Summary

Update the TLS security profile implementation to support curve preferences once openshift/api#2583 is merged.

Background

OpenShift TLS profiles currently specify:

• TLS protocol versions (e.g., TLS 1.2, TLS 1.3)
• Cipher suites (e.g., ECDHE-RSA-AES128-GCM-SHA256)

Once openshift/api#2583 merges, TLS profiles will also include:

• Curve preferences (e.g., X25519, P-256, P-384)

This is important for PQC (Post-Quantum Cryptography) readiness, as PQC-resilient key exchange algorithms will use specific curves.

Implementation Steps

Once openshift/api#2583 is merged:

1. Update go.mod to pull latest openshift/api with curve support
2. Update pkg/tls/config.go to extract curve preferences from profile
3. Update ConfigMap generation to include curvePreferences
4. Add unit tests for curve preferences handling
5. Add E2E tests to verify curve preferences are applied

Files to Modify

• go.mod - Update openshift/api version
• pkg/tls/config.go - Add curve handling to GetTLSConfig
• pkg/tls/config_test.go - Add curve tests
• pkg/operator/target_config_reconciler.go - Include curves in ConfigMap

Code Changes

// In pkg/tls/config.go
type TLSConfig struct {
    MinTLSVersion    uint16
    CipherSuites     []uint16
    CurvePreferences []tls.CurveID  // Add this
}

func GetTLSConfig(profile *configv1.TLSSecurityProfile) *TLSConfig {
    // ... existing code ...
    
    // Add once openshift/api#2583 merges:
    // curvePreferences := crypto.CurvesToIDs(spec.Curves)
    
    return &TLSConfig{
        MinTLSVersion:    minVersion,
        CipherSuites:     cipherSuites,
        CurvePreferences: curvePreferences,
    }
}

Acceptance Criteria

• [ ] openshift/api#2583 is merged (blocker)
• [ ] go.mod updated with new openshift/api version
• [ ] TLS helper extracts curve preferences from profile
• [ ] ConfigMap includes curvePreferences for operand
• [ ] Default curves used when profile has no curve preferences
• [ ] Unit tests for curve preferences
• [ ] E2E tests verify curve configuration

References

• openshift/api#2583 - Add TLS curve preferences to OpenShift API
• OCPNODE-3970 - Similar story for DAS Operator
• Go tls.Config.CurvePreferences
• OCPKUEUE-450 - Upstream KEP includes curves in design