Skip to content

add configurable TLS min version and cipher suite support #485

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
thejasn wants to merge 9 commits into
base: osc-release
Choose a base branch
from
Draft

add configurable TLS min version and cipher suite support #485

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
593479c
probe: bind startup probe server to localhost
thejasn Jun 2, 2026
74a8e02
tlsutil: promote k8s.io/component-base to direct dependency
thejasn Jun 2, 2026
6cfe63b
tlsutil: add tlsconfig package for TLS option parsing
thejasn Jun 2, 2026
23fe09a
tlsutil: support dynamic TLS version and cipher suite configuration
thejasn Jun 2, 2026
bb493a6
forwarder: add MinTLSVersion and CipherSuites to APF user-data config
thejasn Jun 2, 2026
6959721
adaptor: write MinTLSVersion and CipherSuites into peer pod user-data
thejasn Jun 2, 2026
5305a8f
cmd: add TLS min version and cipher suite flags
thejasn Jun 2, 2026
e86a740
webhook: honour TLS_MIN_VERSION and TLS_CIPHER_SUITES env vars
thejasn Jun 2, 2026
a45adf5
charts: add TLS min version and cipher suite configuration
thejasn Jun 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
23 changes: 20 additions & 3 deletions src/cloud-api-adaptor/cmd/cloud-api-adaptor/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,8 +82,9 @@ func (cfg *daemonConfig) Setup() (cmd.Starter, error) {
}

var (
disableTLS bool
tlsConfig tlsutil.TLSConfig
disableTLS bool
tlsConfig tlsutil.TLSConfig
tlsCipherSuites string
)

cmd.Parse(programName, os.Args[1:], func(flags *flag.FlagSet) {
Expand All @@ -105,6 +106,8 @@ func (cfg *daemonConfig) Setup() (cmd.Starter, error) {
reg.StringWithEnv(&tlsConfig.CertFile, "cert-file", "", "CERT_FILE", "Client certificate file for custom TLS (e.g. /etc/certificates/client.crt)")
reg.StringWithEnv(&tlsConfig.KeyFile, "cert-key", "", "CERT_KEY", "Client key file for custom TLS (e.g. /etc/certificates/client.key)")
reg.BoolWithEnv(&tlsConfig.SkipVerify, "tls-skip-verify", false, "TLS_SKIP_VERIFY", "Skip TLS certificate verification - use it only for testing")
reg.StringWithEnv(&tlsConfig.MinTLSVersion, "tls-min-version", "", "TLS_MIN_VERSION", "Minimum TLS version for peer pod connections (VersionTLS12 or VersionTLS13)")
reg.StringWithEnv(&tlsCipherSuites, "tls-cipher-suites", "", "TLS_CIPHER_SUITES", "Comma-separated IANA TLS cipher suite names for peer pod connections (not applicable for VersionTLS13)")
reg.DurationWithEnv(&cfg.serverConfig.ProxyTimeout, "proxy-timeout", proxy.DefaultProxyTimeout, "PROXY_TIMEOUT", "Maximum timeout in minutes for establishing agent proxy connection")
reg.StringWithEnv(&cfg.networkConfig.TunnelType, "tunnel-type", podnetwork.DefaultTunnelType, "TUNNEL_TYPE", "Tunnel provider")
reg.IntWithEnv(&cfg.networkConfig.VXLAN.Port, "vxlan-port", vxlan.DefaultVXLANPort, "VXLAN_PORT", "VXLAN UDP port number (VXLAN tunnel mode only")
Expand All @@ -127,8 +130,22 @@ func (cfg *daemonConfig) Setup() (cmd.Starter, error) {

fmt.Printf("%s: starting Cloud API Adaptor daemon for %q\n", programName, cloudName)

if !disableTLS {
if tlsCipherSuites != "" {
tlsConfig.CipherSuites = strings.Split(tlsCipherSuites, ",")
}

if disableTLS {
fmt.Printf("%s: WARNING: TLS disabled (--disable-tls). Use only for testing.\n", programName)
} else {
cfg.serverConfig.TLSConfig = &tlsConfig

if tlsConfig.SkipVerify {
fmt.Printf("%s: WARNING: TLS certificate verification disabled (--tls-skip-verify). Use only for testing.\n", programName)
}

if tlsConfig.MinTLSVersion != "" || len(tlsConfig.CipherSuites) > 0 {
fmt.Printf("%s: WARNING: TLS profile (TLS_MIN_VERSION=%s, TLS_CIPHER_SUITES=%s) is baked into peer pod VMs at creation time via user-data. Existing peer pods will not pick up profile changes until deleted and recreated.\n", programName, tlsConfig.MinTLSVersion, tlsCipherSuites)
}
}

// DEPRECATED: LoadEnv() is now a no-op for all providers.
Expand Down
37 changes: 20 additions & 17 deletions src/cloud-api-adaptor/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,15 +50,15 @@ require (
github.com/moby/sys/mountinfo v0.7.2
github.com/pelletier/go-toml/v2 v2.1.0
github.com/sirupsen/logrus v1.9.3
github.com/spf13/cobra v1.7.0
github.com/spf13/cobra v1.10.0
golang.org/x/crypto v0.48.0 // indirect
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f
google.golang.org/api v0.256.0
google.golang.org/protobuf v1.36.11
k8s.io/api v0.29.0
k8s.io/apimachinery v0.33.0
k8s.io/client-go v0.29.0
k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
k8s.io/api v0.35.0
k8s.io/apimachinery v0.35.0
k8s.io/client-go v0.35.0
k8s.io/utils v0.0.0-20251002143259-bc988d571ff4
sigs.k8s.io/e2e-framework v0.1.0
sigs.k8s.io/kustomize v2.0.3+incompatible
sigs.k8s.io/kustomize/api v0.16.0
Expand All @@ -75,6 +75,11 @@ require (
github.com/fenglyu/go-dmidecode v0.0.0-20220417074508-03f52eb45fe9
)

require (
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
)

require (
cloud.google.com/go v0.123.0 // indirect
cloud.google.com/go/auth v0.17.0 // indirect
Expand Down Expand Up @@ -136,12 +141,11 @@ require (
github.com/docker/go-connections v0.5.0 // indirect
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.9.0 // indirect
github.com/fxamacker/cbor/v2 v2.7.0 // indirect
github.com/fxamacker/cbor/v2 v2.9.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.11 // indirect
github.com/ghodss/yaml v1.0.0 // indirect
github.com/go-errors/errors v1.4.2 // indirect
Expand All @@ -163,14 +167,13 @@ require (
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/gnostic-models v0.6.9 // indirect
github.com/google/gnostic-models v0.7.0 // indirect
github.com/google/go-cmp v0.7.0 // indirect
github.com/google/s2a-go v0.1.9 // indirect
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
github.com/googleapis/enterprise-certificate-proxy v0.3.7 // indirect
github.com/googleapis/gax-go/v2 v2.15.0 // indirect
github.com/gorilla/websocket v1.5.0 // indirect
github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
github.com/imdario/mergo v0.3.13 // indirect
Expand All @@ -194,7 +197,7 @@ require (
github.com/moby/sys/userns v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
Expand All @@ -209,7 +212,7 @@ require (
github.com/pkg/sftp v1.13.9 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/sergi/go-diff v1.2.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/spf13/pflag v1.0.9 // indirect
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
github.com/tjfoc/gmsm v1.4.1 // indirect
github.com/x448/float16 v0.8.4 // indirect
Expand All @@ -224,7 +227,7 @@ require (
go.opentelemetry.io/otel/trace v1.37.0 // indirect
go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/mod v0.33.0 // indirect
golang.org/x/net v0.51.0 // indirect
golang.org/x/oauth2 v0.33.0 // indirect
Expand All @@ -240,12 +243,12 @@ require (
gopkg.in/ini.v1 v1.67.0 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
gotest.tools/v3 v3.5.2 // indirect
k8s.io/component-base v0.35.0
k8s.io/klog/v2 v2.130.1 // indirect
k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
sigs.k8s.io/controller-runtime v0.14.1 // indirect
sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
sigs.k8s.io/randfill v1.0.0 // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
tags.cncf.io/container-device-interface v1.0.1 // indirect
tags.cncf.io/container-device-interface/specs-go v1.0.0 // indirect
Expand Down
Loading