apiservers.config.openshift.io: remove spec.tlsSecurityProfile GoDoc caveats

joelanford · joelanford · commit 2371796832ab · 2025-09-04T12:34:18.000-04:00
The apiserver component was updated in OCP 4.19 to support the Modern
TLS profile and TLS 1.3

Signed-off-by: Joe Lanford &lt;joe.lanford@gmail.com&gt;
diff --git a/config/v1/types_apiserver.go b/config/v1/types_apiserver.go
@@ -58,9 +58,8 @@ type APIServerSpec struct {
 	Encryption APIServerEncryption `json:"encryption"`
 	// tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 	//
-	// If unset, a default (which may change between releases) is chosen. Note that only Old,
-	// Intermediate and Custom profiles are currently supported, and the maximum available
-	// minTLSVersion is VersionTLS12.
+	// When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+	// The current default is the Intermediate profile.
 	// +optional
 	TLSSecurityProfile *TLSSecurityProfile `json:"tlsSecurityProfile,omitempty"`
 	// audit specifies the settings for audit configuration to be applied to all OpenShift-provided
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-Default.crd.yaml
@@ -227,9 +227,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/AAA_ungated.yaml
@@ -227,9 +227,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml b/config/v1/zz_generated.featuregated-crd-manifests/apiservers.config.openshift.io/KMSEncryptionProvider.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/config/v1/zz_generated.swagger_doc_generated.go b/config/v1/zz_generated.swagger_doc_generated.go
diff --git a/openapi/generated_openapi/zz_generated.openapi.go b/openapi/generated_openapi/zz_generated.openapi.go
diff --git a/openapi/openapi.json b/openapi/openapi.json
@@ -4137,7 +4137,7 @@
           "$ref": "#/definitions/com.github.openshift.api.config.v1.APIServerServingCerts"
         },
         "tlsSecurityProfile": {
-          "description": "tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.\n\nIf unset, a default (which may change between releases) is chosen. Note that only Old, Intermediate and Custom profiles are currently supported, and the maximum available minTLSVersion is VersionTLS12.",
+          "description": "tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.\n\nWhen omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is the Intermediate profile.",
           "$ref": "#/definitions/com.github.openshift.api.config.v1.TLSSecurityProfile"
         }
       }
diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-CustomNoUpgrade.crd.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-Default.crd.yaml
@@ -227,9 +227,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-DevPreviewNoUpgrade.crd.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-
diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-TechPreviewNoUpgrade.crd.yaml
@@ -296,9 +296,8 @@ spec:
                 description: |-
                   tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
 
-                  If unset, a default (which may change between releases) is chosen. Note that only Old,
-                  Intermediate and Custom profiles are currently supported, and the maximum available
-                  minTLSVersion is VersionTLS12.
+                  When omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time.
+                  The current default is the Intermediate profile.
                 properties:
                   custom:
                     description: |-

Original file line number	Diff line number	Diff line change
`@@ -4137,7 +4137,7 @@`
`4137`	`4137`	`"$ref": "#/definitions/com.github.openshift.api.config.v1.APIServerServingCerts"`
`4138`	`4138`	`},`
`4139`	`4139`	`"tlsSecurityProfile": {`
`4140`		`- "description": "tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.\n\nIf unset, a default (which may change between releases) is chosen. Note that only Old, Intermediate and Custom profiles are currently supported, and the maximum available minTLSVersion is VersionTLS12.",`
	`4140`	`+ "description": "tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.\n\nWhen omitted, this means no opinion and the platform is left to choose a reasonable default, which is subject to change over time. The current default is the Intermediate profile.",`
`4141`	`4141`	`"$ref": "#/definitions/com.github.openshift.api.config.v1.TLSSecurityProfile"`
`4142`	`4142`	`}`
`4143`	`4143`	`}`