Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

LOG-3398: Apply TLSSecurityProfile settings to TLS listeners in log collectors #129

Merged
merged 1 commit into from
Feb 23, 2023

Conversation

syedriko
Copy link

@syedriko syedriko commented Dec 9, 2022

This PR adds two new optional TLS parameters 

  • min_tls_version: an enum of "VersionTLS10", "VersionTLS11", "VersionTLS12", "VersionTLS13". If set to anything else, defaults to "VersionTLS10".
  • ciphersuites: a comma-separated list of ciphersuites for TLS 1.2 and lower, in OpenSSL nomenclature.
    For TLS 1.3, the ciphersuites are hardcoded to "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256".

These new parameters apply to all TLS configuration objects in Vector, such as https://vector.dev/docs/reference/configuration/sources/socket/#tls, https://vector.dev/docs/reference/configuration/sources/prometheus_scrape/#tls, etc.

If either of the new settings is missing, Vector defaults to the prior behavior and uses Mozilla Intermediate V5 settings (https://wiki.mozilla.org/Security/Server_Side_TLS).

JIRA: https://issues.redhat.com/browse/LOG-3398

@openshift-ci openshift-ci bot requested review from cahartma and jcantrill December 9, 2022 01:36
@openshift-ci
Copy link

openshift-ci bot commented Dec 9, 2022

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: syedriko
Once this PR has been reviewed and has the lgtm label, please assign vimalk78 for approval by writing /assign @vimalk78 in a comment. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@syedriko
Copy link
Author

/test clo-functional-5-6
/test cluster-logging-operator-e2e-5-6

@syedriko
Copy link
Author

/test clo-functional-5-6

1 similar comment
@syedriko
Copy link
Author

/test clo-functional-5-6

@syedriko
Copy link
Author

/retest

@syedriko
Copy link
Author

syedriko commented Feb 9, 2023

/test clo-functional-5-6
/test cluster-logging-operator-e2e-5-6

1 similar comment
@syedriko
Copy link
Author

/test clo-functional-5-6
/test cluster-logging-operator-e2e-5-6

@syedriko
Copy link
Author

/test cluster-logging-operator-e2e-5-6

1 similar comment
@syedriko
Copy link
Author

/test cluster-logging-operator-e2e-5-6

@syedriko syedriko merged commit c52c09e into ViaQ:v0.21-rh Feb 23, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant