Red Hat OpenShift Container Platform

Configuring cluster TLS security profile adherence for cert-manager components

You can configure the cert-manager Operator for Red Hat OpenShift to apply the cluster-wide TLS security profile by setting the TLS adherence policy on the cluster APIServer resource. When the adherence policy is set to StrictAllComponents, cert-manager components automatically apply the cluster TLS security profile settings.

TLS adherence for cert-manager operands is a Technology Preview feature only. Technology Preview features are not supported with Red Hat production service level agreements (SLAs) and might not be functionally complete. Red Hat does not recommend using them in production. These features provide early access to upcoming product features, enabling customers to test functionality and provide feedback during the development process.

For more information about the support scope of Red Hat Technology Preview features, see Technology Preview Features Support Scope.

Prerequisites

You have access to the cluster with cluster-admin privileges.
You installed the cert-manager Operator for Red Hat OpenShift.
You enabled the TechPreviewNoUpgrade feature set. For more information, see "Enabling features using feature gates".

Procedure

Edit the cluster APIServer custom resource (CR) by running the following command:
```
$ oc edit apiserver cluster
```
Add or modify the tlsAdherence field in the spec section and set it to StrictAllComponents by using the following example:
```
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
  name: cluster
spec:
  tlsSecurityProfile:
    type: Intermediate
    intermediate: {}
  tlsAdherence: StrictAllComponents
```
where:

tlsSecurityProfile.type

Optional: Specifies the TLS security profile type. Valid values are Old, Intermediate, Modern, or Custom. If not specified, the default is Intermediate. When specifying a profile type, you must also include the corresponding profile-specific field, for example, intermediate: {} for the Intermediate profile.

tlsAdherence: StrictAllComponents

Specifies that cluster-wide TLS settings are enforced on all components, including cert-manager.
Save the changes and exit the editor.

Verification

The cert-manager Operator for Red Hat OpenShift automatically applies the cluster TLS security profile to the cert-manager controller, webhook, and CA injector deployments. Check that the TLS configuration is applied to the cert-manager components. For more information, see "Verifying TLS security profile adherence for cert-manager components".