OCPBUGS-78774: Add TLS Profile compliance

[jmesnil]

Both the extractor (Rust) and exporter (Go) now fetch the TLS security
profile from the API Server (apiservers.config.openshift.io/cluster)
and apply it dynamically. Plain TCP and plain HTTP are removed entirely.

Extractor: uses openssl crate with kube client to fetch the profile at
startup. Exporter: fetches profile, maps OpenSSL cipher names to Go
crypto/tls constants, serves HTTPS, connects to extractor over TLS with
CA verification, and exits on profile change for pod restart.

Manifests updated with TLS secret volume, CLI args, and RBAC for
APIServer read access.

[openshift-ci-robot]

@jmesnil: This pull request references Jira Issue OCPBUGS-78774, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.22.0) matches configured target version for branch (4.22.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

The bug has been updated to refer to the pull request using the external bug tracker.

Details

In response to this:

Both the extractor (Rust) and exporter (Go) now fetch the TLS security
profile from the API Server (apiservers.config.openshift.io/cluster)
and apply it dynamically. Plain TCP and plain HTTP are removed entirely.

Extractor: uses openssl crate with kube client to fetch the profile at
startup. Exporter: fetches profile, maps OpenSSL cipher names to Go
crypto/tls constants, serves HTTPS, connects to extractor over TLS with
CA verification, and exits on profile change for pod restart.

Manifests updated with TLS secret volume, CLI args, and RBAC for
APIServer read access.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jmesnil

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [jmesnil]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jmesnil: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/rust-unit-tests	6c0e13e	link	true	/test rust-unit-tests
ci/prow/e2e-aws	6c0e13e	link	true	/test e2e-aws
ci/prow/e2e-tests	6c0e13e	link	true	/test e2e-tests

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.