features: enable TLSAdherence feature gate for OKD featureset

[redhat-chai-bot]

Enable the TLSAdherence feature gate for the OKD featureset.

This adds inOKD() to the FeatureGateTLSAdherence enable call in features/features.go, making the TLSAdherence field available in OKD clusters. TLSAdherence was already enabled for DevPreviewNoUpgrade and TechPreviewNoUpgrade.

Changes

• features/features.go — Added inOKD() to the enable call
• Regenerated CRD manifests now include TLSAdherence fields for OKD variants
• Regenerated payload feature gate manifests move TLSAdherence from disabled to enabled for OKD
• features.md updated to reflect the new state

All generated files updated via make update. Verified with make verify.

Jira: https://redhat.atlassian.net/browse/OKD-442

---

AI-generated. Review for accuracy.

@Prashanth684 requested in Slack thread

[openshift-merge-bot]

Pipeline controller notification
This repo is configured to use the pipeline controller. Second-stage tests will be triggered either automatically or after lgtm label is added, depending on the repository configuration. The pipeline controller will automatically detect which contexts are required and will utilize /test Prow commands to trigger the second stage.

For optional jobs, comment /test ? to see a list of all defined jobs. To trigger manually all jobs from second stage use /pipeline required command.

This repository is configured in: LGTM mode

[openshift-ci]

Hello @redhat-chai-bot! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Central YAML (inherited)

Review profile: CHILL

Plan: Team

Run ID: 9d06139b-9efc-4f22-b41f-1449c839a195

📥 Commits

Reviewing files that changed from the base of the PR and between 8127870 and 9b3cc19.

⛔ Files ignored due to path filters (1)

• config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml is excluded by !**/zz_generated.crd-manifests/*

📒 Files selected for processing (5)

• features.md
• features/features.go
• payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml
• payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
• payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml

Included review availability: Your plan provides up to 2 included reviews per hour; 1 remains after this review.

---

📝 Walkthrough

Walkthrough

The APIServer CRD now supports the optional tlsAdherence field with two enum values and prevents removing it after configuration. TLSAdherence is enabled for the OKD cluster profile and both OKD FeatureGate manifests. The feature gate table was reordered without changing enablement values.

Suggested reviewers: damdo, vr4manta, djoshy

Merge Risk: ⚪ Minimal · up to 9b3cc

This change enables TLSAdherence for OKD and updates the corresponding generated manifests and documentation. No actionable merge-blocking risk remains beyond normal checks and review.

🚥 Pre-merge checks | ✅ 15

✅ Passed checks (15 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: enabling the TLSAdherence feature gate for the OKD featureset.
Description check	✅ Passed	The description directly explains the TLSAdherence enablement, the related generated manifest updates, and verification steps.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Stable And Deterministic Test Names	✅ Passed	PASS. The pull request changes feature-gate code, CRD manifests, payload manifests, and documentation only. The diff contains no Ginkgo title calls and no test metadata changes. The existing TLSAdhere…
Test Structure And Quality	✅ Passed	PASS: The pull request changes only feature-gate declarations, generated CRD manifests, feature-gate manifests, and documentation. The diff contains no Ginkgo test files, It blocks, cluster operatio…
Microshift Test Compatibility	✅ Passed	PASS: The pull request adds no Ginkgo e2e tests. The diff changes feature-gate code, generated CRD manifests, feature-gate manifests, and documentation only. Therefore, the MicroShift test compatibili…
Single Node Openshift (Sno) Test Compatibility	✅ Passed	PASS — The pull request adds no Ginkgo e2e tests. The verified diff changes only feature-gate code, generated CRD manifests, feature-gate manifests, and documentation. No It(), Describe(), Context(), …
Topology-Aware Scheduling Compatibility	✅ Passed	PASS: The pull request changes only feature-gate registration, generated APIServer CRD schemas, feature-gate manifests, and documentation. The changed YAML contains CRDs and feature-gate configuration…
Ote Binary Stdout Contract	✅ Passed	PASS: The pull request changes one feature-gate declaration and generated YAML/Markdown files. The changed Go line only adds inOKD() to FeatureGateTLSAdherence; it adds no fmt, klog, log, `o…
Ipv6 And Disconnected Network Test Compatibility	✅ Passed	PASS — The pull request adds no Ginkgo tests or test files. The exact diff changes feature-gate code, generated CRDs, feature-gate manifests, and documentation only. Added-line searches found no It/De…
No-Weak-Crypto	✅ Passed	This pull request enables the TLSAdherence feature gate for the OKD featureset. The primary change is in features/features.go, where inOKD() was added to the FeatureGateTLSAdherence enable cal…
Container-Privileges	✅ Passed	The pull request changes only the TLSAdherence feature gate, generated CRD schema fields, feature-gate manifests, and documentation. The added manifest content contains no privileged, hostPID, `ho…
No-Sensitive-Data-In-Logs	✅ Passed	PASS. The pull request changes a feature-gate declaration, CRD schema, generated manifests, and documentation. The exact diff adds no logging calls, log messages, or sensitive values. The `log a warni…

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (4 skipped: 4 unsupported.)

Full details: Stable And Deterministic Test Names

Explanation

PASS. The pull request changes feature-gate code, CRD manifests, payload manifests, and documentation only. The diff contains no Ginkgo title calls and no test metadata changes. The existing TLSAdherence test names are static descriptions, with no generated pod, node, namespace, timestamp, IP, or UUID values.

Full details: Test Structure And Quality

Explanation

PASS: The pull request changes only feature-gate declarations, generated CRD manifests, feature-gate manifests, and documentation. The diff contains no Ginkgo test files, It blocks, cluster operations, Eventually/Consistently calls, or test setup and cleanup code. Therefore, none of the stated Ginkgo test quality failure conditions apply.

Full details: Microshift Test Compatibility

Explanation

PASS: The pull request adds no Ginkgo e2e tests. The diff changes feature-gate code, generated CRD manifests, feature-gate manifests, and documentation only. Therefore, the MicroShift test compatibility check is not applicable.

Full details: Single Node Openshift (Sno) Test Compatibility

Explanation

PASS — The pull request adds no Ginkgo e2e tests. The verified diff changes only feature-gate code, generated CRD manifests, feature-gate manifests, and documentation. No It(), Describe(), Context(), or When() declarations were added, so the SNO test compatibility check is not applicable.

Full details: Topology-Aware Scheduling Compatibility

Explanation

PASS: The pull request changes only feature-gate registration, generated APIServer CRD schemas, feature-gate manifests, and documentation. The changed YAML contains CRDs and feature-gate configuration, not Deployments, controllers, or workload scheduling settings. The diff adds no affinity, topology spread, replica, node selector/affinity, toleration, rollout, or PDB constraints. Enabling TLSAdherence for OKD does not introduce a topology-dependent scheduling constraint.

Full details: Ote Binary Stdout Contract

Explanation

PASS: The pull request changes one feature-gate declaration and generated YAML/Markdown files. The changed Go line only adds inOKD() to FeatureGateTLSAdherence; it adds no fmt, klog, log, os.Stdout, Ginkgo setup, or other stdout write. The repository search found no OTE binary or changed process-level test setup. Therefore the pull request does not introduce a failure under the OTE Binary Stdout Contract.

Full details: Ipv6 And Disconnected Network Test Compatibility

Explanation

PASS — The pull request adds no Ginkgo tests or test files. The exact diff changes feature-gate code, generated CRDs, feature-gate manifests, and documentation only. Added-line searches found no It/Describe/Context/When declarations, IPv4 assumptions, or external connectivity calls. The custom check is therefore inapplicable.

Full details: No-Weak-Crypto

Explanation

This pull request enables the TLSAdherence feature gate for the OKD featureset. The primary change is in features/features.go, where inOKD() was added to the FeatureGateTLSAdherence enable call. The PR also includes regenerated CRD manifests and feature gate configurations. Investigation found: 1. No weak cryptographic algorithm implementations: The PR contains no MD5, SHA1, DES (except as documentation), RC4, 3DES, Blowfish, or ECB mode usage in code. 2. DES-CBC3-SHA reference is schema documentation: The CRD file contains a reference to DES-CBC3-SHA, but this exists in the "Old" TLS profile section of the schema documentation describing supported TLS cipher suites as OpenShift configuration options. This is pre-existing CRD schema that documents what cipher suites are available for users to configure - it is not a cryptographic implementation and appears identically in all other TLS profile variant CRD files. 3. No custom crypto implementations: The features.go change is purely a feature gate configuration toggle that enables an existing feature in an additional deployment profile. It contains no cryptographic code. 4. No non-constant-time comparisons: No custom secret or token comparison code was found. The PR changes are all declarative configuration to enable an existing TLS adherence feature for the OKD profile, not the introduction of weak cryptography.

Full details: Container-Privileges

Explanation

The pull request changes only the TLSAdherence feature gate, generated CRD schema fields, feature-gate manifests, and documentation. The added manifest content contains no privileged, hostPID, hostNetwork, hostIPC, SYS_ADMIN, allowPrivilegeEscalation, or root execution settings. No container security context is introduced.

Full details: No-Sensitive-Data-In-Logs

Explanation

PASS. The pull request changes a feature-gate declaration, CRD schema, generated manifests, and documentation. The exact diff adds no logging calls, log messages, or sensitive values. The log a warning text is only a CRD field description and does not log data.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

Some tools did not complete. Review the errors below.

🔧 golangci-lint (2.13.2)

Error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented
The command is terminated due to an error: build linters: unable to load custom analyzer "kubeapilinter": tools/_output/bin/kube-api-linter.so, plugin: not implemented

---

_{Comment @coderabbitai help to get the list of available commands.}

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign deads2k for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Prashanth684]

The motivation for this change is to de-risk TLSAdherence for OCP 5.1/5.0

[JoelSpeed]

/pipeline required

[openshift-merge-bot]

Scheduling tests matching the pipeline_run_if_changed or not excluded by pipeline_skip_if_only_changed parameters:
/test e2e-aws-ovn
/test e2e-aws-ovn-hypershift
/test e2e-aws-ovn-hypershift-conformance
/test e2e-aws-ovn-techpreview
/test e2e-aws-serial-1of2
/test e2e-aws-serial-2of2
/test e2e-aws-serial-techpreview-1of2
/test e2e-aws-serial-techpreview-2of2
/test e2e-azure
/test e2e-gcp
/test e2e-upgrade
/test e2e-upgrade-out-of-change
/test minor-e2e-upgrade-minor

[openshift-ci]

@redhat-chai-bot: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-ovn-hypershift-conformance	9b3cc19	link	true	/test e2e-aws-ovn-hypershift-conformance
ci/prow/e2e-azure	9b3cc19	link	true	/test e2e-azure
ci/prow/e2e-aws-ovn-hypershift	9b3cc19	link	true	/test e2e-aws-ovn-hypershift
ci/prow/e2e-aws-serial-2of2	9b3cc19	link	true	/test e2e-aws-serial-2of2
ci/prow/e2e-gcp	9b3cc19	link	true	/test e2e-gcp

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.