Title: feat: Integrate cluster TLS profile with graceful fallback by ugiordan · Pull Request #6567 · feast-dev/feast · GitHub
Open Graph Title: feat: Integrate cluster TLS profile with graceful fallback by ugiordan · Pull Request #6567 · feast-dev/feast
X Title: feat: Integrate cluster TLS profile with graceful fallback by ugiordan · Pull Request #6567 · feast-dev/feast
Description: Summary Integrate the feast-operator with the cluster-wide TLS security profile from apiservers.config.openshift.io/cluster, with graceful fallback for non-OpenShift clusters. On OpenShift clusters, the operator reads the admin-configured TLS profile (MinVersion, CipherSuites) and applies it to webhook and metrics servers. On vanilla Kubernetes (EKS, GKE, AKS), it falls back to hardened Intermediate defaults (TLS 1.2, ECDHE AEAD ciphers). Also removes the enableHTTP2 flag since CVE-2023-44487 (HTTP/2 Rapid Reset) is fixed in Go 1.21.3+ and feast uses Go 1.25+. Changes cmd/main.go: Fetch TLS profile at startup, apply to webhook and metrics servers, register SecurityProfileWatcher for profile changes, always enable HTTP/2 with NextProtos config/rbac/role.yaml: Add RBAC for config.openshift.io/apiservers get/list/watch go.mod/go.sum: Add controller-runtime-common dependency internal/controller/featurestore_controller.go: Remove enableHTTP2 conditional, always set NextProtos Non-OpenShift behavior Graceful fallback via IsNoMatchError/IsNotFound handling. No behavior change for vanilla Kubernetes deployments. No new hard dependencies on OpenShift APIs. Test plan Build passes Existing tests pass
Open Graph Description: Summary Integrate the feast-operator with the cluster-wide TLS security profile from apiservers.config.openshift.io/cluster, with graceful fallback for non-OpenShift clusters. On OpenShift clusters...
X Description: Summary Integrate the feast-operator with the cluster-wide TLS security profile from apiservers.config.openshift.io/cluster, with graceful fallback for non-OpenShift clusters. On OpenShift clusters...
Opengraph URL: https://github.com/feast-dev/feast/pull/6567
X: @github
Domain: github.com
| route-pattern | /:user_id/:repository/pull/:id/files(.:format) |
| route-controller | pull_requests |
| route-action | files |
| fetch-nonce | v2:423444ff-c9b1-46dd-7392-36d307655b8e |
| current-catalog-service-hash | ae870bc5e265a340912cde392f23dad3671a0a881730ffdadd82f2f57d81641b |
| request-id | 9070:2D29C2:1556EB:1DCB78:6A53688D |
| html-safe-nonce | b2024ca6752e27f28ebc720caf6dd5fdbf5ac3d4512ef37d4c998c809284524e |
| visitor-payload | eyJyZWZlcnJlciI6IiIsInJlcXVlc3RfaWQiOiI5MDcwOjJEMjlDMjoxNTU2RUI6MURDQjc4OjZBNTM2ODhEIiwidmlzaXRvcl9pZCI6IjkwOTEyOTIyMDMyODA1MjUiLCJyZWdpb25fZWRnZSI6ImlhZCIsInJlZ2lvbl9yZW5kZXIiOiJpYWQifQ== |
| visitor-hmac | 67d3e61fc379af7a4d164033706f3d32ab1f3cd2c4839a211e16843116fbf6d0 |
| hovercard-subject-tag | pull_request:3956506647 |
| github-keyboard-shortcuts | repository,pull-request-list,pull-request-conversation,pull-request-files-changed,copilot |
| google-site-verification | Apib7-x98H0j5cPqHWwSMm6dNU4GmODRoqxLiDzdx9I |
| octolytics-url | https://collector.github.com/github/collect |
| analytics-location | / |
| fb:app_id | 1401488693436528 |
| apple-itunes-app | app-id=1477376905, app-argument=https://github.com/feast-dev/feast/pull/6567/files |
| twitter:image | https://avatars.githubusercontent.com/u/8166389?s=400&v=4 |
| twitter:card | summary_large_image |
| og:image | https://avatars.githubusercontent.com/u/8166389?s=400&v=4 |
| og:image:alt | Summary Integrate the feast-operator with the cluster-wide TLS security profile from apiservers.config.openshift.io/cluster, with graceful fallback for non-OpenShift clusters. On OpenShift clusters... |
| og:site_name | GitHub |
| og:type | object |
| hostname | github.com |
| expected-hostname | github.com |
| None | b9a586c06a05a7a86fc7e3f4dbd03e42f6869085879aa184aa6369456dbd50fb |
| turbo-cache-control | no-preview |
| diff-view | unified |
| go-import | github.com/feast-dev/feast git https://github.com/feast-dev/feast.git |
| octolytics-dimension-user_id | 57027613 |
| octolytics-dimension-user_login | feast-dev |
| octolytics-dimension-repository_id | 161133770 |
| octolytics-dimension-repository_nwo | feast-dev/feast |
| octolytics-dimension-repository_public | true |
| octolytics-dimension-repository_is_fork | false |
| octolytics-dimension-repository_network_root_id | 161133770 |
| octolytics-dimension-repository_network_root_nwo | feast-dev/feast |
| turbo-body-classes | logged-out env-production page-responsive full-width |
| disable-turbo | true |
| browser-stats-url | https://api.github.com/_private/browser/stats |
| browser-errors-url | https://api.github.com/_private/browser/errors |
| release | 07a982c1d40157c619b364352b704c3ce66bb332 |
| ui-target | full |
| theme-color | #1e2327 |
| color-scheme | light dark |
Links:
Viewport: width=device-width