Skip to content

Commit

Permalink
Adds TLS options to managers
Browse files Browse the repository at this point in the history 
This patch introduces two new flags to configure TLS options on the
managers:
1. --tls-min-version which is used to set the minimum TLS version in use
   by the webhook server.
2. --tls-cipher-suites which is used to set the TLS cipher suites in use
   by the webhook server.

The minimum TLS version defaults to 1.2

Signed-off-by: Sagar Muchhal <muchhals@vmware.com>
  • Loading branch information
@srm09
srm09 committed Nov 2, 2022
1 parent e70fef8 commit d152b92
Show file tree
Hide file tree
Showing 3 changed files with 117 additions and 0 deletions.
39 changes: 39 additions & 0 deletions bootstrap/kubeadm/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,14 @@ package main

import (
"context"
"crypto/tls"
"flag"
"fmt"
"math/rand"
"net/http"
_ "net/http/pprof"
"os"
"strings"
"time"

// +kubebuilder:scaffold:imports
Expand Down Expand Up @@ -85,6 +87,8 @@ var (
webhookCertDir string
healthAddr string
tokenTTL time.Duration
tlsMinVersion string
tlsCipherSuites string
logOptions = logs.NewOptions()
)

Expand Down Expand Up @@ -135,6 +139,16 @@ func InitFlags(fs *pflag.FlagSet) {
fs.StringVar(&healthAddr, "health-addr", ":9440",
"The address the health endpoint binds to.")

flag.StringVar(&tlsMinVersion, "tls-min-version", "VersionTLS12",
"The minimum TLS version in use by the webhook server.\n"+
fmt.Sprintf("Possible values are %s.", strings.Join(cliflag.TLSPossibleVersions(), ", ")),
)

flag.StringVar(&tlsCipherSuites, "tls-cipher-suites", "",
"Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.\n"+
fmt.Sprintf("Possible values are %s.", strings.Join(cliflag.TLSCipherPossibleValues(), ", ")),
)

feature.MutableGates.AddFlag(fs)
}

Expand Down Expand Up @@ -193,6 +207,7 @@ func main() {
ctx := ctrl.SetupSignalHandler()

setupChecks(mgr)
setupWebhookTLSConfigs(mgr, tlsMinVersion, tlsCipherSuites)
setupWebhooks(mgr)
setupReconcilers(ctx, mgr)

Expand All @@ -216,6 +231,30 @@ func setupChecks(mgr ctrl.Manager) {
}
}

func setupWebhookTLSConfigs(mgr ctrl.Manager, tlsMinVersion, tlsCipherSuites string) {
tlsVersion, err := cliflag.TLSVersion(tlsMinVersion)
if err != nil {
setupLog.Error(err, "unable to set TLS min version")
os.Exit(1)
}
mgr.GetWebhookServer().TLSOpts = append(mgr.GetWebhookServer().TLSOpts, func(cfg *tls.Config) {
cfg.MinVersion = tlsVersion
})

if tlsCipherSuites != "" {
cipherSuites := strings.Split(tlsCipherSuites, ",")
suites, err := cliflag.TLSCipherSuites(cipherSuites)
if err != nil {
setupLog.Error(err, "unable to set TLS Cipher suites")
os.Exit(1)
}

mgr.GetWebhookServer().TLSOpts = append(mgr.GetWebhookServer().TLSOpts, func(cfg *tls.Config) {
cfg.CipherSuites = suites
})
}
}

func setupReconcilers(ctx context.Context, mgr ctrl.Manager) {
if err := (&kubeadmbootstrapcontrollers.KubeadmConfigReconciler{
Client: mgr.GetClient(),
Expand Down
39 changes: 39 additions & 0 deletions controlplane/kubeadm/main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,14 @@ package main

import (
"context"
"crypto/tls"
"flag"
"fmt"
"math/rand"
"net/http"
_ "net/http/pprof"
"os"
"strings"
"time"

// +kubebuilder:scaffold:imports
Expand Down Expand Up @@ -89,6 +91,8 @@ var (
webhookCertDir string
healthAddr string
etcdDialTimeout time.Duration
tlsMinVersion string
tlsCipherSuites string
logOptions = logs.NewOptions()
)

Expand Down Expand Up @@ -139,6 +143,16 @@ func InitFlags(fs *pflag.FlagSet) {
fs.DurationVar(&etcdDialTimeout, "etcd-dial-timeout-duration", 10*time.Second,
"Duration that the etcd client waits at most to establish a connection with etcd")

flag.StringVar(&tlsMinVersion, "tls-min-version", "VersionTLS12",
"The minimum TLS version in use by the webhook server.\n"+
fmt.Sprintf("Possible values are %s.", strings.Join(cliflag.TLSPossibleVersions(), ", ")),
)

flag.StringVar(&tlsCipherSuites, "tls-cipher-suites", "",
"Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.\n"+
fmt.Sprintf("Possible values are %s.", strings.Join(cliflag.TLSCipherPossibleValues(), ", ")),
)

feature.MutableGates.AddFlag(fs)
}
func main() {
Expand Down Expand Up @@ -197,6 +211,7 @@ func main() {
ctx := ctrl.SetupSignalHandler()

setupChecks(mgr)
setupWebhookTLSConfigs(mgr, tlsMinVersion, tlsCipherSuites)
setupReconcilers(ctx, mgr)
setupWebhooks(mgr)

Expand All @@ -220,6 +235,30 @@ func setupChecks(mgr ctrl.Manager) {
}
}

func setupWebhookTLSConfigs(mgr ctrl.Manager, tlsMinVersion, tlsCipherSuites string) {
tlsVersion, err := cliflag.TLSVersion(tlsMinVersion)
if err != nil {
setupLog.Error(err, "unable to set TLS min version")
os.Exit(1)
}
mgr.GetWebhookServer().TLSOpts = append(mgr.GetWebhookServer().TLSOpts, func(cfg *tls.Config) {
cfg.MinVersion = tlsVersion
})

if tlsCipherSuites != "" {
cipherSuites := strings.Split(tlsCipherSuites, ",")
suites, err := cliflag.TLSCipherSuites(cipherSuites)
if err != nil {
setupLog.Error(err, "unable to set TLS Cipher suites")
os.Exit(1)
}

mgr.GetWebhookServer().TLSOpts = append(mgr.GetWebhookServer().TLSOpts, func(cfg *tls.Config) {
cfg.CipherSuites = suites
})
}
}

func setupReconcilers(ctx context.Context, mgr ctrl.Manager) {
// Set up a ClusterCacheTracker to provide to controllers
// requiring a connection to a remote cluster
Expand Down
39 changes: 39 additions & 0 deletions main.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,14 @@ package main

import (
"context"
"crypto/tls"
"flag"
"fmt"
"math/rand"
"net/http"
_ "net/http/pprof"
"os"
"strings"
"time"

// +kubebuilder:scaffold:imports
Expand Down Expand Up @@ -99,6 +101,8 @@ var (
webhookPort int
webhookCertDir string
healthAddr string
tlsMinVersion string
tlsCipherSuites string
logOptions = logs.NewOptions()
)

Expand Down Expand Up @@ -198,6 +202,16 @@ func InitFlags(fs *pflag.FlagSet) {
fs.StringVar(&healthAddr, "health-addr", ":9440",
"The address the health endpoint binds to.")

flag.StringVar(&tlsMinVersion, "tls-min-version", "VersionTLS12",
"The minimum TLS version in use by the webhook server.\n"+
fmt.Sprintf("Possible values are %s.", strings.Join(cliflag.TLSPossibleVersions(), ", ")),
)

flag.StringVar(&tlsCipherSuites, "tls-cipher-suites", "",
"Comma-separated list of cipher suites for the server. If omitted, the default Go cipher suites will be used.\n"+
fmt.Sprintf("Possible values are %s.", strings.Join(cliflag.TLSCipherPossibleValues(), ", ")),
)

feature.MutableGates.AddFlag(fs)
}

Expand Down Expand Up @@ -269,6 +283,7 @@ func main() {

setupChecks(mgr)
setupIndexes(ctx, mgr)
setupWebhookTLSConfigs(mgr, tlsMinVersion, tlsCipherSuites)
setupReconcilers(ctx, mgr)
setupWebhooks(mgr)

Expand Down Expand Up @@ -299,6 +314,30 @@ func setupIndexes(ctx context.Context, mgr ctrl.Manager) {
}
}

func setupWebhookTLSConfigs(mgr ctrl.Manager, tlsMinVersion, tlsCipherSuites string) {
tlsVersion, err := cliflag.TLSVersion(tlsMinVersion)
if err != nil {
setupLog.Error(err, "unable to set TLS min version")
os.Exit(1)
}
mgr.GetWebhookServer().TLSOpts = append(mgr.GetWebhookServer().TLSOpts, func(cfg *tls.Config) {
cfg.MinVersion = tlsVersion
})

if tlsCipherSuites != "" {
cipherSuites := strings.Split(tlsCipherSuites, ",")
suites, err := cliflag.TLSCipherSuites(cipherSuites)
if err != nil {
setupLog.Error(err, "unable to set TLS Cipher suites")
os.Exit(1)
}

mgr.GetWebhookServer().TLSOpts = append(mgr.GetWebhookServer().TLSOpts, func(cfg *tls.Config) {
cfg.CipherSuites = suites
})
}
}

func setupReconcilers(ctx context.Context, mgr ctrl.Manager) {
// Set up a ClusterCacheTracker and ClusterCacheReconciler to provide to controllers
// requiring a connection to a remote cluster
Expand Down

0 comments on commit d152b92

Please sign in to comment.