OCPCLOUD-3372: Use centralized tls profile for webhook tls

[damdo]

Summary by CodeRabbit

• New Features
  • Enabled webhook support for the AWS cloud controller manager.
  • Added configurable webhook TLS cipher suites and minimum TLS versions across supported cloud providers.
• Security
  • Webhook servers now honor configured TLS settings, allowing deployments to enforce stronger encryption requirements.
• Improvements
  • Updated cloud controller manager deployments to use webhook-specific secure communication settings instead of the previous disabled secure-port configuration.

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign racheljpg for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@damdo: This pull request references OCPCLOUD-3372 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Stacked on top of #433

To be tested in tandem with: openshift/cloud-provider-aws#127

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 699ad2f8-85f6-4557-af71-4f1810e476f0

📥 Commits

Reviewing files that changed from the base of the PR and between bc52198 and 954cab7.

📒 Files selected for processing (9)

• pkg/cloud/aws/assets/deployment.yaml
• pkg/cloud/azure/assets/cloud-controller-manager-deployment.yaml
• pkg/cloud/azurestack/assets/cloud-controller-manager-deployment.yaml
• pkg/cloud/gcp/assets/cloud-controller-manager.yaml
• pkg/cloud/ibm/assets/deployment.yaml
• pkg/cloud/nutanix/assets/cloud-controller-manager-deployment.yaml
• pkg/cloud/openstack/assets/deployment.yaml
• pkg/cloud/powervs/assets/deployment.yaml
• pkg/cloud/vsphere/assets/cloud-controller-manager-deployment.yaml

---

Walkthrough

The deployment manifests enable webhook TLS configuration across AWS and other cloud providers. They pass configured cipher suites and minimum TLS versions to webhook servers. Most manifests remove --secure-port=0.

Changes

Webhook TLS configuration

Layer / File(s)	Summary
AWS webhook enablement pkg/cloud/aws/assets/deployment.yaml	AWS enables webhooks and the CloudControllerManagerWebhook feature gate. It conditionally passes webhook TLS settings and removes --secure-port=0.
Provider webhook TLS flags pkg/cloud/{azure,azurestack,gcp,ibm,nutanix,openstack,powervs,vsphere}/assets/*	The deployment commands conditionally pass configured webhook cipher suites and minimum TLS versions. Most manifests remove --secure-port=0.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: mandre, mdbooth

---

Important

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Container-Privileges	❌ Error	All nine changed Kubernetes manifests set hostNetwork: true, which the container-privileges check explicitly flags; the setting is present even though unchanged.	Remove hostNetwork: true where possible, or document the operational need and obtain an approved security exception.

✅ Passed checks (14 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: using centralized TLS settings for webhook TLS configuration.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	The PR changes only nine deployment YAML files. The patch adds webhook flags and template conditionals, with no Ginkgo test-title calls or dynamic test names.
Test Structure And Quality	✅ Passed	The commit changes only nine deployment YAML files; it adds no Ginkgo test files or test constructs, so the listed test-quality requirements do not apply.
Microshift Test Compatibility	✅ Passed	The PR changes only nine YAML deployment assets; the diff adds no Ginkgo tests or test declarations, so MicroShift test compatibility is not applicable.
Single Node Openshift (Sno) Test Compatibility	✅ Passed	The PR changes only nine YAML deployment assets and adds no Ginkgo e2e tests or other test code, so SNO multi-node compatibility checks do not apply.
Topology-Aware Scheduling Compatibility	✅ Passed	The PR adds only webhook and TLS command flags across nine manifests; no scheduling fields or topology constraints appear in added lines.
Ote Binary Stdout Contract	✅ Passed	The PR changes only nine YAML deployment assets; no Go files or process-level stdout/logging code changed, so the OTE binary stdout contract is not implicated.
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	The commit changes only nine deployment YAML files; it adds no Ginkgo tests, IPv4 assumptions, or external connectivity requirements.
No-Weak-Crypto	✅ Passed	The commit adds only templated webhook TLS flags that reuse centralized values; added lines contain no MD5, SHA1, DES, RC4, Blowfish, ECB, custom crypto, or secret comparisons.
No-Sensitive-Data-In-Logs	✅ Passed	The diff adds only webhook/TLS arguments; scans found no logging calls or sensitive-data literals, and TLS values come from centralized TLS configuration fields.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci-robot]

@damdo: This pull request explicitly references no jira issue.

Details

In response to this:

Stacked on top of #433

To be tested in tandem with: openshift/cloud-provider-aws#127

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@damdo: This pull request references OCPCLOUD-3372 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@damdo: This pull request references OCPCLOUD-3372 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set.

Details

In response to this:

Summary by CodeRabbit

• New Features
• Enabled webhook support for the AWS cloud controller manager.
• Added configurable webhook TLS cipher suites and minimum TLS versions across supported cloud providers.
• Security
• Webhook servers now honor configured TLS settings, allowing deployments to enforce stronger encryption requirements.
• Improvements
• Updated cloud controller manager deployments to use webhook-specific secure communication settings instead of the previous disabled secure-port configuration.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[damdo]

/retest

[damdo]

/retest

[damdo]

/test ?

[damdo]

/test e2e-openstack-ovn e2e-vsphere-ovn e2e-gcp-ovn e2e-azure-ovn

[damdo]

/retest

[damdo]

/retest

[openshift-ci]

@damdo: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-azure-ovn-upgrade	954cab7	link	true	/test e2e-azure-ovn-upgrade
ci/prow/e2e-azure-ovn	954cab7	link	false	/test e2e-azure-ovn
ci/prow/e2e-openstack-ovn	954cab7	link	false	/test e2e-openstack-ovn
ci/prow/level0-clusterinfra-azure-ipi-proxy-tests	954cab7	link	false	/test level0-clusterinfra-azure-ipi-proxy-tests
ci/prow/e2e-nutanix-ovn	954cab7	link	false	/test e2e-nutanix-ovn

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.