-
Bug
-
Resolution: Unresolved
-
Undefined
-
None
-
4.22.0
-
None
-
None
-
False
-
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
-
None
Description of problem:
The TestTLSDefaults test in openshift/origin was skipping when the cluster TLS profile was set to Modern (TLS 1.3), preventing proper test coverage in CI jobs configured with TLS 1.3 clusters (e.g., openshift-kubernetes-2315-ci-4.18-e2e-aws-ovn-tls-13).
The test would skip with the following message:
[sig-api-machinery][Feature:APIServer] TestTLSDefaults [Suite:openshift/conformance/parallel]
Reason: skip [github.com/openshift/origin/test/extended/apiserver/tls.go:126]:
Cluster TLS profile is not default (intermediate), skipping cipher defaults check
Version-Release number of selected component (if applicable):
OpenShift 4.18 and later
Affected file: test/extended/apiserver/tls.go
How reproducible:
100% reproducible on clusters with Modern TLS profile (TLS 1.3)
Steps to Reproduce:
- Deploy an OpenShift cluster with Modern TLS profile (TLS 1.3 only)
- Run the TestTLSDefaults test from openshift/origin
- Observe the test being skipped
Actual results:
The test skips execution on Modern TLS profile clusters, missing test coverage for TLS 1.3 behavior validation.
Expected results:
The test should execute on both Intermediate (TLS 1.2+) and Modern (TLS 1.3) TLS profile clusters:
- For Intermediate profile: test TLS 1.2+ connections and cipher suites
- For Modern profile: test that only TLS 1.3 connections succeed and TLS 1.0/1.1/1.2 connections fail
Additional info:
Fix implemented in PR https://github.com/openshift/origin/pull/30746:
- Replaced skip condition with a switch statement handling both Intermediate and Modern profiles
- For Intermediate profile: tests TLS 1.2+ and cipher suites (existing behavior preserved)
- For Modern profile: tests TLS 1.3 only (cipher suites skipped as they're not configurable in TLS 1.3)
- Uses dynamic minTLSVersion variable based on the detected profile
- Modified file: test/extended/apiserver/tls.go (45 additions, 31 deletions)