diff --git a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml
index 99c093b2176..3fcdb34871a 100644
--- a/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml
+++ b/config/v1/zz_generated.crd-manifests/0000_10_config-operator_01_apiservers-OKD.crd.yaml
@@ -223,6 +223,42 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
+ tlsAdherence:
+ description: |-
+ tlsAdherence controls if components in the cluster adhere to the TLS security profile
+ configured on this APIServer resource.
+
+ Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+ When set to "LegacyAdheringComponentsOnly", components that already honor the
+ cluster-wide TLS profile continue to do so. Components that do not already honor
+ it continue to use their individual TLS configurations.
+
+ When set to "StrictAllComponents", all components must honor the configured TLS
+ profile unless they have a component-specific TLS configuration that overrides
+ it. This mode is recommended for security-conscious deployments and is required
+ for certain compliance frameworks.
+
+ Note: Some components such as Kubelet and IngressController have their own
+ dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+ CRs respectively. When these component-specific TLS configurations are set,
+ they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+ these components fall back to the cluster-wide default.
+
+ Components that encounter an unknown value for tlsAdherence should treat it
+ as "StrictAllComponents" and log a warning to ensure forward compatibility
+ while defaulting to the more secure behavior.
+
+ This field is optional.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is LegacyAdheringComponentsOnly.
+
+ Once set, this field may be changed to a different value, but may not be removed.
+ enum:
+ - LegacyAdheringComponentsOnly
+ - StrictAllComponents
+ type: string
tlsSecurityProfile:
description: |-
tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -380,6 +416,9 @@ spec:
type: string
type: object
type: object
+ x-kubernetes-validations:
+ - message: tlsAdherence may not be removed once set
+ rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
status:
description: status holds observed values from the cluster. They may not
be overridden.
diff --git a/features.md b/features.md
index 1114b69d9b5..f8b18f4846e 100644
--- a/features.md
+++ b/features.md
@@ -85,9 +85,9 @@
| OnPremDNSRecords| | | Enabled | Enabled | | | Enabled | Enabled |
| SELinuxMount| | | Enabled | Enabled | | | Enabled | Enabled |
| SignatureStores| | | Enabled | Enabled | | | Enabled | Enabled |
-| TLSAdherence| | | Enabled | Enabled | | | Enabled | Enabled |
| TLSGroupPreferences| | | Enabled | Enabled | | | Enabled | Enabled |
| VSphereConfigurableMaxAllowedBlockVolumesPerNode| | | Enabled | Enabled | | | Enabled | Enabled |
+| TLSAdherence| | | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
| AWSClusterHostedDNSInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
| AWSDualStackInstall| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
| AdditionalStorageConfig| Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled | Enabled |
diff --git a/features/features.go b/features/features.go
index 7ff6c4c3ed1..a1697b09a57 100644
--- a/features/features.go
+++ b/features/features.go
@@ -994,7 +994,7 @@ var (
contactPerson("joelanford").
productScope(ocpSpecific).
enhancementPR("https://github.com/openshift/enhancements/pull/1910").
- enable(inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
+ enable(inOKD(), inDevPreviewNoUpgrade(), inTechPreviewNoUpgrade()).
mustRegister()
FeatureGateConfidentialCluster = newFeatureGate("ConfidentialCluster").
diff --git a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml
index 99c093b2176..3fcdb34871a 100644
--- a/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml
+++ b/payload-manifests/crds/0000_10_config-operator_01_apiservers-OKD.crd.yaml
@@ -223,6 +223,42 @@ spec:
type: array
x-kubernetes-list-type: atomic
type: object
+ tlsAdherence:
+ description: |-
+ tlsAdherence controls if components in the cluster adhere to the TLS security profile
+ configured on this APIServer resource.
+
+ Valid values are "LegacyAdheringComponentsOnly" and "StrictAllComponents".
+
+ When set to "LegacyAdheringComponentsOnly", components that already honor the
+ cluster-wide TLS profile continue to do so. Components that do not already honor
+ it continue to use their individual TLS configurations.
+
+ When set to "StrictAllComponents", all components must honor the configured TLS
+ profile unless they have a component-specific TLS configuration that overrides
+ it. This mode is recommended for security-conscious deployments and is required
+ for certain compliance frameworks.
+
+ Note: Some components such as Kubelet and IngressController have their own
+ dedicated TLS configuration mechanisms via KubeletConfig and IngressController
+ CRs respectively. When these component-specific TLS configurations are set,
+ they take precedence over the cluster-wide tlsSecurityProfile. When not set,
+ these components fall back to the cluster-wide default.
+
+ Components that encounter an unknown value for tlsAdherence should treat it
+ as "StrictAllComponents" and log a warning to ensure forward compatibility
+ while defaulting to the more secure behavior.
+
+ This field is optional.
+ When omitted, this means the user has no opinion and the platform is left
+ to choose reasonable defaults. These defaults are subject to change over time.
+ The current default is LegacyAdheringComponentsOnly.
+
+ Once set, this field may be changed to a different value, but may not be removed.
+ enum:
+ - LegacyAdheringComponentsOnly
+ - StrictAllComponents
+ type: string
tlsSecurityProfile:
description: |-
tlsSecurityProfile specifies settings for TLS connections for externally exposed servers.
@@ -380,6 +416,9 @@ spec:
type: string
type: object
type: object
+ x-kubernetes-validations:
+ - message: tlsAdherence may not be removed once set
+ rule: 'has(oldSelf.tlsAdherence) ? has(self.tlsAdherence) : true'
status:
description: status holds observed values from the cluster. They may not
be overridden.
diff --git a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
index ed750c9b289..032c0dff2bc 100644
--- a/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-Hypershift-OKD.yaml
@@ -268,9 +268,6 @@
{
"name": "SignatureStores"
},
- {
- "name": "TLSAdherence"
- },
{
"name": "TLSGroupPreferences"
},
@@ -375,6 +372,9 @@
{
"name": "StoragePerformantSecurityPolicy"
},
+ {
+ "name": "TLSAdherence"
+ },
{
"name": "UpgradeStatus"
},
diff --git a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
index ec1ed473d2e..f8dacd376cb 100644
--- a/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
+++ b/payload-manifests/featuregates/featureGate-4-10-SelfManagedHA-OKD.yaml
@@ -256,9 +256,6 @@
{
"name": "SignatureStores"
},
- {
- "name": "TLSAdherence"
- },
{
"name": "TLSGroupPreferences"
},
@@ -375,6 +372,9 @@
{
"name": "StoragePerformantSecurityPolicy"
},
+ {
+ "name": "TLSAdherence"
+ },
{
"name": "UpgradeStatus"
},