TLS1.3 support #1364
TLS1.3 support #1364
Conversation
sanchezl
commented
Oct 31, 2024
sanchezl
commented
- bump library-go
- use new NewStaticPodOperatorClient signature
- add ETCD_TLS_MIN_VERSION env to etcd pods
- add listen-tls-min-version flag to readyz cmd
- do not start etcd with --cipher-suites with tls1.3
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: sanchezl The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
| var tlsMinVersion uint16 | ||
| switch r.tlsMinVersion { | ||
| case "TLS1.3": | ||
| tlsMinVersion = tls.VersionTLS13 | ||
| case "TLS1.2": | ||
| tlsMinVersion = tls.VersionTLS12 | ||
| } |
There was a problem hiding this comment.
feel free to use "go.etcd.io/etcd/client/pkg/v3/tlsutil" here too
| @@ -304,6 +308,33 @@ func getCipherSuites(envVarContext envVarContext) (map[string]string, error) { | |||
| }, nil | |||
| } | |||
|
|
|||
| func getTLSMinVersion(envVarContext envVarContext) (map[string]string, error) { | |||
There was a problem hiding this comment.
given your extraordinary gotpl skills, I'm wondering whether we should just check this inside of the cipher suite function above in conjunction.
That way we can enable/disable the suites depending on the TLS version. I'm mostly curious about how we can surface this back to a user somehow. I know some (especially FIPS) customers run compliance scanners that will alert them on not setting those ciphers.
| @@ -173,7 +174,7 @@ func RunOperator(ctx context.Context, controllerContext *controllercmd.Controlle | |||
| // we keep the default behavior of exiting the controller once a gate changes | |||
| featureGateAccessor.SetChangeHandler(featuregates.ForceExit) | |||
|
|
|||
| operatorClient, dynamicInformers, err := genericoperatorclient.NewStaticPodOperatorClient(controllerContext.KubeConfig, operatorv1.GroupVersion.WithResource("etcds"), operatorv1.GroupVersion.WithKind("Etcd"), ExtractStaticPodOperatorSpec, ExtractStaticPodOperatorStatus) | |||
| operatorClient, dynamicInformers, err := genericoperatorclient.NewStaticPodOperatorClient(clock.RealClock{}, controllerContext.KubeConfig, operatorv1.GroupVersion.WithResource("etcds"), operatorv1.GroupVersion.WithKind("Etcd"), ExtractStaticPodOperatorSpec, ExtractStaticPodOperatorStatus) | |||
There was a problem hiding this comment.
do you mind to split out the library-go update into a separate PR? we can merge that earlier, I see there is a bunch of static pod changes there too, which we might want to separate out - just in case they mess up CI somehow.
There was a problem hiding this comment.
oh you already got #1365 - resolved :) thanks!
