Test OpenShift TLS security profile propagation to Authorino

[averevki]

Summary

Test that the OpenShift cluster TLS security profile (configured via the APIServer CR at config.openshift.io/v1) is correctly propagated to Authorino through the kuadrant-operator. On non-OpenShift clusters, verify that Authorino falls back to Intermediate profile defaults.

The feature is implemented across three repositories:

• Add TLS min version and cipher suite CLI flags authorino#647 — adds --tls-min-version and --tls-cipher-suites CLI flags to Authorino
• Add TLS profile fields to Authorino CR authorino-operator#335 — adds tlsMinVersion and tlsCipherSuites fields to the Authorino CR
• Propagate OpenShift TLS security profile to Authorino kuadrant-operator#2091 — reads the APIServer CR and propagates TLS settings to the Authorino CR

Documentation

• Parent epic: Propagate OpenShift TLS Security Profile kuadrant-operator#2125
• Implementation PRs:
  • Add TLS min version and cipher suite CLI flags authorino#647
  • Add TLS profile fields to Authorino CR authorino-operator#335
  • Propagate OpenShift TLS security profile to Authorino kuadrant-operator#2091

Test Scenarios

Scenario 1: Default Intermediate profile on OpenShift

Setup:

• OpenShift cluster with default APIServer configuration (Intermediate profile)
• Kuadrant installed with Authorino

Tests:

• Verify the Authorino CR has tlsMinVersion set to VersionTLS12
• Verify the Authorino CR has expected Intermediate cipher suites
• Verify the Authorino deployment container args include --tls-min-version=VersionTLS12 and the correct --tls-cipher-suites

Scenario 2: Modern TLS profile

Setup:

• OpenShift cluster with APIServer TLS profile set to Modern

Tests:

• Verify the Authorino CR has tlsMinVersion set to VersionTLS13
• Verify the Authorino deployment reflects TLS 1.3 settings
• Verify TLS 1.2 connections to Authorino's OIDC/ext-auth port are rejected

Scenario 3: Old TLS profile

Setup:

• OpenShift cluster with APIServer TLS profile set to Old

Tests:

• Verify the Authorino CR has tlsMinVersion set to VersionTLS10
• Verify the Authorino deployment reflects TLS 1.0 settings

Scenario 4: Custom TLS profile

Setup:

• OpenShift cluster with APIServer TLS profile set to Custom with specific minTLSVersion and cipher suites

Tests:

• Verify the Authorino CR reflects the custom tlsMinVersion
• Verify the Authorino CR reflects the custom cipher suites (OpenSSL to IANA name translation)
• Verify unsupported DHE ciphers are silently skipped

Scenario 5: Profile change reconciliation

Setup:

• OpenShift cluster with Kuadrant installed

Tests:

• Change APIServer TLS profile from Intermediate to Modern
• Verify the Authorino CR is updated to reflect the new profile
• Verify the Authorino deployment is restarted with updated args

Scenario 6: Non-OpenShift fallback (Kind cluster)

Setup:

• Kind cluster (no APIServer CRD present)
• Kuadrant installed with Authorino

Tests:

• Verify the Authorino CR has Intermediate profile defaults (VersionTLS12 + standard cipher suites)
• Verify Authorino functions correctly with the fallback configuration

Implementation Details

• Test location: testsuite/tests/singlecluster/authorino/operator/tls_profile/
• Markers: @pytest.mark.authorino, @pytest.mark.kuadrant_only
• Model extensions needed:
  • APIServer CR model (config.openshift.io/v1) for reading/modifying the cluster TLS profile
  • Authorino CR model extension for tlsMinVersion and tlsCipherSuites fields
• Fixtures:
  • Fixture to read the current APIServer CR and restore it after tests (for scenarios that modify the profile)
  • Fixture to read the Authorino CR's TLS configuration
  • Fixture to inspect Authorino deployment container args
• Scenarios 2-5 modify the cluster-wide APIServer CR, which can affect other cluster components. These tests should be marked as @pytest.mark.disruptive or run in isolation
• OpenShift-only scenarios (1-5) should be skipped on non-OpenShift clusters

Dependencies

• Add TLS min version and cipher suite CLI flags authorino#647 (merged)
• Add TLS profile fields to Authorino CR authorino-operator#335 (merged)
• Propagate OpenShift TLS security profile to Authorino kuadrant-operator#2091 (merged)