feat: add shared tls package for reading TLS config from environment by Fedosin · Pull Request #3324 · knative/pkg

Fedosin · Feb 27, 2026

Changes

Extract TLS configuration parsing into a reusable knative.dev/pkg/tls package so that any Knative component (not just webhooks) can read TLS_MIN_VERSION, TLS_MAX_VERSION, TLS_CIPHER_SUITES, and TLS_CURVE_PREFERENCES from environment variables with an optional prefix.

The webhook package is updated to use the new tls package, extending env var support from just WEBHOOK_TLS_MIN_VERSION to all four WEBHOOK_TLS_* variables. Programmatic Options values continue to take precedence over environment variables.

/kind enhancement

Fixes #

Release Note

Add new `knative.dev/pkg/tls` package for shared TLS configuration. Webhook now supports `WEBHOOK_TLS_MAX_VERSION`, `WEBHOOK_TLS_CIPHER_SUITES`, and `WEBHOOK_TLS_CURVE_PREFERENCES` environment variables in addition to the existing `WEBHOOK_TLS_MIN_VERSION`.

Docs

codecov · Feb 27, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 74.87%. Comparing base (b239e96) to head (9243d2e).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3324      +/-   ##
==========================================
+ Coverage   74.63%   74.87%   +0.24%     
==========================================
  Files         188      189       +1     
  Lines        8219     8299      +80     
==========================================
+ Hits         6134     6214      +80     
  Misses       1844     1844              
  Partials      241      241

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Extract TLS configuration parsing into a reusable knative.dev/pkg/tls package so that any Knative component (not just webhooks) can read TLS_MIN_VERSION, TLS_MAX_VERSION, TLS_CIPHER_SUITES, and TLS_CURVE_PREFERENCES from environment variables with an optional prefix. The webhook package is updated to use the new tls package, extending env var support from just WEBHOOK_TLS_MIN_VERSION to all four WEBHOOK_TLS_* variables. Programmatic Options values continue to take precedence over environment variables. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com>

twoGiants

Great job @Fedosin ! 👍

See my comments below.

webhook_test.go is not yet reviewed. Will do after lunch 🥘 😺

twoGiants

Alright, done. Tests are great!

See my few comments.

Reduce the public API surface of the tls package by unexporting ParseVersion, ParseCipherSuites, and ParseCurvePreferences since they are implementation details of NewConfigFromEnv. Also validate that TLS max version is not smaller than min version in webhook.New(), document the Options TLS field precedence (programmatic > env vars > defaults), and broaden TestConfig_TLSConfig to exercise the full NewConfigFromEnv → TLSConfig path. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com>

twoGiants

/approve
/lgtm

Cali0707

/lgtm
/approve

knative-prow · Mar 2, 2026

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Cali0707, Fedosin, twoGiants

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Cali0707]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

dprotaso · Mar 8, 2026

Can we move this package under knative.dev/pkg/network/tls ?

…native#3324) * feat: add shared tls package for reading TLS config from environment Extract TLS configuration parsing into a reusable knative.dev/pkg/tls package so that any Knative component (not just webhooks) can read TLS_MIN_VERSION, TLS_MAX_VERSION, TLS_CIPHER_SUITES, and TLS_CURVE_PREFERENCES from environment variables with an optional prefix. The webhook package is updated to use the new tls package, extending env var support from just WEBHOOK_TLS_MIN_VERSION to all four WEBHOOK_TLS_* variables. Programmatic Options values continue to take precedence over environment variables. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> * fix: address review feedback on tls package Reduce the public API surface of the tls package by unexporting ParseVersion, ParseCipherSuites, and ParseCurvePreferences since they are implementation details of NewConfigFromEnv. Also validate that TLS max version is not smaller than min version in webhook.New(), document the Options TLS field precedence (programmatic > env vars > defaults), and broaden TestConfig_TLSConfig to exercise the full NewConfigFromEnv → TLSConfig path. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> --------- Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com>

* feat: add shared tls package for reading TLS config from environment (#3324) * feat: add shared tls package for reading TLS config from environment Extract TLS configuration parsing into a reusable knative.dev/pkg/tls package so that any Knative component (not just webhooks) can read TLS_MIN_VERSION, TLS_MAX_VERSION, TLS_CIPHER_SUITES, and TLS_CURVE_PREFERENCES from environment variables with an optional prefix. The webhook package is updated to use the new tls package, extending env var support from just WEBHOOK_TLS_MIN_VERSION to all four WEBHOOK_TLS_* variables. Programmatic Options values continue to take precedence over environment variables. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> * fix: address review feedback on tls package Reduce the public API surface of the tls package by unexporting ParseVersion, ParseCipherSuites, and ParseCurvePreferences since they are implementation details of NewConfigFromEnv. Also validate that TLS max version is not smaller than min version in webhook.New(), document the Options TLS field precedence (programmatic > env vars > defaults), and broaden TestConfig_TLSConfig to exercise the full NewConfigFromEnv → TLSConfig path. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> --------- Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> * Replace NewConfigFromEnv with DefaultConfigFromEnv (#3328) DefaultConfigFromEnv replaces NewConfigFromEnv by returning a full default tls.Config with overrides from env vars. This avoids specifying e.g. the TLS MinVersion explicitely. * Move tls package to network/tls, keep aliases for backward compatibility (#3331) The TLS configuration package is moved from tls/ to network/tls/ to co-locate it with the rest of the networking code. The old tls/ package now re-exports all public symbols as deprecated aliases so that existing consumers continue to compile without changes. The webhook package is updated to import from the new location directly. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> * remove deprecated TLS package (#3333) --------- Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com> Co-authored-by: Vincent Link <linkvt@users.noreply.github.com> Co-authored-by: Dave Protasowski <dprotaso@gmail.com>

knative-prow Bot added the kind/enhancement label Feb 27, 2026

knative-prow Bot requested review from Cali0707 and skonto February 27, 2026 09:37

knative-prow Bot added the size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. label Feb 27, 2026

Fedosin force-pushed the tls-opts branch 5 times, most recently from 62d1981 to 554c259 Compare February 27, 2026 11:26

Fedosin force-pushed the tls-opts branch from 554c259 to 1723d0e Compare February 27, 2026 11:41

twoGiants suggested changes Mar 2, 2026

View reviewed changes

Comment thread tls/config_test.go

Comment thread tls/config_test.go

Comment thread webhook/env.go Outdated

Comment thread tls/config.go Outdated

Comment thread webhook/webhook.go

Comment thread webhook/webhook.go

knative-prow Bot assigned twoGiants Mar 2, 2026

twoGiants suggested changes Mar 2, 2026

View reviewed changes

Comment thread webhook/webhook_test.go Outdated

Comment thread webhook/webhook_test.go Outdated

Fedosin force-pushed the tls-opts branch from 5d19b0b to 9243d2e Compare March 2, 2026 13:55

twoGiants approved these changes Mar 2, 2026

View reviewed changes

knative-prow Bot added the lgtm Indicates that a PR is ready to be merged. label Mar 2, 2026

Cali0707 approved these changes Mar 2, 2026

View reviewed changes

knative-prow Bot assigned Cali0707 Mar 2, 2026

knative-prow Bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 2, 2026

knative-prow Bot merged commit f62171b into knative:main Mar 2, 2026
38 checks passed

Fedosin deleted the tls-opts branch March 2, 2026 14:18

This was referenced Mar 3, 2026

feat: use knative.dev/pkg/tls for activator TLS configuration knative/serving#16424

Merged

feat: use knative.dev/pkg/tls for queue-proxy TLS configuration knative/serving#16425

Merged

Fedosin mentioned this pull request Mar 9, 2026

Move tls package to network/tls, keep aliases for backward compatibility #3331

Merged

Fedosin mentioned this pull request Mar 18, 2026

[release-1.21] Add network/tls package for TLS configuration #3337

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: add shared tls package for reading TLS config from environment#3324

feat: add shared tls package for reading TLS config from environment#3324
knative-prow[bot] merged 2 commits intoknative:mainknative/pkg:mainfrom
Fedosin:tls-optsFedosin/knative-pkg:tls-optsCopy head branch name to clipboard

Fedosin commented Feb 27, 2026

Uh oh!

codecov Bot commented Feb 27, 2026 •

edited

Loading

Uh oh!

twoGiants left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

twoGiants left a comment

Uh oh!

Uh oh!

Uh oh!

twoGiants left a comment

Uh oh!

Cali0707 left a comment

Uh oh!

knative-prow Bot commented Mar 2, 2026

Uh oh!

Uh oh!

dprotaso commented Mar 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Search code, repositories, users, issues, pull requests...

Conversation

Fedosin commented Feb 27, 2026

Changes

Uh oh!

codecov Bot commented Feb 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

twoGiants left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

twoGiants left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

twoGiants left a comment

Choose a reason for hiding this comment

Uh oh!

Cali0707 left a comment

Choose a reason for hiding this comment

Uh oh!

knative-prow Bot commented Mar 2, 2026

Uh oh!

Uh oh!

dprotaso commented Mar 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov Bot commented Feb 27, 2026 •

edited

Loading