mirror of
https://github.com/open-cluster-management-io/ocm.git
synced 2026-08-23 22:26:49 +00:00
Jian Zhu
336e5b0e4d
Add TLS profile compliance to the gRPC server, completing TLS support for all hub components. The operator reads the ocm-tls-profile ConfigMap and injects --tls-min-version and --tls-cipher-suites flags into the gRPC server deployment, matching the pattern used by all other hub component deployments. Changes: - Add TLS flag injection to gRPC server deployment manifest - Wire TLS flags from common options to gRPC server via closure - Call ApplyTLSToCommand for the 8443 health server endpoint - Apply TLS overrides to the 8090 gRPC port via SDK ApplyTLSFlags - Update vendored sdk-go with CipherSuites support for gRPC server - Add unit, controller, and integration tests Assisted by Claude Signed-off-by: zhujian <jiazhu@redhat.com>
45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package hub
|
|
|
|
import (
|
|
"context"
|
|
|
|
"github.com/openshift/library-go/pkg/controller/controllercmd"
|
|
"github.com/spf13/cobra"
|
|
"k8s.io/utils/clock"
|
|
|
|
commonoptions "open-cluster-management.io/ocm/pkg/common/options"
|
|
grpcopts "open-cluster-management.io/ocm/pkg/server/grpc"
|
|
"open-cluster-management.io/ocm/pkg/version"
|
|
)
|
|
|
|
func NewGRPCServerCommand() *cobra.Command {
|
|
opts := commonoptions.NewOptions()
|
|
grpcServerOpts := grpcopts.NewGRPCServerOptions()
|
|
|
|
// Disable leader election to allow multiple gRPC server instances to run concurrently.
|
|
cmdConfig := controllercmd.NewControllerCommandConfig("grpc-server", version.Get(),
|
|
opts.StartWithQPS(grpcStartFunc(opts, grpcServerOpts)), clock.RealClock{})
|
|
cmdConfig.DisableLeaderElection = true
|
|
|
|
cmd := cmdConfig.NewCommandWithContext(context.TODO())
|
|
cmd.Use = "grpc"
|
|
cmd.Short = "Start the gRPC Server"
|
|
|
|
flags := cmd.Flags()
|
|
opts.AddFlags(flags)
|
|
grpcServerOpts.AddFlags(flags)
|
|
opts.ApplyTLSToCommand(cmd)
|
|
|
|
return cmd
|
|
}
|
|
|
|
// grpcStartFunc bridges TLS flags from common options to gRPC server options
|
|
// before starting the gRPC server. Extracted for testability.
|
|
func grpcStartFunc(opts *commonoptions.Options, grpcServerOpts *grpcopts.GRPCServerOptions) controllercmd.StartFunc {
|
|
return func(ctx context.Context, cc *controllercmd.ControllerContext) error {
|
|
grpcServerOpts.TLSMinVersionOverride = opts.TLSMinVersion
|
|
grpcServerOpts.TLSCipherSuitesOverride = opts.TLSCipherSuites
|
|
return grpcServerOpts.Run(ctx, cc)
|
|
}
|
|
}
|