{
  "timestamp": "2026-11-03T18:50:17Z",
  "total_ips": 2,
  "scanned_ips": 2,
  "ip_results": [
    {
      "ip": "10.133.0.28",
      "status": "scanned",
      "open_ports": [
        8081,
        8443,
        9443
      ],
      "port_results": [
        {
          "port": 8081,
          "protocol": "tcp",
          "state": "open",
          "service": "",
          "status": "PROBE_PORT",
          "reason": "Port is used as a plaintext health probe endpoint (HTTP/TCP/gRPC), TLS not expected"
        },
        {
          "port": 8443,
          "protocol": "tcp",
          "state": "open",
          "service": "ssl/tls",
          "tls_versions": [
            "TLSv1.2",
            "TLSv1.3"
          ],
          "tls_key_exchange": {
            "forward_secrecy": {
              "supported": true,
              "ecdhe": [
                "TLS_AES_256_GCM_SHA384",
                "TLS_CHACHA20_POLY1305_SHA256",
                "ECDHE-RSA-AES256-GCM-SHA384",
                "ECDHE-RSA-CHACHA20-POLY1305",
                "TLS_AES_128_GCM_SHA256",
                "ECDHE-RSA-AES128-GCM-SHA256"
              ],
              "kems": [
                "SecP256r1MLKEM768",
                "X25519MLKEM768",
                "SecP384r1MLKEM1024"
              ]
            }
          },
          "status": "OK",
          "reason": "TLS scan successful",
          "ingress_tls_config_compliance": {
            "configured_profile": "Default",
            "version": true,
            "ciphers": false
          },
          "api_server_tls_config_compliance": {
            "configured_profile": "Default",
            "version": true,
            "ciphers": false
          },
          "kubelet_tls_config_compliance": {
            "version": false,
            "ciphers": false
          },
          "tls13_supported": true,
          "mlkem_supported": true,
          "mlkem_kems": [
            "SecP256r1MLKEM768",
            "X25519MLKEM768",
            "SecP384r1MLKEM1024"
          ],
          "all_kems": [
            "SecP256r1MLKEM768",
            "X25519MLKEM768",
            "SecP384r1MLKEM1024"
          ],
          "tls_readiness": {
            "tls13_offered": true,
            "tls12_only": false,
            "pqc_capable": true,
            "mlkem_kems": [
              "SecP256r1MLKEM768",
              "X25519MLKEM768",
              "SecP384r1MLKEM1024"
            ],
            "all_kems": [
              "SecP256r1MLKEM768",
              "X25519MLKEM768",
              "SecP384r1MLKEM1024"
            ],
            "notes": "Endpoint offers TLS 1.3 and ML-KEM — ready for Modern profile"
          }
        },
        {
          "port": 9443,
          "protocol": "tcp",
          "state": "open",
          "service": "ssl/tls",
          "tls_versions": [
            "TLSv1.2",
            "TLSv1.3"
          ],
          "tls_key_exchange": {
            "forward_secrecy": {
              "supported": true,
              "ecdhe": [
                "TLS_AES_256_GCM_SHA384",
                "TLS_CHACHA20_POLY1305_SHA256",
                "ECDHE-RSA-AES256-GCM-SHA384",
                "ECDHE-RSA-CHACHA20-POLY1305",
                "TLS_AES_128_GCM_SHA256",
                "ECDHE-RSA-AES128-GCM-SHA256"
              ],
              "kems": [
                "SecP256r1MLKEM768",
                "X25519MLKEM768",
                "SecP384r1MLKEM1024"
              ]
            }
          },
          "status": "OK",
          "reason": "TLS scan successful",
          "ingress_tls_config_compliance": {
            "configured_profile": "Default",
            "version": true,
            "ciphers": false
          },
          "api_server_tls_config_compliance": {
            "configured_profile": "Default",
            "version": true,
            "ciphers": false
          },
          "kubelet_tls_config_compliance": {
            "version": false,
            "ciphers": false
          },
          "tls13_supported": true,
          "mlkem_supported": true,
          "mlkem_kems": [
            "SecP256r1MLKEM768",
            "X25519MLKEM768",
            "SecP384r1MLKEM1024"
          ],
          "all_kems": [
            "SecP256r1MLKEM768",
            "X25519MLKEM768",
            "SecP384r1MLKEM1024"
          ],
          "tls_readiness": {
            "tls13_offered": true,
            "tls12_only": false,
            "pqc_capable": true,
            "mlkem_kems": [
              "SecP256r1MLKEM768",
              "X25519MLKEM768",
              "SecP384r1MLKEM1024"
            ],
            "all_kems": [
              "SecP256r1MLKEM768",
              "X25519MLKEM768",
              "SecP384r1MLKEM1024"
            ],
            "notes": "Endpoint offers TLS 1.3 and ML-KEM — ready for Modern profile"
          }
        }
      ],
      "openshift_component": {
        "component": "maas-controller",
        "source_location": "quay.io",
        "maintainer_component": "redhat",
        "is_bundle": false
      },
      "pod": {
        "Name": "maas-controller-7c9fb575f4-whbfb",
        "Namespace": "opendatahub",
        "Image": "quay.io/opendatahub/maas-controller@sha256:9cff422470642d0aa4474c1f8d86e25af7be12d3f0207d1a0545134ef35ddaeb",
        "IPs": [
          "10.133.0.28"
        ],
        "Containers": [
          "manager"
        ]
      }
    },
    {
      "ip": "10.132.0.50",
      "status": "scanned",
      "open_ports": [
        8443,
        9090
      ],
      "port_results": [
        {
          "port": 8443,
          "protocol": "tcp",
          "state": "open",
          "service": "ssl/tls",
          "tls_versions": [
            "TLSv1.2",
            "TLSv1.3"
          ],
          "tls_key_exchange": {
            "forward_secrecy": {
              "supported": true,
              "ecdhe": [
                "TLS_AES_256_GCM_SHA384",
                "TLS_CHACHA20_POLY1305_SHA256",
                "ECDHE-RSA-AES256-GCM-SHA384",
                "ECDHE-RSA-CHACHA20-POLY1305",
                "TLS_AES_128_GCM_SHA256",
                "ECDHE-RSA-AES128-GCM-SHA256"
              ],
              "kems": [
                "SecP256r1MLKEM768",
                "X25519MLKEM768",
                "SecP384r1MLKEM1024"
              ]
            }
          },
          "status": "OK",
          "reason": "TLS scan successful",
          "ingress_tls_config_compliance": {
            "configured_profile": "Default",
            "version": true,
            "ciphers": false
          },
          "api_server_tls_config_compliance": {
            "configured_profile": "Default",
            "version": true,
            "ciphers": false
          },
          "kubelet_tls_config_compliance": {
            "version": false,
            "ciphers": false
          },
          "tls13_supported": true,
          "mlkem_supported": true,
          "mlkem_kems": [
            "SecP256r1MLKEM768",
            "X25519MLKEM768",
            "SecP384r1MLKEM1024"
          ],
          "all_kems": [
            "SecP256r1MLKEM768",
            "X25519MLKEM768",
            "SecP384r1MLKEM1024"
          ],
          "tls_readiness": {
            "tls13_offered": true,
            "tls12_only": false,
            "pqc_capable": true,
            "mlkem_kems": [
              "SecP256r1MLKEM768",
              "X25519MLKEM768",
              "SecP384r1MLKEM1024"
            ],
            "all_kems": [
              "SecP256r1MLKEM768",
              "X25519MLKEM768",
              "SecP384r1MLKEM1024"
            ],
            "notes": "Endpoint offers TLS 1.3 and ML-KEM — ready for Modern profile"
          }
        },
        {
          "port": 9090,
          "protocol": "tcp",
          "state": "open",
          "service": "ssl/tls",
          "status": "NO_TLS",
          "reason": "Port open but no TLS detected",
          "tls_readiness": {
            "tls13_offered": false,
            "tls12_only": false,
            "pqc_capable": false,
            "notes": "No TLS versions detected"
          }
        }
      ],
      "openshift_component": {
        "component": "maas-api",
        "source_location": "quay.io",
        "maintainer_component": "redhat",
        "is_bundle": false
      },
      "pod": {
        "Name": "maas-api-86d899c578-k57wv",
        "Namespace": "odh-ai-gateway-infra",
        "Image": "quay.io/opendatahub/maas-api@sha256:aaf1633a27828352e2663d062c97760798fdb0f2eb3011466f2bc659d2755090",
        "IPs": [
          "10.132.0.50"
        ],
        "Containers": [
          "maas-api"
        ]
      }
    }
  ],
  "tls_security_config": {
    "ingress_controller": {
      "type": "Default",
      "min_tls_version": "VersionTLS12",
      "ciphers": [
        "TLS_AES_128_GCM_SHA256",
        "TLS_AES_256_GCM_SHA384",
        "TLS_CHACHA20_POLY1305_SHA256",
        "ECDHE-ECDSA-AES128-GCM-SHA256",
        "ECDHE-RSA-AES128-GCM-SHA256",
        "ECDHE-ECDSA-AES256-GCM-SHA384",
        "ECDHE-RSA-AES256-GCM-SHA384",
        "ECDHE-ECDSA-CHACHA20-POLY1305",
        "ECDHE-RSA-CHACHA20-POLY1305",
        "DHE-RSA-AES128-GCM-SHA256",
        "DHE-RSA-AES256-GCM-SHA384"
      ]
    },
    "api_server": {
      "type": "Default",
      "min_tls_version": "VersionTLS12",
      "ciphers": [
        "TLS_AES_128_GCM_SHA256",
        "TLS_AES_256_GCM_SHA384",
        "TLS_CHACHA20_POLY1305_SHA256",
        "ECDHE-ECDSA-AES128-GCM-SHA256",
        "ECDHE-RSA-AES128-GCM-SHA256",
        "ECDHE-ECDSA-AES256-GCM-SHA384",
        "ECDHE-RSA-AES256-GCM-SHA384",
        "ECDHE-ECDSA-CHACHA20-POLY1305",
        "ECDHE-RSA-CHACHA20-POLY1305",
        "DHE-RSA-AES128-GCM-SHA256",
        "DHE-RSA-AES256-GCM-SHA384"
      ]
    }
  }
}