HPCASE-208:Add TLSAdherencePolicy helper

[richardsonnick]

Add ShouldHonorClusterTLSProfile helper for TLS adherence policy

Adds a helper function that encapsulates the logic for determining
whether a component should honor the cluster-wide TLS security profile
from apiserver.config.openshift.io/cluster.

This function handles:

• Empty/unset values (treated as LegacyExternalAPIServerComponentsOnly)
• LegacyExternalAPIServerComponentsOnly (returns false)
• StrictAllComponents (returns true)
• Unknown enum values (returns true for forward compatibility)

Component implementors should use this helper rather than checking
tlsAdherence field values directly, allowing coordinated changes to
the default semantic across all implementations.

See: https://github.com/openshift/enhancements/pull/XXXX

Relevant APIServer changes: openshift/api#2680

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[richardsonnick]

This will be a draft diff until openshift/api#2680 is landed. Since 2680 adds the TLSAdherencePolicy type

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: richardsonnick
Once this PR has been reviewed and has the lgtm label, please assign p0lyn0mial for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@richardsonnick: This pull request references HPCASE-208 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

This helper gives us control on the behavior of consuming components without making changes to the APIServer CRD.

Relevant APIServer changes: openshift/api#2680

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci-robot]

@richardsonnick: This pull request references HPCASE-208 which is a valid jira issue.

Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the sub-task to target the "4.22.0" version, but no target version was set.

Details

In response to this:

Add ShouldHonorClusterTLSProfile helper for TLS adherence policy

Adds a helper function that encapsulates the logic for determining
whether a component should honor the cluster-wide TLS security profile
from apiserver.config.openshift.io/cluster.

This function handles:

• Empty/unset values (treated as LegacyExternalAPIServerComponentsOnly)
• LegacyExternalAPIServerComponentsOnly (returns false)
• StrictAllComponents (returns true)
• Unknown enum values (returns true for forward compatibility)

Component implementors should use this helper rather than checking
tlsAdherence field values directly, allowing coordinated changes to
the default semantic across all implementations.

See: https://github.com/openshift/enhancements/pull/XXXX

Relevant APIServer changes: openshift/api#2680

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository.

[openshift-ci]

@richardsonnick: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/verify-deps	b244d82	link	true	/test verify-deps
ci/prow/verify	b244d82	link	true	/test verify
ci/prow/unit	b244d82	link	true	/test unit

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[richardsonnick]

/hold

[richardsonnick]

Tests will not pass until api changes are merged: openshift/api#2680