CNTRLPLANE-3611: propagate tls profile to aws-pod-identity-webhook

control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment.go

@@ -299,22 +299,33 @@ func updateBootstrapInitContainer(deployment *appsv1.Deployment, hcp *hyperv1.Ho
 }
 
 func applyAWSPodIdentityWebhookContainer(podSpec *corev1.PodSpec, hcp *hyperv1.HostedControlPlane) {
+	command := []string{
+		"/usr/bin/aws-pod-identity-webhook",
+		"--annotation-prefix=eks.amazonaws.com",
+		"--in-cluster=false",
+		"--kubeconfig=/var/run/app/kubeconfig/kubeconfig",
+		"--logtostderr",
+		"--port=4443",
+		fmt.Sprintf("--aws-default-region=%s", hcp.Spec.Platform.AWS.Region),
+		"--tls-cert=/var/run/app/certs/tls.crt",
+		"--tls-key=/var/run/app/certs/tls.key",
+		"--token-audience=openshift",
+	}
+
+	if tlsMinVersion := config.MinTLSVersion(hcp.Spec.Configuration.GetTLSSecurityProfile()); tlsMinVersion != "" {
+		if version := convertTLSVersion(tlsMinVersion); version != "" {
+			command = append(command, fmt.Sprintf("--tls-min-version=%s", version))
+		}
+	}
+	if cipherSuites := config.CipherSuites(hcp.Spec.Configuration.GetTLSSecurityProfile()); len(cipherSuites) != 0 {
+		command = append(command, fmt.Sprintf("--tls-cipher-suites=%s", strings.Join(cipherSuites, ",")))
+	}
+
 	podSpec.Containers = append(podSpec.Containers, corev1.Container{
 		Name:            "aws-pod-identity-webhook",
 		Image:           "aws-pod-identity-webhook",
 		ImagePullPolicy: corev1.PullIfNotPresent,
-		Command: []string{
-			"/usr/bin/aws-pod-identity-webhook",
-			"--annotation-prefix=eks.amazonaws.com",
-			"--in-cluster=false",
-			"--kubeconfig=/var/run/app/kubeconfig/kubeconfig",
-			"--logtostderr",
-			"--port=4443",
-			fmt.Sprintf("--aws-default-region=%s", hcp.Spec.Platform.AWS.Region),
-			"--tls-cert=/var/run/app/certs/tls.crt",
-			"--tls-key=/var/run/app/certs/tls.key",
-			"--token-audience=openshift",
-		},
+		Command:         command,
 		Resources: corev1.ResourceRequirements{
 			Requests: corev1.ResourceList{
 				corev1.ResourceCPU:    resource.MustParse("10m"),
@@ -343,6 +354,21 @@ func applyAWSPodIdentityWebhookContainer(podSpec *corev1.PodSpec, hcp *hyperv1.H
 	)
 }
 
+func convertTLSVersion(version string) string {
+	switch version {
+	case "VersionTLS10":
+		return "1.0"
+	case "VersionTLS11":
+		return "1.1"
+	case "VersionTLS12":
+		return "1.2"
+	case "VersionTLS13":
+		return "1.3"
+	default:
+		return ""
+	}
+}
+
 func applyAzureWorkloadIdentityWebhookContainer(podSpec *corev1.PodSpec, hcp *hyperv1.HostedControlPlane) {
 	waitForKASScript := fmt.Sprintf(azureWorkloadIdentityWebhookWaitForKASVersionTemplate, netutil.KASPodPort(hcp))
 

control-plane-operator/controllers/hostedcontrolplane/v2/kas/deployment_test.go

@@ -85,3 +85,50 @@ func TestAddImagePrePullInitContainers(t *testing.T) {
 		})
 	}
 }
+
+func TestConvertTLSVersion(t *testing.T) {
+	testCases := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "When input is VersionTLS10 it should return 1.0",
+			input:    "VersionTLS10",
+			expected: "1.0",
+		},
+		{
+			name:     "When input is VersionTLS11 it should return 1.1",
+			input:    "VersionTLS11",
+			expected: "1.1",
+		},
+		{
+			name:     "When input is VersionTLS12 it should return 1.2",
+			input:    "VersionTLS12",
+			expected: "1.2",
+		},
+		{
+			name:     "When input is VersionTLS13 it should return 1.3",
+			input:    "VersionTLS13",
+			expected: "1.3",
+		},
+		{
+			name:     "When input is unknown it should return empty string",
+			input:    "UnknownVersion",
+			expected: "",
+		},
+		{
+			name:     "When input is empty it should return empty string",
+			input:    "",
+			expected: "",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			g := NewWithT(t)
+			result := convertTLSVersion(tc.input)
+			g.Expect(result).To(Equal(tc.expected))
+		})
+	}
+}