TEMPORARY: Combine PR #2883 + #2998 to verify feature-promotion job

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml

@@ -223,6 +223,42 @@ spec:
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
+              tlsAdherence:
+                description: |-
+                  tlsAdherence controls if components in the cluster adhere to the TLS security profile
+                  configured on this APIServer resource.
+
+                  Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+                  When set to "LegacyAdheringComponentsOnly", components that already honor the
+                  cluster-wide TLS profile continue to do so. Components that do not already honor
+                  it continue to use their individual TLS configurations.
+
+                  When set to "StrictAllComponents", all components must honor the configured TLS
+                  profile unless they have a component-specific TLS configuration that overrides
+                  it. This mode is recommended for security-conscious deployments and is required
+                  for certain compliance frameworks.
+
+                  Note: Some components such as Kubelet and IngressController have their own
+                  dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+                  CRs respectively. When these component-specific TLS configurations are set,
+                  they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+                  these components fall back to the cluster-wide default.
+
+                  Components that encounter an unknown value for tlsAdherence should treat it
+                  as "StrictAllComponents" and log a warning to ensure forward compatibility
+                  while defaulting to the more secure behavior.
+
+                  This field is optional.
+                  When omitted, this means the user has no opinion and the platform is left
+                  to choose reasonable defaults. These defaults are subject to change over time.
+                  The current default is LegacyAdheringComponentsOnly.
+
+                  Once set, this field may be changed to a different value, but may not be removed.
+                enum:
+                - LegacyAdheringComponentsOnly
+                - StrictAllComponents
+                type: string
               tlsSecurityProfile:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -380,6 +416,9 @@ spec:
                     type: string
                 type: object
             type: object
+            x-kubernetes-validations:
+            - message: tlsAdherence may not be removed once set
+              rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
           status:
             description: status holds observed values from the cluster. They may not
               be overridden.

config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml

@@ -223,6 +223,42 @@ spec:
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
+              tlsAdherence:
+                description: |-
+                  tlsAdherence controls if components in the cluster adhere to the TLS security profile
+                  configured on this APIServer resource.
+
+                  Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+                  When set to "LegacyAdheringComponentsOnly", components that already honor the
+                  cluster-wide TLS profile continue to do so. Components that do not already honor
+                  it continue to use their individual TLS configurations.
+
+                  When set to "StrictAllComponents", all components must honor the configured TLS
+                  profile unless they have a component-specific TLS configuration that overrides
+                  it. This mode is recommended for security-conscious deployments and is required
+                  for certain compliance frameworks.
+
+                  Note: Some components such as Kubelet and IngressController have their own
+                  dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+                  CRs respectively. When these component-specific TLS configurations are set,
+                  they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+                  these components fall back to the cluster-wide default.
+
+                  Components that encounter an unknown value for tlsAdherence should treat it
+                  as "StrictAllComponents" and log a warning to ensure forward compatibility
+                  while defaulting to the more secure behavior.
+
+                  This field is optional.
+                  When omitted, this means the user has no opinion and the platform is left
+                  to choose reasonable defaults. These defaults are subject to change over time.
+                  The current default is LegacyAdheringComponentsOnly.
+
+                  Once set, this field may be changed to a different value, but may not be removed.
+                enum:
+                - LegacyAdheringComponentsOnly
+                - StrictAllComponents
+                type: string
               tlsSecurityProfile:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -380,6 +416,9 @@ spec:
                     type: string
                 type: object
             type: object
+            x-kubernetes-validations:
+            - message: tlsAdherence may not be removed once set
+              rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
           status:
             description: status holds observed values from the cluster. They may not
               be overridden.

features.md

@@ -84,7 +84,6 @@
 | OnPremDNSRecords| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | SELinuxMount| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | SignatureStores| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
-| TLSAdherence| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | TLSGroupPreferences| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereConfigurableMaxAllowedBlockVolumesPerNode| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereMultiVCenterDay2| | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | | | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
@@ -120,6 +119,7 @@
 | SigstoreImageVerification| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | SigstoreImageVerificationPKI| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | StoragePerformantSecurityPolicy| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
+| TLSAdherence| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | UpgradeStatus| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereHostVMGroupZonal| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |
 | VSphereMixedNodeEnv| <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span> | <span style="background-color: #519450">Enabled</span>  |

features/features.go

@@ -1010,7 +1010,7 @@ var (
 				contactPerson("joelanford").
 				productScope(ocpSpecific).
 				enhancementPR("https://github.com/openshift/enhancements/pull/1910").
-				enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
+				enable(inDefault(), inOKD(), inTechPreviewNoUpgrade(), inDevPreviewNoUpgrade()).
 				mustRegister()
 
 	FeatureGateConfidentialCluster = newFeatureGate("ConfidentialCluster").

payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml

@@ -223,6 +223,42 @@ spec:
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
+              tlsAdherence:
+                description: |-
+                  tlsAdherence controls if components in the cluster adhere to the TLS security profile
+                  configured on this APIServer resource.
+
+                  Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+                  When set to "LegacyAdheringComponentsOnly", components that already honor the
+                  cluster-wide TLS profile continue to do so. Components that do not already honor
+                  it continue to use their individual TLS configurations.
+
+                  When set to "StrictAllComponents", all components must honor the configured TLS
+                  profile unless they have a component-specific TLS configuration that overrides
+                  it. This mode is recommended for security-conscious deployments and is required
+                  for certain compliance frameworks.
+
+                  Note: Some components such as Kubelet and IngressController have their own
+                  dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+                  CRs respectively. When these component-specific TLS configurations are set,
+                  they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+                  these components fall back to the cluster-wide default.
+
+                  Components that encounter an unknown value for tlsAdherence should treat it
+                  as "StrictAllComponents" and log a warning to ensure forward compatibility
+                  while defaulting to the more secure behavior.
+
+                  This field is optional.
+                  When omitted, this means the user has no opinion and the platform is left
+                  to choose reasonable defaults. These defaults are subject to change over time.
+                  The current default is LegacyAdheringComponentsOnly.
+
+                  Once set, this field may be changed to a different value, but may not be removed.
+                enum:
+                - LegacyAdheringComponentsOnly
+                - StrictAllComponents
+                type: string
               tlsSecurityProfile:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -380,6 +416,9 @@ spec:
                     type: string
                 type: object
             type: object
+            x-kubernetes-validations:
+            - message: tlsAdherence may not be removed once set
+              rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
           status:
             description: status holds observed values from the cluster. They may not
               be overridden.

payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml

@@ -223,6 +223,42 @@ spec:
                     type: array
                     x-kubernetes-list-type: atomic
                 type: object
+              tlsAdherence:
+                description: |-
+                  tlsAdherence controls if components in the cluster adhere to the TLS security profile
+                  configured on this APIServer resource.
+
+                  Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+                  When set to "LegacyAdheringComponentsOnly", components that already honor the
+                  cluster-wide TLS profile continue to do so. Components that do not already honor
+                  it continue to use their individual TLS configurations.
+
+                  When set to "StrictAllComponents", all components must honor the configured TLS
+                  profile unless they have a component-specific TLS configuration that overrides
+                  it. This mode is recommended for security-conscious deployments and is required
+                  for certain compliance frameworks.
+
+                  Note: Some components such as Kubelet and IngressController have their own
+                  dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+                  CRs respectively. When these component-specific TLS configurations are set,
+                  they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+                  these components fall back to the cluster-wide default.
+
+                  Components that encounter an unknown value for tlsAdherence should treat it
+                  as "StrictAllComponents" and log a warning to ensure forward compatibility
+                  while defaulting to the more secure behavior.
+
+                  This field is optional.
+                  When omitted, this means the user has no opinion and the platform is left
+                  to choose reasonable defaults. These defaults are subject to change over time.
+                  The current default is LegacyAdheringComponentsOnly.
+
+                  Once set, this field may be changed to a different value, but may not be removed.
+                enum:
+                - LegacyAdheringComponentsOnly
+                - StrictAllComponents
+                type: string
               tlsSecurityProfile:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -380,6 +416,9 @@ spec:
                     type: string
                 type: object
             type: object
+            x-kubernetes-validations:
+            - message: tlsAdherence may not be removed once set
+              rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
           status:
             description: status holds observed values from the cluster. They may not
               be overridden.

payload-manifests/featuregates/featureGate-4-10-Hypershift-Default.yaml

@@ -263,9 +263,6 @@
                     {
                         "name": "SignatureStores"
                     },
-                    {
-                        "name": "TLSAdherence"
-                    },
                     {
                         "name": "TLSGroupPreferences"
                     },
@@ -376,6 +373,9 @@
                     {
                         "name": "StoragePerformantSecurityPolicy"
                     },
+                    {
+                        "name": "TLSAdherence"
+                    },
                     {
                         "name": "UpgradeStatus"
                     },

payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml

@@ -265,9 +265,6 @@
                     {
                         "name": "SignatureStores"
                     },
-                    {
-                        "name": "TLSAdherence"
-                    },
                     {
                         "name": "TLSGroupPreferences"
                     },
@@ -378,6 +375,9 @@
                     {
                         "name": "StoragePerformantSecurityPolicy"
                     },
+                    {
+                        "name": "TLSAdherence"
+                    },
                     {
                         "name": "UpgradeStatus"
                     },

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-Default.yaml

@@ -251,9 +251,6 @@
                     {
                         "name": "SignatureStores"
                     },
-                    {
-                        "name": "TLSAdherence"
-                    },
                     {
                         "name": "TLSGroupPreferences"
                     },
@@ -376,6 +373,9 @@
                     {
                         "name": "StoragePerformantSecurityPolicy"
                     },
+                    {
+                        "name": "TLSAdherence"
+                    },
                     {
                         "name": "UpgradeStatus"
                     },

payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

@@ -253,9 +253,6 @@
                     {
                         "name": "SignatureStores"
                     },
-                    {
-                        "name": "TLSAdherence"
-                    },
                     {
                         "name": "TLSGroupPreferences"
                     },
@@ -378,6 +375,9 @@
                     {
                         "name": "StoragePerformantSecurityPolicy"
                     },
+                    {
+                        "name": "TLSAdherence"
+                    },
                     {
                         "name": "UpgradeStatus"
                     },