Implement CurvePreferences support in NewTLSConfigFromProfile (openshift/api#2583 merged)

[rauhersu]

Summary

The NewTLSConfigFromProfile function in pkg/tls/tls.go currently has a TODO comment at line 122 waiting on the openshift/api PR to merge:

// TODO: add curve preferences from profile once https://github.com/openshift/api/pull/2583 merges.
// tlsConf.CurvePreferences <<<<<< profile.Curves

That API PR has now merged (June 1, 2026): openshift/api#2583

The TLSProfileSpec struct now includes a Groups field (note: the field is named Groups, not Curves as referenced in the TODO):

// +openshift:enable:FeatureGate=TLSGroupPreferences
Groups []TLSGroup `json:"groups,omitempty"`

What needs to happen

NewTLSConfigFromProfile should be updated to wire profile.Groups into tls.Config.CurvePreferences, mapping each TLSGroup value to its corresponding tls.CurveID.

The feature is gated behind TLSGroupPreferences (TechPreview), per the enhancement proposal. When Groups is empty/nil (GA clusters), Go's default curve preferences should continue to apply as they do today.

Why this matters

Downstream operators that consume controller-runtime-common to configure TLS (e.g., oran-o2ims — CNF-21985: Central TLS Profile consistency) rely on NewTLSConfigFromProfile to fully apply the cluster TLS profile. Without this implementation, curve preferences from the profile are silently ignored even when the feature gate is enabled.

cc @damdo (introduced the TODO in ab84f25b)