ITADN
sebrandon1/tls-operator-audit
代码 动态 Issues 合并请求 版本
sebrandon1/tls-operator-audit · 文件
文件最后提交记录最后更新时间
README.md

tls-operator-audit

Audit OCP operators for ML-KEM/PQC and TLS compliance using the tls-compliance-operator.

Installs each operator one at a time, scans its TLS endpoints for ML-KEM support, collects results, and tears down before moving to the next. Tracked under OCPSTRAT-3491 / OCPSTRAT-3303.

Results

Tested on OCP 5.0 cluster (cnfdt16) on 2026-08-03. Operators sourced from redhat-operator-index:v5.0 and redhat-operator-index:v4.22 (fallback for operators not yet in the 5.0 index).

OperatorJiraSourceEndpointsML-KEMStatus
cert-manager-operatorCNF-25677pre-installed3 reachable (1 Closed)3/3PASS
compliance-operatorCMP-4503pre-installed2 reachable (6 Closed)2/2PASS
openshift-pipelines-operator-rhSRVKP-11858v5.011/1PASS
rhacs-operatorROX-33132v5.011/1PASS
servicemeshoperator3OSSM-13756v5.011/1PASS
skupper-operatorCONNLINK-1122v5.022/2PASS
openshift-external-secrets-operatorESO-537v5.011/1PASS
file-integrity-operatorCMP-4504v4.220-NONE
security-profiles-operatorCMP-4505v4.2211/1PASS
openshift-gitops-operatorGITOPS-10309v4.224 reachable (3 stale)4/4PASS
rhods-operatorRHOAIENG-72334v4.18 only21/2PARTIAL
sandboxed-containers-operatorKATA-5144v4.22--ERROR
trustee-operatorTRUSTEE-80v4.22--ERROR
openshift-zero-trust-workload-identity-managerSPIRE-568v4.22--ERROR

Key Findings

  • 10 PASS — All reachable TLS endpoints offer ML-KEM key exchange
  • 1 PARTIAL — rhods-operator has a metrics endpoint (redhat-ods-operator-controller-manager-metrics-service:8443) serving PlaintextHTTP instead of TLS
  • 1 NONE — file-integrity-operator exposes no TLS-serving endpoints (controller only)
  • 3 ERROR — sandboxed-containers-operator, trustee-operator, and openshift-zero-trust-workload-identity-manager won't install on OCP 5.0 from either v4.22 or v4.18 catalog indexes (likely need native 5.0 builds)

Notes

  • "Closed" endpoints are services whose backing pods are not running (e.g., compliance-operator scan ResultServers that only exist during active scans). These are excluded from pass/fail evaluation.
  • Operators installed via AllNamespaces mode run in openshift-operators. The test runner installs one operator at a time and cleans up between each to avoid cross-contamination.
  • The v4.22 fallback catalog (redhat-operators-v422) was added as a separate CatalogSource to avoid overlapping with the v5.0 index.

Prerequisites

  • oc CLI with cluster-admin access
  • jq for JSON processing
  • yq for YAML processing (v4+)
  • tls-compliance-operator deployed on the target cluster

Scripts

tls-test-all.sh — Full test runner (install, scan, teardown)

Iterates through operators.yaml, installing each operator one at a time, waiting for the tls-compliance-operator to discover its endpoints, collecting ML-KEM results, then tearing down.

./tls-test-all.sh --kubeconfig ~/kubeconfig

# Test a single operator
./tls-test-all.sh --kubeconfig ~/kubeconfig --only rhacs-operator

# Keep operators installed after scanning
./tls-test-all.sh --kubeconfig ~/kubeconfig --skip-teardown

tls-mlkem-report.sh — Quick report from existing data

Queries existing TLSComplianceReport CRs on the cluster (no new scan). Useful for checking operators that are already installed.

./tls-mlkem-report.sh --kubeconfig ~/kubeconfig

# Report on all namespaces, not just listed operators
./tls-mlkem-report.sh --kubeconfig ~/kubeconfig --all-namespaces

tls-audit.sh — Single operator scan via run-once Job

Deploys a scoped run-once scan Job for a specific operator. Produces JSON, Markdown, and JUnit reports.

./tls-audit.sh --operator cert-manager-operator --kubeconfig ~/kubeconfig
./tls-audit.sh --list-operators --kubeconfig ~/kubeconfig

Output

Results are saved to results/<operator-name>/<timestamp>/:

  • report.json — Full scan results (TLSComplianceReport CRs)
  • report.md — Markdown summary table
  • report.xml — JUnit XML for CI integration