Skip to content

Commit 0cc2223

Browse files
richardsonnickrichardsonnick
committed
Rename enum values to LegacyExternalAPIServerComponentsOnly and StrictAllComponents
1 parent d0a2bac commit 0cc2223

10 files changed

Lines changed: 90 additions & 110 deletions

‎config/v1/types_apiserver.go‎

Lines changed: 18 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -65,20 +65,21 @@ type APIServerSpec struct {
6565
// tlsAdherence controls how strictly components in the cluster adhere to the TLS security profile
6666
// configured on this APIServer resource.
6767
//
68-
// Valid values are "Legacy" and "Strict".
68+
// Valid values are "LegacyExternalAPIServerComponentsOnly" and "StrictAllComponents".
6969
//
70-
// When set to "Legacy" (the default), components attempt to honor the configured TLS profile
71-
// but may fall back to their individual defaults if conflicts arise. This mode is intended for
72-
// clusters that need to maintain compatibility with existing configurations during migration.
70+
// When set to "LegacyExternalAPIServerComponentsOnly" (the default), components attempt to honor
71+
// the configured TLS profile but may fall back to their individual defaults if conflicts arise.
72+
// This mode is intended for clusters that need to maintain compatibility with existing
73+
// configurations during migration.
7374
//
74-
// When set to "Strict", all components must strictly honor the configured TLS profile.
75+
// When set to "StrictAllComponents", all components must strictly honor the configured TLS profile.
7576
// This mode is recommended for security-conscious deployments and is required for
7677
// certain compliance frameworks.
7778
//
78-
// Components that encounter an unknown value for tlsAdherence should treat it as "Strict"
79+
// Components that encounter an unknown value for tlsAdherence should treat it as "StrictAllComponents"
7980
// and log a warning to ensure forward compatibility while defaulting to the more secure behavior.
8081
//
81-
// When omitted, the default value is "Legacy".
82+
// When omitted, the default value is "LegacyExternalAPIServerComponentsOnly".
8283
// +openshift:enable:FeatureGate=TLSAdherence
8384
// +optional
8485
TLSAdherence TLSAdherencePolicy `json:"tlsAdherence,omitempty"`
@@ -258,20 +259,20 @@ type APIServerStatus struct {
258259
}
259260

260261
// TLSAdherencePolicy defines how strictly components adhere to the TLS security profile.
261-
// +kubebuilder:validation:Enum=Legacy;Strict
262+
// +kubebuilder:validation:Enum=LegacyExternalAPIServerComponentsOnly;StrictAllComponents
262263
type TLSAdherencePolicy string
263264

264265
const (
265-
// TLSAdherenceLegacy provides backward-compatible behavior where components attempt to
266-
// honor the configured TLS profile but may fall back to their individual defaults if
267-
// conflicts arise. This mode is intended for clusters that need to maintain compatibility
268-
// with existing configurations during migration.
269-
TLSAdherenceLegacy TLSAdherencePolicy = "Legacy"
266+
// TLSAdherenceLegacyExternalAPIServerComponentsOnly provides backward-compatible behavior
267+
// where components attempt to honor the configured TLS profile but may fall back to their
268+
// individual defaults if conflicts arise. This mode is intended for clusters that need to
269+
// maintain compatibility with existing configurations during migration.
270+
TLSAdherenceLegacyExternalAPIServerComponentsOnly TLSAdherencePolicy = "LegacyExternalAPIServerComponentsOnly"
270271

271-
// TLSAdherenceStrict enforces strict adherence to the TLS configuration. All components
272-
// must honor the configured profile. This mode is recommended for security-conscious
273-
// deployments and is required for certain compliance frameworks.
274-
TLSAdherenceStrict TLSAdherencePolicy = "Strict"
272+
// TLSAdherenceStrictAllComponents enforces strict adherence to the TLS configuration.
273+
// All components must honor the configured profile. This mode is recommended for
274+
// security-conscious deployments and is required for certain compliance frameworks.
275+
TLSAdherenceStrictAllComponents TLSAdherencePolicy = "StrictAllComponents"
275276
)
276277

277278
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -297,27 +297,24 @@ spec:
297297
tlsAdherence controls how strictly components in the cluster adhere to the TLS security profile
298298
configured on this APIServer resource.
299299
300-
Valid values are "Legacy" and "Strict".
300+
Valid values are "LegacyExternalAPIServerComponentsOnly" and "StrictAllComponents".
301301
302-
When set to "Legacy" (the default), components attempt to honor the configured TLS profile
303-
but may fall back to their individual defaults if conflicts arise. This mode is intended for
304-
clusters that need to maintain compatibility with existing configurations during migration.
302+
When set to "LegacyExternalAPIServerComponentsOnly" (the default), components attempt to honor
303+
the configured TLS profile but may fall back to their individual defaults if conflicts arise.
304+
This mode is intended for clusters that need to maintain compatibility with existing
305+
configurations during migration.
305306
306-
When set to "Strict", all components must strictly honor the configured TLS profile.
307+
When set to "StrictAllComponents", all components must strictly honor the configured TLS profile.
307308
This mode is recommended for security-conscious deployments and is required for
308309
certain compliance frameworks.
309310
310-
Components that encounter an unknown value for tlsAdherence should treat it as "Strict"
311+
Components that encounter an unknown value for tlsAdherence should treat it as "StrictAllComponents"
311312
and log a warning to ensure forward compatibility while defaulting to the more secure behavior.
312313
313-
Note: The Kubelet and IngressController components are excluded from tlsAdherence control
314-
as they have their own dedicated TLS configuration mechanisms via KubeletConfig and
315-
IngressController CRs respectively.
316-
317-
When omitted, the default value is "Legacy".
314+
When omitted, the default value is "LegacyExternalAPIServerComponentsOnly".
318315
enum:
319-
- Legacy
320-
- Strict
316+
- LegacyExternalAPIServerComponentsOnly
317+
- StrictAllComponents
321318
type: string
322319
tlsSecurityProfile:
323320
description: |-

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -297,27 +297,24 @@ spec:
297297
tlsAdherence controls how strictly components in the cluster adhere to the TLS security profile
298298
configured on this APIServer resource.
299299
300-
Valid values are "Legacy" and "Strict".
300+
Valid values are "LegacyExternalAPIServerComponentsOnly" and "StrictAllComponents".
301301
302-
When set to "Legacy" (the default), components attempt to honor the configured TLS profile
303-
but may fall back to their individual defaults if conflicts arise. This mode is intended for
304-
clusters that need to maintain compatibility with existing configurations during migration.
302+
When set to "LegacyExternalAPIServerComponentsOnly" (the default), components attempt to honor
303+
the configured TLS profile but may fall back to their individual defaults if conflicts arise.
304+
This mode is intended for clusters that need to maintain compatibility with existing
305+
configurations during migration.
305306
306-
When set to "Strict", all components must strictly honor the configured TLS profile.
307+
When set to "StrictAllComponents", all components must strictly honor the configured TLS profile.
307308
This mode is recommended for security-conscious deployments and is required for
308309
certain compliance frameworks.
309310
310-
Components that encounter an unknown value for tlsAdherence should treat it as "Strict"
311+
Components that encounter an unknown value for tlsAdherence should treat it as "StrictAllComponents"
311312
and log a warning to ensure forward compatibility while defaulting to the more secure behavior.
312313
313-
Note: The Kubelet and IngressController components are excluded from tlsAdherence control
314-
as they have their own dedicated TLS configuration mechanisms via KubeletConfig and
315-
IngressController CRs respectively.
316-
317-
When omitted, the default value is "Legacy".
314+
When omitted, the default value is "LegacyExternalAPIServerComponentsOnly".
318315
enum:
319-
- Legacy
320-
- Strict
316+
- LegacyExternalAPIServerComponentsOnly
317+
- StrictAllComponents
321318
type: string
322319
tlsSecurityProfile:
323320
description: |-

‎config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -229,27 +229,24 @@ spec:
229229
tlsAdherence controls how strictly components in the cluster adhere to the TLS security profile
230230
configured on this APIServer resource.
231231
232-
Valid values are "Legacy" and "Strict".
232+
Valid values are "LegacyExternalAPIServerComponentsOnly" and "StrictAllComponents".
233233
234-
When set to "Legacy" (the default), components attempt to honor the configured TLS profile
235-
but may fall back to their individual defaults if conflicts arise. This mode is intended for
236-
clusters that need to maintain compatibility with existing configurations during migration.
234+
When set to "LegacyExternalAPIServerComponentsOnly" (the default), components attempt to honor
235+
the configured TLS profile but may fall back to their individual defaults if conflicts arise.
236+
This mode is intended for clusters that need to maintain compatibility with existing
237+
configurations during migration.
237238
238-
When set to "Strict", all components must strictly honor the configured TLS profile.
239+
When set to "StrictAllComponents", all components must strictly honor the configured TLS profile.
239240
This mode is recommended for security-conscious deployments and is required for
240241
certain compliance frameworks.
241242
242-
Components that encounter an unknown value for tlsAdherence should treat it as "Strict"
243+
Components that encounter an unknown value for tlsAdherence should treat it as "StrictAllComponents"
243244
and log a warning to ensure forward compatibility while defaulting to the more secure behavior.
244245
245-
Note: The Kubelet and IngressController components are excluded from tlsAdherence control
246-
as they have their own dedicated TLS configuration mechanisms via KubeletConfig and
247-
IngressController CRs respectively.
248-
249-
When omitted, the default value is "Legacy".
246+
When omitted, the default value is "LegacyExternalAPIServerComponentsOnly".
250247
enum:
251-
- Legacy
252-
- Strict
248+
- LegacyExternalAPIServerComponentsOnly
249+
- StrictAllComponents
253250
type: string
254251
tlsSecurityProfile:
255252
description: |-

‎config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/TLSAdherence.yaml‎

Lines changed: 10 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -223,27 +223,24 @@ spec:
223223
tlsAdherence controls how strictly components in the cluster adhere to the TLS security profile
224224
configured on this APIServer resource.
225225
226-
Valid values are "Legacy" and "Strict".
226+
Valid values are "LegacyExternalAPIServerComponentsOnly" and "StrictAllComponents".
227227
228-
When set to "Legacy" (the default), components attempt to honor the configured TLS profile
229-
but may fall back to their individual defaults if conflicts arise. This mode is intended for
230-
clusters that need to maintain compatibility with existing configurations during migration.
228+
When set to "LegacyExternalAPIServerComponentsOnly" (the default), components attempt to honor
229+
the configured TLS profile but may fall back to their individual defaults if conflicts arise.
230+
This mode is intended for clusters that need to maintain compatibility with existing
231+
configurations during migration.
231232
232-
When set to "Strict", all components must strictly honor the configured TLS profile.
233+
When set to "StrictAllComponents", all components must strictly honor the configured TLS profile.
233234
This mode is recommended for security-conscious deployments and is required for
234235
certain compliance frameworks.
235236
236-
Components that encounter an unknown value for tlsAdherence should treat it as "Strict"
237+
Components that encounter an unknown value for tlsAdherence should treat it as "StrictAllComponents"
237238
and log a warning to ensure forward compatibility while defaulting to the more secure behavior.
238239
239-
Note: The Kubelet and IngressController components are excluded from tlsAdherence control
240-
as they have their own dedicated TLS configuration mechanisms via KubeletConfig and
241-
IngressController CRs respectively.
242-
243-
When omitted, the default value is "Legacy".
240+
When omitted, the default value is "LegacyExternalAPIServerComponentsOnly".
244241
enum:
245-
- Legacy
246-
- Strict
242+
- LegacyExternalAPIServerComponentsOnly
243+
- StrictAllComponents
247244
type: string
248245
tlsSecurityProfile:
249246
description: |-

‎config/v1/zz_generated.swagger_doc_generated.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎openapi/generated_openapi/zz_generated.openapi.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

0 commit comments

Comments
 (0)