Skip to content

Commit 457d553

Browse files
dilyar85dilyar85
authored
Update servers TLS config to use approved cipher suites (vmware-tanzu#68)
This patch updates the controller-manager webhook and kube-rbac-proxy servers to use the approved TLS cipher suites. It upgrades the controller-runtime package to [v0.12.2](https://github.com/kubernetes-sigs/controller-runtime/releases/tag/v0.12.2) (along with its dependent packages), which supports TLS configuration on the webhook server. The TLS min version set has been moved under that same func as the `server.TLSMinVersion` is now [deprecated](https://github.com/kubernetes-sigs/controller-runtime/blob/main/pkg/webhook/server.go#L74). Testing Done: - Internal fast kind-based e2e tests - Manually deployed this patch to a WCP testbed and verified the cipher suites using [sslscan](https://github.com/rbsec/sslscan) ```console $ kubectl get pod -n vmware-system-vmop -o wide NAME READY STATUS RESTARTS AGE IP vmware-system-vmop-controller-manager-66fddb8fb-6g6jl 2/2 Running 0 5m10s 192.168.128.0 vmware-system-vmop-controller-manager-66fddb8fb-tm4sh 2/2 Running 0 5m13s 192.168.128.1 vmware-system-vmop-web-console-validator-55bdcbfc44-wfpkh 1/1 Running 0 5m14s 192.168.128.1 $ ./sslscan https://192.168.128.1:9848 ... Supported Server Cipher(s): Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 $ ./sslscan https://192.168.128.2:9878 ... Supported Server Cipher(s): Preferred TLSv1.3 128 bits TLS_AES_128_GCM_SHA256 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_AES_256_GCM_SHA384 Curve 25519 DHE 253 Accepted TLSv1.3 256 bits TLS_CHACHA20_POLY1305_SHA256 Curve 25519 DHE 253 Preferred TLSv1.2 128 bits ECDHE-RSA-AES128-GCM-SHA256 Curve 25519 DHE 253 Accepted TLSv1.2 256 bits ECDHE-RSA-AES256-GCM-SHA384 Curve 25519 DHE 253 ```
1 parent 12ad456 commit 457d553

File tree

5 files changed

+110
-71
lines changed

5 files changed

+110
-71
lines changed

‎config/crd/bases/vmoperator.vmware.com_virtualmachines.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -312,7 +312,7 @@ spec:
312312
\n * An instance volume with a lifecycle coupled to the VM."
313313
properties:
314314
claimName:
315-
description: 'ClaimName is the name of a PersistentVolumeClaim
315+
description: 'claimName is the name of a PersistentVolumeClaim
316316
in the same namespace as the pod using this volume. More
317317
info: https://kubernetes.io/docs/concepts/storage/persistent-volumes#persistentvolumeclaims'
318318
type: string
@@ -338,8 +338,8 @@ spec:
338338
- storageClass
339339
type: object
340340
readOnly:
341-
description: Will force the ReadOnly setting in VolumeMounts.
342-
Default false.
341+
description: readOnly Will force the ReadOnly setting in
342+
VolumeMounts. Default false.
343343
type: boolean
344344
required:
345345
- claimName

‎config/default/manager_auth_proxy_patch.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ spec:
1717
args:
1818
- "--secure-listen-address=0.0.0.0:8443"
1919
- "--upstream=http://127.0.0.1:8080/"
20+
- "--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
2021
- "--logtostderr=true"
2122
- "--v=10"
2223
ports:

‎go.mod

Lines changed: 22 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ require (
1515
github.com/google/go-cmp v0.5.8
1616
github.com/google/uuid v1.3.0
1717
github.com/onsi/ginkgo v1.16.5
18-
github.com/onsi/gomega v1.17.0
18+
github.com/onsi/gomega v1.18.1
1919
github.com/pkg/errors v0.9.1
2020
github.com/prometheus/client_golang v1.14.0
2121
github.com/vmware-tanzu/vm-operator/api v0.0.0-00010101000000-000000000000
@@ -26,34 +26,43 @@ require (
2626
gomodules.xyz/jsonpatch/v2 v2.2.0
2727
google.golang.org/grpc v1.40.0
2828
gopkg.in/yaml.v2 v2.4.0
29-
k8s.io/api v0.23.5
30-
k8s.io/apiextensions-apiserver v0.23.5
31-
k8s.io/apimachinery v0.23.5
32-
k8s.io/client-go v0.23.5
33-
k8s.io/klog/v2 v2.30.0
34-
k8s.io/utils v0.0.0-20211116205334-6203023598ed
35-
sigs.k8s.io/controller-runtime v0.11.2
29+
k8s.io/api v0.24.2
30+
k8s.io/apiextensions-apiserver v0.24.2
31+
k8s.io/apimachinery v0.24.2
32+
k8s.io/client-go v0.24.2
33+
k8s.io/klog/v2 v2.60.1
34+
k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9
35+
sigs.k8s.io/controller-runtime v0.12.2
3636
sigs.k8s.io/yaml v1.3.0
3737
)
3838

3939
require (
4040
cloud.google.com/go v0.81.0 // indirect
41+
github.com/PuerkitoBio/purell v1.1.1 // indirect
42+
github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 // indirect
4143
github.com/beorn7/perks v1.0.1 // indirect
4244
github.com/cespare/xxhash/v2 v2.1.2 // indirect
4345
github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403 // indirect
46+
github.com/emicklei/go-restful v2.9.5+incompatible // indirect
4447
github.com/envoyproxy/protoc-gen-validate v0.1.0 // indirect
4548
github.com/evanphx/json-patch v4.12.0+incompatible // indirect
4649
github.com/fsnotify/fsnotify v1.5.1 // indirect
50+
github.com/go-openapi/jsonpointer v0.19.5 // indirect
51+
github.com/go-openapi/jsonreference v0.19.5 // indirect
52+
github.com/go-openapi/swag v0.19.14 // indirect
4753
github.com/gogo/protobuf v1.3.2 // indirect
4854
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
4955
github.com/golang/protobuf v1.5.2 // indirect
56+
github.com/google/gnostic v0.5.7-v3refs // indirect
5057
github.com/google/gofuzz v1.1.0 // indirect
51-
github.com/googleapis/gnostic v0.5.5 // indirect
5258
github.com/imdario/mergo v0.3.12 // indirect
59+
github.com/josharian/intern v1.0.0 // indirect
5360
github.com/json-iterator/go v1.1.12 // indirect
61+
github.com/mailru/easyjson v0.7.6 // indirect
5462
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
5563
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
5664
github.com/modern-go/reflect2 v1.0.2 // indirect
65+
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
5766
github.com/nxadm/tail v1.4.8 // indirect
5867
github.com/prometheus/client_model v0.3.0 // indirect
5968
github.com/prometheus/common v0.37.0 // indirect
@@ -65,14 +74,14 @@ require (
6574
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
6675
golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
6776
google.golang.org/appengine v1.6.7 // indirect
68-
google.golang.org/genproto v0.0.0-20210831024726-fe130286e0e2 // indirect
77+
google.golang.org/genproto v0.0.0-20220107163113-42d7afdf6368 // indirect
6978
google.golang.org/protobuf v1.28.1 // indirect
7079
gopkg.in/inf.v0 v0.9.1 // indirect
7180
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
7281
gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
73-
k8s.io/component-base v0.23.5 // indirect
74-
k8s.io/kube-openapi v0.0.0-20211115234752-e816edb12b65 // indirect
75-
sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6 // indirect
82+
k8s.io/component-base v0.24.2 // indirect
83+
k8s.io/kube-openapi v0.0.0-20220328201542-3ee0da9b0b42 // indirect
84+
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 // indirect
7685
sigs.k8s.io/structured-merge-diff/v4 v4.2.1 // indirect
7786
)
7887

0 commit comments

Comments
 (0)