Description of problem: ------------------------ Attempt to set the TLS security profile for CDI fails Version-Release number of selected component (if applicable): ------------------------------------------------------------- kubevirt-hyperconverged-operator.4.12.0-684 How reproducible: ----------------- Always Steps to Reproduce: ------------------- 1. Apply HCO jsonpatch annotation to update TLS security profile for CDI # oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged containerizeddataimporter.kubevirt.io/jsonpatch='[{"op": "replace", "path": "/spec/config/tlsSecurityProfile", "value": {"old":{}, "type": "Old"}}]' 2. Get the TLS security profile set on CDI # oc get cdi cdi-kubevirt-hyperconverged -n openshift-cnv -ojsonpath={.spec.config.tlsSecurityProfile} Actual results: --------------- CDI has got incorrect definition for 'tlsSecurityProfile' as: [cnv-qe-jenkins@ ~]$ oc get cdi cdi-kubevirt-hyperconverged -n openshift-cnv -ojsonpath={.spec.config.tlsSecurityProfile} {"intermediate":{},"old":{},"type":"Old"}[ Expected results: ----------------- CDI should contain the right definition ( not the mix of 2 TLS profiles ) for TLS security profile. {"old":{}, "type": "Old"} Additional info: ---------------- By default TLS security profile enabled at CDI is 'intermediate', but if HCO jsonpatch annotation contains TLS security profile, then that should be reflected in CDI but not the mix of TLS security profiles. Even this issue is true with 'custom' TLS security profile too. [cnv-qe-jenkins@ ~]$ oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged containerizeddataimporter.kubevirt.io/jsonpatch='[{"op": "replace", "path": "/spec/config/tlsSecurityProfile", "value": {"custom":{"ciphers":["ECDHE-ECDSA-WITH-AES-256-GCM-SHA384"], "minTLSVersion": "VersionTLS12"},"type": "Custom"}}]' hyperconverged.hco.kubevirt.io/kubevirt-hyperconverged annotated [cnv-qe-jenkins@ ~]$ oc get cdi cdi-kubevirt-hyperconverged -n openshift-cnv -ojsonpath={.spec.config.tlsSecurityProfile} {"custom":{"ciphers":["ECDHE-ECDSA-WITH-AES-256-GCM-SHA384"],"minTLSVersion":"VersionTLS12"},"intermediate":{},"type":"Custom"} Here the CDI is configured with the mix of 'custom' and 'intermediate' which is incorrect.
This is basically a side effect of: https://github.com/golang/go/issues/53104 https://github.com/kubernetes-sigs/yaml/issues/86 and Old, Intermediate, Modern and Custom being pointers on golang implementation of the API: https://github.com/openshift/api/blob/b7057289fac81e08b06a564a0c724d1a4f3a783a/config/v1/types_tlssecurityprofile.go#L86 I don't think we can have a general solution. I'd suggest to use an appropriate JsonPatch explicitly nulling them if not wanted: $ oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged containerizeddataimporter.kubevirt.io/jsonpatch='[{"op": "replace", "path": "/spec/config/tlsSecurityProfile", "value": {"old":{}, "type": "Old"}}]' $ oc get cdi cdi-kubevirt-hyperconverged -o json | jq .spec.config.tlsSecurityProfile { "intermediate": {}, "old": {}, "type": "Old" } $ oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged containerizeddataimporter.kubevirt.io/jsonpatch='[{"op": "replace", "path": "/spec/config/tlsSecurityProfile", "value": {"old":{}, "type": "Old", "intermediate": null, "modern": null, "custom": null }}]' $ oc get cdi cdi-kubevirt-hyperconverged -o json | jq .spec.config.tlsSecurityProfile { "old": {}, "type": "Old" }
*** Bug 2141419 has been marked as a duplicate of this bug. ***
Verified with the upstream doc reference about updating the tlsSecurityProfile of CDI/CNAO/KubeVirt using jsonpatch. The content is well described and helps to achieve the requirement as stated
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (Important: OpenShift Virtualization 4.12.0 Images security update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHSA-2023:0408