Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-76334

Add TLS 1.3 (Modern profile) support to TestTLSDefaults

    • Icon: Bug Bug
    • Resolution: Unresolved
    • Icon: Undefined Undefined
    • None
    • 4.22.0
    • kube-apiserver
    • None
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      The TestTLSDefaults test in openshift/origin was skipping when the cluster TLS profile was set to Modern (TLS 1.3), preventing proper test coverage in CI jobs configured with TLS 1.3 clusters (e.g., openshift-kubernetes-2315-ci-4.18-e2e-aws-ovn-tls-13).

      The test would skip with the following message:

      [sig-api-machinery][Feature:APIServer] TestTLSDefaults [Suite:openshift/conformance/parallel]
      Reason: skip [github.com/openshift/origin/test/extended/apiserver/tls.go:126]: 
      Cluster TLS profile is not default (intermediate), skipping cipher defaults check
      

      Version-Release number of selected component (if applicable):

      OpenShift 4.18 and later
      Affected file: test/extended/apiserver/tls.go

      How reproducible:

      100% reproducible on clusters with Modern TLS profile (TLS 1.3)

      Steps to Reproduce:

      1. Deploy an OpenShift cluster with Modern TLS profile (TLS 1.3 only)
      2. Run the TestTLSDefaults test from openshift/origin
      3. Observe the test being skipped

      Actual results:

      The test skips execution on Modern TLS profile clusters, missing test coverage for TLS 1.3 behavior validation.

      Expected results:

      The test should execute on both Intermediate (TLS 1.2+) and Modern (TLS 1.3) TLS profile clusters:

      • For Intermediate profile: test TLS 1.2+ connections and cipher suites
      • For Modern profile: test that only TLS 1.3 connections succeed and TLS 1.0/1.1/1.2 connections fail

      Additional info:

      Fix implemented in PR https://github.com/openshift/origin/pull/30746:

      • Replaced skip condition with a switch statement handling both Intermediate and Modern profiles
      • For Intermediate profile: tests TLS 1.2+ and cipher suites (existing behavior preserved)
      • For Modern profile: tests TLS 1.3 only (cipher suites skipped as they're not configurable in TLS 1.3)
      • Uses dynamic minTLSVersion variable based on the detected profile
      • Modified file: test/extended/apiserver/tls.go (45 additions, 31 deletions)

              wk2019 Ke Wang
              wk2019 Ke Wang
              None
              None
              Ke Wang Ke Wang
              None
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: