DevFW-CICD/ingress-nginx-helm
14
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge pull request #5491 from praseodym/fix-tls-configuration

Browse source 
Actually enable TLSv1.3 by default
This commit is contained in:
Kubernetes Prow Robot 2020-05-09 06:03:51 -07:00 committed by GitHub
commit bef2efc4f3
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 9 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
docs/user-guide/nginx-configuration/configmap.md
View file

@ -516,9 +516,11 @@ Please check the result of the configuration using `https://ssllabs.com/ssltest/
## ssl-early-data ## ssl-early-data
Enables or disables TLS 1.3 [early data](https://tools.ietf.org/html/rfc8446#section-2.3) Enables or disables TLS 1.3 [early data](https://tools.ietf.org/html/rfc8446#section-2.3), also known as Zero Round Trip
Time Resumption (0-RTT).
This requires `ssl-protocols` to have `TLSv1.3` enabled. This requires `ssl-protocols` to have `TLSv1.3` enabled. Enable this with caution, because requests sent within early
data are subject to [replay attacks](https://tools.ietf.org/html/rfc8470).
[ssl_early_data](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data). The default is: `false`. [ssl_early_data](http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data). The default is: `false`.

2
internal/ingress/controller/config/config.go
View file

@ -70,7 +70,7 @@ const (
// SSL enabled protocols to use // SSL enabled protocols to use
// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols // http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_protocols
sslProtocols = "TLSv1.2" sslProtocols = "TLSv1.2 TLSv1.3"
// Disable TLS 1.3 early data // Disable TLS 1.3 early data
// http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data // http://nginx.org/en/docs/http/ngx_http_ssl_module.html#ssl_early_data

5
test/e2e/settings/tls.go
View file

@ -64,7 +64,10 @@ var _ = framework.DescribeSetting("[SSL] TLS protocols, ciphers and headers)", f
}) })
ginkgo.It("setting cipher suite", func() { ginkgo.It("setting cipher suite", func() {
f.UpdateNginxConfigMapData(sslCiphers, testCiphers) f.SetNginxConfigMapData(map[string]string{
sslCiphers: testCiphers,
sslProtocols: "TLSv1.2",
})
f.WaitForNginxConfiguration( f.WaitForNginxConfiguration(
func(cfg string) bool { func(cfg string) bool {