Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

TLS minimum version for tag to digest defaults to 1.2 again and is configurable #13962

Merged
merged 1 commit into from
May 8, 2023
Merged

TLS minimum version for tag to digest defaults to 1.2 again and is configurable #13962

merged 1 commit into from
May 8, 2023

Conversation

dprotaso
Copy link
Member

@dprotaso dprotaso commented May 8, 2023 •
edited
Loading

Fixes #13937

quay.io (Red Hat's hosted registry) only support TLS 1.2

Proposed Changes

  • For tag to digest revert TLS min version to 1.2
  • It can be configured higher using the controller env var TAG_TO_DIGEST_TLS_MIN_VERSION
  • Valid env var values are "1.2" and "1.3"

Release Note

Tag to digest min TLS version is 1.2 and can be configured higher using the controller environment variable `TAG_TO_DIGEST_TLS_MIN_VERSION` and supports values `"1.2"` and `"1.3"`

@knative-prow knative-prow bot requested review from carlisia and izabelacg May 8, 2023 14:45
@knative-prow knative-prow bot added area/API API objects and controllers size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels May 8, 2023
@knative-prow
Copy link

knative-prow bot commented May 8, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dprotaso

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@knative-prow knative-prow bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 8, 2023
@dprotaso dprotaso mentioned this pull request May 8, 2023
Closed
@dprotaso
Copy link
Member Author

dprotaso commented May 8, 2023

/cherry-pick release-1.10

@knative-prow-robot
Copy link
Contributor

@dprotaso: once the present PR merges, I will cherry-pick it on top of release-1.10 in a new PR and assign it to you.

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@dprotaso dprotaso changed the title Min TLS for tag to digest defaults to 1.2 again and is configurable TLS minimum version for tag to digest defaults to 1.2 again and is configurable May 8, 2023
@codecov
Copy link

codecov bot commented May 8, 2023 •
edited
Loading

Codecov Report

Patch coverage: 81.81% and project coverage change: -0.01 ⚠️

Comparison is base (50a9f22) 86.21% compared to head (2445d68) 86.21%.

Additional details and impacted files 
@@            Coverage Diff             @@
##             main   #13962      +/-   ##
==========================================
- Coverage   86.21%   86.21%   -0.01%     
==========================================
  Files         199      199              
  Lines       14749    14759      +10     
==========================================
+ Hits        12716    12724       +8     
- Misses       1731     1733       +2     
  Partials      302      302
Impacted Files Coverage Δ
pkg/reconciler/revision/resolve.go 78.00% <81.81%> (+0.50%) ⬆️

... and 4 files with indirect coverage changes

☔ View full report in Codecov by Sentry.
📢 Do you have feedback about the report comment? Let us know in this issue.

KauzClay
KauzClay reviewed May 8, 2023
View reviewed changes
pkg/reconciler/revision/resolve.go
@@ -42,6 +42,8 @@ const (
// Kubernetes CA certificate bundle is mounted into the pod here, see:
// https://kubernetes.io/docs/tasks/tls/managing-tls-in-a-cluster/#trusting-tls-in-a-cluster
k8sCertPath = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"

tlsMinVersionEnvKey = "TAG_TO_DIGEST_TLS_MIN_VERSION"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What do you think of adding a comment here mentioning where this can be set?

@KauzClay
Copy link
Contributor

KauzClay commented May 8, 2023

/lgtm

@knative-prow knative-prow bot added the lgtm Indicates that a PR is ready to be merged. label May 8, 2023
@knative-prow knative-prow bot merged commit 2fa05bd into knative:main May 8, 2023
@knative-prow-robot knative-prow-robot mentioned this pull request May 8, 2023
Merged
@knative-prow-robot
Copy link
Contributor

@dprotaso: new pull request created: #13963

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@dprotaso dprotaso deleted the tag-to-digest-min-tls branch May 8, 2023 17:20
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@KauzClay KauzClay KauzClay left review comments

@carlisia carlisia Awaiting requested review from carlisia

@izabelacg izabelacg Awaiting requested review from izabelacg

Assignees

@KauzClay KauzClay

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/API API objects and controllers lgtm Indicates that a PR is ready to be merged. size/L Denotes a PR that changes 100-499 lines, ignoring generated files.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

v1.10.0 tls: server selected unsupported protocol version 303.
3 participants
@dprotaso @knative-prow-robot @KauzClay