NO-JIRA: fix:(api): Correct Modern TLS profile support documentation by rutvik23 · Pull Request #3146 · openshift/api

rutvik23 · 2026-11-02T11:35:19Z

Summary:

Remove outdated comments in config/v1/types_tlssecurityprofile.go stating
that the Modern profile is unsupported and that minTLSVersion is capped
at TLS 1.2. OpenShift 4.21 supports Modern with a minimum of TLS 1.3.
Changes are limited to documentation only; no API validation or runtime behavior changes.
These stale doc entries were identified while fixing the similar doc bug in releaes-4.20 branch.

openshift-merge-bot · 2026-11-02T11:35:25Z

Pipeline controller notification

This PR uses the pipeline controller for second-stage tests. Selection and triggering follow the repository configuration.

Use /test ? to list jobs and /pipeline help for commands.

openshift-ci-robot · 2026-11-02T11:35:26Z

@rutvik23: This pull request explicitly references no jira issue.

Details

In response to this:

Summary:

Remove outdated comments in config/v1/types_tlssecurityprofile.go stating
that the Modern profile is unsupported and that minTLSVersion is capped
at TLS 1.2. OpenShift 4.21 supports Modern with a minimum of TLS 1.3.

Changes are limited to documentation only; no API validation or runtime behavior changes.

These stale doc entries were identified while fixing the similar doc bug in releaes-4.20 branch.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

coderabbitai · 2026-11-02T11:35:30Z

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

Source mode: Auto
Repository: Unavailable
Branch: Unavailable
File: No configuration file from this repository applied
Commit: Unavailable
Layers: Central YAML; Path: .coderabbit.yaml
Review profile: CHILL
Plan: Advanced
Run ID: 040d999e-ec60-4d34-9cf2-868818108bce

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

Trigger review

Tip

🎯 Customize your risk assessments

Guide how CodeRabbit assesses merge risk and security architecture risk. Highlight sensitive changes and explain your security boundaries using Merge Risk Instructions and Security Risk Instructions in your review settings. Security architecture risk assessments require the Advanced plan or above.

✅ Automatic approvals, with your rules

Let CodeRabbit approve pull requests once required threads are resolved, pre-merge checks pass, and your risk limits are met. Enable Automatic approvals in review settings, with overrides for teams or file paths.

CodeRabbit Verify

Run CodeRabbit Verify to test the changes in this pull request.

openshift-ci · 2026-11-02T11:35:35Z

Hello @rutvik23! Some important instructions when contributing to openshift/api:
API design plays an important part in the user experience of OpenShift and as such API PRs are subject to a high level of scrutiny to ensure they follow our best practices. If you haven't already done so, please review the OpenShift API Conventions and ensure that your proposed changes are compliant. Following these conventions will help expedite the api review process for your PR.

Remove the outdated statement that the Modern TLS security profile is unsupported because it is not widely adopted by software libraries. Modern is supported in OpenShift 4.21 and requires TLS 1.3. Also remove the statement that VersionTLS12 is the highest allowed minTLSVersion. TLSProtocolVersion already permits VersionTLS13, and the Modern profile explicitly uses it as its minimum TLS version. Changes are limited to comments in config/v1/types_tlssecurityprofile.go. No API validation, defaults, or runtime behavior is changed. Signed-off-by: rutvik23 <rkshirsa@redhat.com>

openshift-ci · 2026-11-03T07:02:58Z

@rutvik23: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

everettraven

/lgtm
/approve

openshift-ci · 2026-11-03T21:07:26Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: everettraven

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [everettraven]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

everettraven · 2026-11-03T21:07:33Z

/label backport-risk-assessed
/label jira/valid-bug

redhat-chai-bot · 2026-11-03T21:08:40Z

Chai test selection for 23ddf98dc137c45b12d04a597d3eeaa4cf015b2b → release-4.21

None.

Reason: All changes are pure documentation removals — no functional behavior is affected. Changed surfaces: Two outdated documentation phrases removed from Go doc comments (//), swagger doc string literals, OpenAPI Description strings, and CRD description: fields across 20 files. No Go code logic, API validation rules, enum values, types, required fields, or structural CRD schema elements are changed in any file. Why no e2e coverage is needed: CRD description: fields and OpenAPI Description strings are purely informational — no e2e test asserts on documentation text content, and no runtime behavior (operator, controller, admission, TLS negotiation) depends on these strings. The first-stage jobs (build, images, unit, lint, verify, verify-crd-schema, verify-crdify, verify-deps, verify-client-go, verify-feature-promotion, integration) all passed, confirming the generated files are consistent and the code compiles correctly.

redhat-chai-bot · 2026-11-03T21:08:40Z

/pipeline mark-pipeline-gate 23ddf98

rutvik23 · 2026-11-04T08:22:05Z

/verified by @rutvik23

Built a 4.21 nightly cluster from this PR to ensure stale references are gone

Verified the updated GoDoc:

TLSSecurityProfile.Type no longer states that Modern is unsupported.
TLSProfileSpec.MinTLSVersion no longer states that TLS 1.2 is the highest allowed minimum version.

oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.21.0-0-2026-11-04-070428-test-ci-ln-rdvir52-latest   True        False         25m     Cluster version is 4.21.0-0-2026-11-04-070428-test-ci-ln-rdvir52-latest

% oc explain apiserver.spec.tlsSecurityProfile.type

FIELD: type <string>
ENUM:
    Old
    Intermediate
    Modern
    Custom

DESCRIPTION:
    type is one of Old, Intermediate, Modern or Custom. Custom provides
    the ability to specify individual TLS security profile parameters.
    Old, Intermediate and Modern are TLS security profiles based on:
    
    https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
    
    The profiles are intent based, so they may change over time as new ciphers
    are developed and existing ciphers
    are found to be insecure.  Depending on precisely which ciphers are
    available to a process, the list may be
    reduced.
    

 % oc explain apiserver.spec.tlsSecurityProfile.custom.minTLSVersion

FIELD: minTLSVersion <string>
ENUM:
    VersionTLS10
    VersionTLS11
    VersionTLS12
    VersionTLS13

DESCRIPTION:
    minTLSVersion is used to specify the minimal version of the TLS protocol
    that is negotiated during the TLS handshake. For example, to use TLS
    versions 1.1, 1.2 and 1.3 (yaml):
    
      minTLSVersion: VersionTLS11

openshift-ci-robot · 2026-11-04T08:22:20Z

@rutvik23: This PR has been marked as verified by @rutvik23.

Details

In response to this:

/verified by @rutvik23

Built a 4.21 nightly cluster from this PR to ensure stale references are gone

Verified the updated GoDoc:

TLSSecurityProfile.Type no longer states that Modern is unsupported.
TLSProfileSpec.MinTLSVersion no longer states that TLS 1.2 is the highest allowed minimum version.

oc get clusterversion
NAME      VERSION                                                AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.21.0-0-2026-11-04-070428-test-ci-ln-rdvir52-latest   True        False         25m     Cluster version is 4.21.0-0-2026-11-04-070428-test-ci-ln-rdvir52-latest

% oc explain apiserver.spec.tlsSecurityProfile.type

FIELD: type <string>
ENUM:
   Old
   Intermediate
   Modern
   Custom

DESCRIPTION:
   type is one of Old, Intermediate, Modern or Custom. Custom provides
   the ability to specify individual TLS security profile parameters.
   Old, Intermediate and Modern are TLS security profiles based on:
   
   https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
   
   The profiles are intent based, so they may change over time as new ciphers
   are developed and existing ciphers
   are found to be insecure.  Depending on precisely which ciphers are
   available to a process, the list may be
   reduced.
   

% oc explain apiserver.spec.tlsSecurityProfile.custom.minTLSVersion

FIELD: minTLSVersion <string>
ENUM:
   VersionTLS10
   VersionTLS11
   VersionTLS12
   VersionTLS13

DESCRIPTION:
   minTLSVersion is used to specify the minimal version of the TLS protocol
   that is negotiated during the TLS handshake. For example, to use TLS
   versions 1.1, 1.2 and 1.3 (yaml):
   
     minTLSVersion: VersionTLS11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

openshift-ci-robot added the jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. label Nov 2, 2026

openshift-ci Bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Nov 2, 2026

openshift-ci Bot requested review from everettraven and sinnykumari November 2, 2026 11:37

rutvik23 force-pushed the fix/4.21-modern-tls-profile-docs branch from a55550f to 23ddf98 Compare November 3, 2026 06:27

everettraven approved these changes Nov 3, 2026

View reviewed changes

openshift-ci Bot assigned everettraven Nov 3, 2026

openshift-ci Bot added the lgtm Indicates that a PR is ready to be merged. label Nov 3, 2026

openshift-ci Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 3, 2026

openshift-ci Bot added backport-risk-assessed Indicates a PR to a release branch has been evaluated and considered safe to accept. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Nov 3, 2026

openshift-ci Bot assigned gangwgr Nov 3, 2026

openshift-ci-robot added the verified Signifies that the PR passed pre-merge verification criteria label Nov 4, 2026

openshift-merge-bot Bot merged commit 083e9bb into openshift:release-4.21 Nov 4, 2026
14 checks passed

Conversation

rutvik23 commented Nov 2, 2026

Summary:

Uh oh!

openshift-merge-bot Bot commented Nov 2, 2026

Uh oh!

openshift-ci-robot commented Nov 2, 2026

Summary:

Uh oh!

coderabbitai Bot commented Nov 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

CodeRabbit Verify

Uh oh!

openshift-ci Bot commented Nov 2, 2026

Uh oh!

openshift-ci Bot commented Nov 3, 2026

Uh oh!

everettraven left a comment

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Nov 3, 2026

Uh oh!

everettraven commented Nov 3, 2026

Uh oh!

redhat-chai-bot commented Nov 3, 2026

Uh oh!

redhat-chai-bot commented Nov 3, 2026

Uh oh!

rutvik23 commented Nov 4, 2026

Uh oh!

openshift-ci-robot commented Nov 4, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai Bot commented Nov 2, 2026 •

edited

Loading