Add ALPN/NextProtos helpers for TLS config

[ugiordan]

Summary

Adds composable ALPN protocol negotiation helpers to pkg/tls, eliminating
copy-paste boilerplate found in 49+ repos across the openshift org.

Currently every operator using NewTLSConfigFromProfile must manually append
a func(*tls.Config) to set tls.Config.NextProtos. This change provides:

• HTTP2NextProtos / HTTP1NextProtos: well-known ALPN protocol lists
• SetNextProtos(protos ...string): explicit ALPN setter with defensive copy and empty-string filtering

Before (every operator today):

// Fetch the cluster TLS profile
tlsProfile, err := openshifttls.FetchAPIServerTLSProfile(ctx, client)
if err != nil {
    return fmt.Errorf("failed to get tls profile: %w", err)
}

// Build TLS config from the profile
tlsConfig, unsupported := openshifttls.NewTLSConfigFromProfile(tlsProfile)
if len(unsupported) > 0 {
    setupLog.Info("unsupported ciphers", "ciphers", unsupported)
}

// Manually set ALPN (copy-pasted across 49+ repos)
disableHTTP2 := func(c *tls.Config) {
    setupLog.Info("disabling http/2")
    c.NextProtos = []string{"http/1.1"}
}

// Wire into controller-runtime
mgr, err := ctrl.NewManager(cfg, ctrl.Options{
    Metrics: metricsserver.Options{
        TLSOpts: []func(*tls.Config){tlsConfig, disableHTTP2},
    },
    WebhookServer: &webhook.DefaultServer{Options: webhook.Options{
        TLSOpts: []func(*tls.Config){tlsConfig, disableHTTP2},
    }},
})

After:

// Fetch the cluster TLS profile
tlsProfile, err := openshifttls.FetchAPIServerTLSProfile(ctx, client)
if err != nil {
    return fmt.Errorf("failed to get tls profile: %w", err)
}

// Build TLS config from the profile
tlsConfig, unsupported := openshifttls.NewTLSConfigFromProfile(tlsProfile)
if len(unsupported) > 0 {
    setupLog.Info("unsupported ciphers", "ciphers", unsupported)
}

// Compose profile + ALPN into a single TLSOpts slice
tlsOpts := []func(*tls.Config){tlsConfig, openshifttls.SetNextProtos(openshifttls.HTTP1NextProtos...)}

// Wire into controller-runtime
mgr, err := ctrl.NewManager(cfg, ctrl.Options{
    Metrics: metricsserver.Options{
        TLSOpts: tlsOpts,
    },
    WebhookServer: &webhook.DefaultServer{Options: webhook.Options{
        TLSOpts: tlsOpts,
    }},
})

Other usage patterns:

// Disable HTTP/2 (defense-in-depth for CVE-2023-44487)
openshifttls.SetNextProtos(openshifttls.HTTP1NextProtos...)

// Enable HTTP/2 with HTTP/1.1 fallback
openshifttls.SetNextProtos(openshifttls.HTTP2NextProtos...)

// Inline protocol values
openshifttls.SetNextProtos("h2", "http/1.1")

// Conditional inclusion (empty strings are filtered out)
openshifttls.SetNextProtos(conditionalH2, "http/1.1")

// Use the exported vars directly when building a tls.Config outside TLSOpts
cfg := &tls.Config{
    NextProtos: openshifttls.HTTP1NextProtos,
}

Concrete use-cases

Repos already using NewTLSConfigFromProfile alongside manual NextProtos:

• openshift/lvm-operator (cmd/operator/operator.go, cmd/vgmanager/vgmanager.go)
• openshift/ptp-operator (main.go)
• openshift/pf-status-relay-operator (cmd/main.go)
• openshift/vertical-pod-autoscaler-operator (cmd/main.go)
• openshift/cluster-node-tuning-operator (cmd/cluster-node-tuning-operator/main.go)

GitHub code search shows 49 total repos in the openshift org with this pattern.

Design decisions

• Separate from NewTLSConfigFromProfile: NextProtos is HTTP protocol
  negotiation, not TLS cipher/version selection. Different consumers want
  different values. Composable functions preserve the existing API.
• Explicit over opinionated: callers directly control the protocol list
  they're setting rather than going through a boolean abstraction.
• Defensive copy in SetNextProtos: prevents callers from mutating the
  captured slice.
• Empty-string filtering: allows conditional protocol inclusion without
  requiring wrapper functions.
• nil preservation: SetNextProtos() with zero non-empty args returns nil
  to preserve tls.Config default semantics.
• Follows existing patterns: func(*tls.Config) return type, exported
  package-level vars with nolint:gochecknoglobals, Ginkgo/Gomega tests.

Verification

• make test passes (all tests green with race detector)
• make lint passes (0 issues)

[ugiordan]

@sdodson @joelanford would appreciate a review when you get a chance. This adds ALPN/NextProtos to the TLS config returned by NewTLSConfigFromProfile. Currently every operator using this library has to append NextProtos manually. This fixes it at the library level.

[openshift-ci]

@ugiordan: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[joelanford]

/approve

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: joelanford, ugiordan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [joelanford]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ugiordan]

@joelanford can I get a lgtm?

[ugiordan]

@joelanford could you please help with this one?