersionTLS11":
+		return "1.1"
+	case "VersionTLS10":
+		return "1"
+	default:
+		return "" // default fallback
+	}
 }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@controllers/gitopsservice_controller.go` around lines 803 - 814, Update
TLSVersionToBackend to replace the per-call versionMap allocation with a switch
on tlsVersion, returning the existing TLS version strings for VersionTLS10
through VersionTLS13 and preserving the empty-string fallback for unknown
values.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@controllers/gitopsservice_controller.go`:
- Around line 803-814: Update TLSVersionToBackend to replace the per-call
versionMap allocation with a switch on tlsVersion, returning the existing TLS
version strings for VersionTLS10 through VersionTLS13 and preserving the
empty-string fallback for unknown values.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 21920b77-0290-4a4e-877d-7c69f5b22609

📥 Commits

Reviewing files that changed from the base of the PR and between 8695d85 and 3f8dcc0.

📒 Files selected for processing (2)

cmd/main.go
controllers/gitopsservice_controller.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

argoproj-labs/argocd-operator (manual)

…nd component Signed-off-by: akhil nittala <nakhil@redhat.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@controllers/gitopsservice_controller_test.go`:
- Around line 113-126: In controllers/gitopsservice_controller_test.go sites
113-126 and 133-146, update both environment-variable loops to remove the early
break statements so TLS_MIN_VERSION and TLS_CIPHER_SUITES are always collected.
Separate the assertions in each test so gotTLSMinVersion is independently
checked against "1.3" and gotTLSCiphers is independently checked against
"dummy1" at 113-126 and "dummy1:dummy2" at 133-146.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 68ef1871-9cc1-442b-9fea-2370e80ce23a

📥 Commits

Reviewing files that changed from the base of the PR and between 3f8dcc0 and 0eaf3c7.

📒 Files selected for processing (1)

controllers/gitopsservice_controller_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

argoproj-labs/argocd-operator (manual)

akhilnittala · 2026-07-22T04:38:31Z

/retest-required

akhilnittala · 2026-07-22T10:28:25Z

/retest-required

akhilnittala · 2026-07-22T17:49:43Z

/retest-required

akhilnittala · 2026-07-22T17:50:28Z

/retest

Signed-off-by: akhil nittala <nakhil@redhat.com>

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@cmd/main.go`:
- Line 315: Update the GitOps service reconciler initialization in main to
assign the fetched profile from the existing profile variable to
CentralTLSProfile instead of an empty TLSProfileSpec. Preserve the fetched
cluster TLS profile so newBackendDeployment can emit the corresponding TLS
environment variables.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Pro Plus

Run ID: 0b96129c-53b2-4d7f-802f-aad391bfcc38

📥 Commits

Reviewing files that changed from the base of the PR and between 0eaf3c7 and dcd1e57.

📒 Files selected for processing (3)

cmd/main.go
controllers/gitopsservice_controller.go
controllers/gitopsservice_controller_test.go

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

argoproj-labs/argocd-operator (manual)

🚧 Files skipped from review as they are similar to previous changes (1)

controllers/gitopsservice_controller_test.go

Signed-off-by: akhil nittala <nakhil@redhat.com>

svghadi

/lgtm
/approve

openshift-ci · 2026-07-23T07:25:14Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: svghadi

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [svghadi]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[GITOPS-10474]: Configure TLS MinVersion and Ciphers for gitops backe…

3f8dcc0

…nd component Signed-off-by: akhil nittala <nakhil@redhat.com>

openshift-ci Bot added the kind/enhancement New feature or request label Jul 21, 2026

openshift-ci Bot requested review from anandrkskd and varshab1210 July 21, 2026 06:31

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

[GITOPS-10474]: Configure TLS MinVersion and Ciphers for gitops backe…

0eaf3c7

…nd component Signed-off-by: akhil nittala <nakhil@redhat.com>

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread controllers/gitopsservice_controller_test.go

Merge branch 'master' into usr/akhil/GITOPS-10474

82a99da

akhilnittala closed this Jul 21, 2026

akhilnittala reopened this Jul 21, 2026

Merge branch 'master' into usr/akhil/GITOPS-10474

914842b

akhilnittala closed this Jul 22, 2026

akhilnittala reopened this Jul 22, 2026

svghadi reviewed Jul 23, 2026

View reviewed changes

Comment thread cmd/main.go Outdated

svghadi reviewed Jul 23, 2026

View reviewed changes

Comment thread controllers/gitopsservice_controller.go Outdated

feat(gitops-backend): Configure TLS MinVersion and Ciphers

dcd1e57

Signed-off-by: akhil nittala <nakhil@redhat.com>

coderabbitai Bot reviewed Jul 23, 2026

View reviewed changes

Comment thread cmd/main.go Outdated

akhilnittala added 2 commits July 23, 2026 12:20

feat(gitops-backend): Configure TLS MinVersion and Ciphers

2485839

Signed-off-by: akhil nittala <nakhil@redhat.com>

feat(gitops-backend): Configure TLS MinVersion and Ciphers

cd00b10

Signed-off-by: akhil nittala <nakhil@redhat.com>

svghadi approved these changes Jul 23, 2026

View reviewed changes

openshift-ci Bot assigned svghadi Jul 23, 2026

openshift-ci Bot added the lgtm label Jul 23, 2026

openshift-ci Bot added the approved label Jul 23, 2026

openshift-merge-bot Bot merged commit 276d5bf into redhat-developer:master Jul 23, 2026
17 of 18 checks passed

Uh oh!

Conversation

akhilnittala commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

akhilnittala commented Jul 22, 2026

Uh oh!

akhilnittala commented Jul 22, 2026

Uh oh!

akhilnittala commented Jul 22, 2026

Uh oh!

akhilnittala commented Jul 22, 2026

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

svghadi left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Jul 23, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

akhilnittala commented Jul 21, 2026 •

edited

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading