diff --git a/argocd-operator/pkg/tlsprofile/profile.go b/argocd-operator/pkg/tlsprofile/profile.go index 6b83c09b2fe..e613c4ceb17 100644 --- a/argocd-operator/pkg/tlsprofile/profile.go +++ b/argocd-operator/pkg/tlsprofile/profile.go @@ -8,4 +8,6 @@ type TLSConfigProfile struct { MinVersion configv1.TLSProtocolVersion // Ciphers specifies the list of supported TLS cipher suites in cluster. Ciphers []string + // CurvePreferences specifies the list of supported TLS curve preferences in cluster. + CurvePreferences []configv1.TLSGroup } diff --git a/cmd/main.go b/cmd/main.go index a4a8a72bdce..145a3227a76 100644 --- a/cmd/main.go +++ b/cmd/main.go @@ -317,12 +317,19 @@ func main() { os.Exit(1) } + centralTLSConfigProfile := tlsprofile.TLSConfigProfile{ + DisableClusterTLSProfile: disableClusterTLSProfile, + MinVersion: profile.MinTLSVersion, + Ciphers: profile.Ciphers, + CurvePreferences: profile.Groups, + } + if util.IsOpenShiftCluster() { if err = (&controllers.ReconcileGitopsService{ Client: client, Scheme: mgr.GetScheme(), DisableDefaultInstall: strings.ToLower(os.Getenv(common.DisableDefaultInstallEnvVar)) == "true", - CentralTLSProfile: profile, + CentralTLSProfile: centralTLSConfigProfile, PluginNamespace: pluginNamespace, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "GitopsService") @@ -372,17 +379,13 @@ func main() { argocdprovisioner.Register(openshift.ReconcilerHook, openshift.BuilderHook) if err = (&argocdprovisioner.ReconcileArgoCD{ - Client: client, - Scheme: mgr.GetScheme(), - LabelSelector: labelSelectorFlag, - K8sClient: k8sClient, - LocalUsers: argocdprovisioner.NewLocalUsersInfo(), - FipsConfigChecker: argoutil.NewLinuxFipsConfigChecker(), - CentralTLSConfigProfile: tlsprofile.TLSConfigProfile{ - DisableClusterTLSProfile: disableClusterTLSProfile, - MinVersion: profile.MinTLSVersion, - Ciphers: profile.Ciphers, - }, + Client: client, + Scheme: mgr.GetScheme(), + LabelSelector: labelSelectorFlag, + K8sClient: k8sClient, + LocalUsers: argocdprovisioner.NewLocalUsersInfo(), + FipsConfigChecker: argoutil.NewLinuxFipsConfigChecker(), + CentralTLSConfigProfile: centralTLSConfigProfile, }).SetupWithManager(mgr); err != nil { setupLog.Error(err, "unable to create controller", "controller", "Argo CD") os.Exit(1) diff --git a/controllers/consoleplugin.go b/controllers/consoleplugin.go index aab97f443a0..16accd185ec 100644 --- a/controllers/consoleplugin.go +++ b/controllers/consoleplugin.go @@ -13,6 +13,7 @@ import ( argocommon "github.com/argoproj-labs/gitops-operator/argocd-operator/common" argocdutil "github.com/argoproj-labs/gitops-operator/argocd-operator/controllers/argoutil" + configv1 "github.com/openshift/api/config/v1" consolev1 "github.com/openshift/api/console/v1" pipelinesv1alpha1 "github.com/redhat-developer/gitops-operator/api/v1alpha1" "github.com/redhat-developer/gitops-operator/controllers/util" @@ -250,9 +251,43 @@ func securityContextForPlugin() *corev1.SecurityContext { } } +// allowedHttpdGroups lists TLS groups supported by OpenSSL via SSLOpenSSLConfCmd Groups. +// OpenShift TLSGroup string values are directly usable as OpenSSL group names (OpenSSL >= 3.5). +var allowedHttpdGroups = map[configv1.TLSGroup]struct{}{ + configv1.TLSGroupX25519: {}, + configv1.TLSGroupSecP256r1: {}, + configv1.TLSGroupSecP384r1: {}, + configv1.TLSGroupSecP521r1: {}, + configv1.TLSGroupX25519MLKEM768: {}, + configv1.TLSGroupSecP256r1MLKEM768: {}, + configv1.TLSGroupSecP384r1MLKEM1024: {}, +} + +// tlsGroupsForHttpd converts OpenShift TLS groups to a colon-separated OpenSSL +// Groups string for Apache's SSLOpenSSLConfCmd directive. Unknown groups are +// filtered out so forward-compatible profile values do not break httpd. +func tlsGroupsForHttpd(groups []configv1.TLSGroup) string { + if len(groups) == 0 { + return "" + } + names := make([]string, 0, len(groups)) + skipped := make([]configv1.TLSGroup, 0) + for _, g := range groups { + if _, ok := allowedHttpdGroups[g]; ok { + names = append(names, string(g)) + continue + } + skipped = append(skipped, g) + } + if len(skipped) > 0 { + logs.Info("skipping unsupported TLS curve preference groups for gitops-plugin httpd", "groups", skipped) + } + return strings.Join(names, ":") +} + // buildHttpdConfig generates httpd.conf with dynamic TLS settings func (r *ReconcileGitopsService) buildHttpdConfig() string { - minVersionTLS := string(r.CentralTLSProfile.MinTLSVersion) + minVersionTLS := string(r.CentralTLSProfile.MinVersion) httpdConfigBase := fmt.Sprintf(`LoadModule ssl_module modules/mod_ssl.so Listen %d https ServerRoot "/etc/httpd" @@ -275,6 +310,9 @@ ServerRoot "/etc/httpd" if minVersionTLS != "VersionTLS13" && strings.Join(r.CentralTLSProfile.Ciphers, ":") != "" { httpdConfigBase += fmt.Sprintf("\n\tSSLCipherSuite %s", strings.Join(r.CentralTLSProfile.Ciphers, ":")) } + if groups := tlsGroupsForHttpd(r.CentralTLSProfile.CurvePreferences); groups != "" { + httpdConfigBase += fmt.Sprintf("\n\tSSLOpenSSLConfCmd Groups %s", groups) + } // Close VirtualHost httpdConfigBase += "\n" return httpdConfigBase diff --git a/controllers/consoleplugin_test.go b/controllers/consoleplugin_test.go index f03a553316f..195c836244b 100644 --- a/controllers/consoleplugin_test.go +++ b/controllers/consoleplugin_test.go @@ -7,6 +7,7 @@ import ( "testing" argocommon "github.com/argoproj-labs/gitops-operator/argocd-operator/common" + "github.com/argoproj-labs/gitops-operator/argocd-operator/pkg/tlsprofile" configv1 "github.com/openshift/api/config/v1" consolev1 "github.com/openshift/api/console/v1" pipelinesv1alpha1 "github.com/redhat-developer/gitops-operator/api/v1alpha1" @@ -1866,62 +1867,130 @@ func TestReconcileDeployment_UpdateWhenActualChange(t *testing.T) { func TestBuildHttpdConfig(t *testing.T) { tests := []struct { name string - CentralTLSProfile configv1.TLSProfileSpec + CentralTLSProfile tlsprofile.TLSConfigProfile wantProtocol bool wantCipherSuite bool + wantGroups bool protocol string cipherSuite string + groups string }{ { name: "no TLS version no ciphers", - CentralTLSProfile: configv1.TLSProfileSpec{ - MinTLSVersion: "", - Ciphers: nil, + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "", + Ciphers: nil, }, wantProtocol: false, wantCipherSuite: false, + wantGroups: false, }, { name: "TLS 1.2 with cipher suites", - CentralTLSProfile: configv1.TLSProfileSpec{ - MinTLSVersion: "VersionTLS12", - Ciphers: []string{"ECDHE-RSA-AES256-GCM-SHA384", "ECDHE-RSA-AES128-GCM-SHA256"}, + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS12", + Ciphers: []string{"ECDHE-RSA-AES256-GCM-SHA384", "ECDHE-RSA-AES128-GCM-SHA256"}, }, wantProtocol: true, wantCipherSuite: true, + wantGroups: false, protocol: "-all +TLSv1.2 +TLSv1.3", cipherSuite: "ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256", }, { name: "TLS 1.3 ignores cipher suites", - CentralTLSProfile: configv1.TLSProfileSpec{ - MinTLSVersion: "VersionTLS13", - Ciphers: []string{"TLS_AES_128_GCM_SHA256"}, + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS13", + Ciphers: []string{"TLS_AES_128_GCM_SHA256"}, }, wantProtocol: true, wantCipherSuite: false, + wantGroups: false, protocol: "-all +TLSv1.3", }, { name: "TLS 1.2 without cipher suites", - CentralTLSProfile: configv1.TLSProfileSpec{ - MinTLSVersion: "VersionTLS12", - Ciphers: nil, + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS12", + Ciphers: nil, }, wantProtocol: true, wantCipherSuite: false, + wantGroups: false, protocol: "-all +TLSv1.2 +TLSv1.3", }, { name: "invalid TLS version with cipher suites", - CentralTLSProfile: configv1.TLSProfileSpec{ - MinTLSVersion: "invalid", - Ciphers: []string{"ECDHE-RSA-AES256-GCM-SHA384"}, + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "invalid", + Ciphers: []string{"ECDHE-RSA-AES256-GCM-SHA384"}, }, wantProtocol: false, wantCipherSuite: true, + wantGroups: false, cipherSuite: "ECDHE-RSA-AES256-GCM-SHA384", }, + { + name: "TLS groups configure SSLOpenSSLConfCmd Groups", + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS12", + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupX25519MLKEM768, + configv1.TLSGroupX25519, + configv1.TLSGroupSecP256r1, + configv1.TLSGroupSecP384r1, + }, + }, + wantProtocol: true, + wantCipherSuite: false, + wantGroups: true, + protocol: "-all +TLSv1.2 +TLSv1.3", + groups: "X25519MLKEM768:X25519:secp256r1:secp384r1", + }, + { + name: "TLS 1.3 with groups", + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS13", + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupX25519, + configv1.TLSGroupSecP256r1, + }, + }, + wantProtocol: true, + wantCipherSuite: false, + wantGroups: true, + protocol: "-all +TLSv1.3", + groups: "X25519:secp256r1", + }, + { + name: "unknown groups are filtered out", + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS12", + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroupX25519, + configv1.TLSGroup("UnknownGroup"), + configv1.TLSGroupSecP384r1, + }, + }, + wantProtocol: true, + wantCipherSuite: false, + wantGroups: true, + protocol: "-all +TLSv1.2 +TLSv1.3", + groups: "X25519:secp384r1", + }, + { + name: "only unknown groups omits SSLOpenSSLConfCmd", + CentralTLSProfile: tlsprofile.TLSConfigProfile{ + MinVersion: "VersionTLS12", + CurvePreferences: []configv1.TLSGroup{ + configv1.TLSGroup("UnknownGroup"), + }, + }, + wantProtocol: true, + wantCipherSuite: false, + wantGroups: false, + protocol: "-all +TLSv1.2 +TLSv1.3", + }, } for _, tt := range tests { @@ -1953,6 +2022,13 @@ func TestBuildHttpdConfig(t *testing.T) { } else { assert.Assert(t, !strings.Contains(cfg, "SSLCipherSuite")) } + + // SSLOpenSSLConfCmd Groups + if tt.wantGroups { + assert.Assert(t, cmp.Contains(cfg, "SSLOpenSSLConfCmd Groups "+tt.groups)) + } else { + assert.Assert(t, !strings.Contains(cfg, "SSLOpenSSLConfCmd Groups")) + } }) } } diff --git a/controllers/gitopsservice_controller.go b/controllers/gitopsservice_controller.go index d37b887aec1..58ab3acbf19 100644 --- a/controllers/gitopsservice_controller.go +++ b/controllers/gitopsservice_controller.go @@ -28,8 +28,10 @@ import ( argocommon "github.com/argoproj-labs/gitops-operator/argocd-operator/common" argocdcontroller "github.com/argoproj-labs/gitops-operator/argocd-operator/controllers/argocd" argocdutil "github.com/argoproj-labs/gitops-operator/argocd-operator/controllers/argoutil" + "github.com/argoproj-labs/gitops-operator/argocd-operator/pkg/tlsprofile" "github.com/go-logr/logr" version "github.com/hashicorp/go-version" + configv1 "github.com/openshift/api/config/v1" routev1 "github.com/openshift/api/route/v1" pipelinesv1alpha1 "github.com/redhat-developer/gitops-operator/api/v1alpha1" "github.com/redhat-developer/gitops-operator/common" @@ -54,8 +56,6 @@ import ( logf "sigs.k8s.io/controller-runtime/pkg/log" "sigs.k8s.io/controller-runtime/pkg/predicate" "sigs.k8s.io/controller-runtime/pkg/reconcile" - - configv1 "github.com/openshift/api/config/v1" ) var logs = logf.Log.WithName("controller_gitopsservice") @@ -148,8 +148,8 @@ type ReconcileGitopsService struct { // disableDefaultInstall, if true, will ensure that the default ArgoCD instance is not instantiated in the openshift-gitops namespace. DisableDefaultInstall bool - //CentralTLSProfile contains MinVersion and CipherSuites - CentralTLSProfile configv1.TLSProfileSpec + // CentralTLSProfile contains cluster TLS settings (min version, ciphers, curve preferences). + CentralTLSProfile tlsprofile.TLSConfigProfile // PluginNamespace is the namespace where console plugin resources (Deployment, Service, ConfigMap) are deployed. // This is typically the operator's own namespace (e.g. "openshift-gitops-operator"). @@ -834,7 +834,7 @@ func objectMeta(resourceName string, namespace string, opts ...func(*metav1.Obje return objectMeta } -func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy, CentralTLSProfile configv1.TLSProfileSpec) *appsv1.Deployment { +func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.PullPolicy, CentralTLSProfile tlsprofile.TLSConfigProfile) *appsv1.Deployment { image := os.Getenv(backendImageEnvName) if image == "" { image = backendImage @@ -845,18 +845,39 @@ func newBackendDeployment(ns types.NamespacedName, crImagePullPolicy corev1.Pull Value: insecureEnvVarValue, }, } - if argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion) != "" { + if argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinVersion) != "" { env = append(env, corev1.EnvVar{ Name: "TLS_MIN_VERSION", - Value: argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinTLSVersion), + Value: argocdutil.TLSProtocolVersionString(CentralTLSProfile.MinVersion), }) } - if len(CentralTLSProfile.Ciphers) > 0 { - env = append(env, corev1.EnvVar{ - Name: "TLS_CIPHER_SUITES", - Value: strings.Join(CentralTLSProfile.Ciphers, ":"), - }) + // gitops-backend is Go-based and accepts IANA cipher names only (e.g. + // TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256), not OpenSSL names from the + // OpenShift TLSSecurityProfile (e.g. ECDHE-ECDSA-AES128-GCM-SHA256). + if ciphers := argocdutil.MapCipherSuites(CentralTLSProfile.Ciphers); len(ciphers) > 0 { + // Go does not allow configuring TLS 1.3 cipher suites; gitops-backend + // also rejects TLS 1.3 suites when the configured minimum is below 1.3. + if CentralTLSProfile.MinVersion != configv1.VersionTLS13 { + tls13Ciphers := map[string]bool{ + "TLS_AES_128_GCM_SHA256": true, + "TLS_AES_256_GCM_SHA384": true, + "TLS_CHACHA20_POLY1305_SHA256": true, + } + filtered := make([]string, 0, len(ciphers)) + for _, cipher := range ciphers { + if !tls13Ciphers[cipher] { + filtered = append(filtered, cipher) + } + } + ciphers = filtered + } + if len(ciphers) > 0 { + env = append(env, corev1.EnvVar{ + Name: "TLS_CIPHER_SUITES", + Value: strings.Join(ciphers, ":"), + }) + } } podSpec := corev1.PodSpec{ Containers: []corev1.Container{ diff --git a/controllers/gitopsservice_controller_test.go b/controllers/gitopsservice_controller_test.go index 160b96c82ae..4099132a3a2 100644 --- a/controllers/gitopsservice_controller_test.go +++ b/controllers/gitopsservice_controller_test.go @@ -25,6 +25,7 @@ import ( argoapp "github.com/argoproj-labs/gitops-operator/argocd-operator/api/v1beta1" argocommon "github.com/argoproj-labs/gitops-operator/argocd-operator/common" "github.com/argoproj-labs/gitops-operator/argocd-operator/controllers/argocd" + "github.com/argoproj-labs/gitops-operator/argocd-operator/pkg/tlsprofile" configv1 "github.com/openshift/api/config/v1" consolev1 "github.com/openshift/api/console/v1" routev1 "github.com/openshift/api/route/v1" @@ -62,7 +63,7 @@ func TestImageFromEnvVariable(t *testing.T) { image := "quay.io/org/test" t.Setenv(backendImageEnvName, image) - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{}) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), tlsprofile.TLSConfigProfile{}) got := deployment.Spec.Template.Spec.Containers[0].Image if got != image { @@ -70,7 +71,7 @@ func TestImageFromEnvVariable(t *testing.T) { } }) t.Run("env variable for image not found", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{}) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), tlsprofile.TLSConfigProfile{}) got := deployment.Spec.Template.Spec.Containers[0].Image if got != backendImage { @@ -79,7 +80,7 @@ func TestImageFromEnvVariable(t *testing.T) { }) t.Run("TLS Min Version 1.3 and empty ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13}) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), tlsprofile.TLSConfigProfile{MinVersion: configv1.VersionTLS13}) var gotTLSMinVersion string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { if env.Name == "TLS_MIN_VERSION" { @@ -93,7 +94,7 @@ func TestImageFromEnvVariable(t *testing.T) { }) t.Run("TLS Min Version 1.2 and empty ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS12}) + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), tlsprofile.TLSConfigProfile{MinVersion: configv1.VersionTLS12}) var gotTLSMinVersion string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { if env.Name == "TLS_MIN_VERSION" { @@ -106,43 +107,55 @@ func TestImageFromEnvVariable(t *testing.T) { } }) - t.Run("TLS Min Version 1.3 and single ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13, Ciphers: []string{"dummy1"}}) + t.Run("TLS Min Version 1.3 maps OpenSSL ciphers to IANA names", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), tlsprofile.TLSConfigProfile{ + MinVersion: configv1.VersionTLS13, + Ciphers: []string{"ECDHE-ECDSA-AES128-GCM-SHA256"}, + }) var gotTLSMinVersion string var gotTLSCiphers string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { if env.Name == "TLS_MIN_VERSION" { gotTLSMinVersion = env.Value - break } if env.Name == "TLS_CIPHER_SUITES" { gotTLSCiphers = env.Value - break } } - if gotTLSMinVersion != "1.3" && gotTLSCiphers != "dummy1" { + if gotTLSMinVersion != "1.3" { t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") - t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, "dummy1") + } + want := "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" + if gotTLSCiphers != want { + t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, want) } }) - t.Run("TLS Min Version 1.3 and double ciphers", func(t *testing.T) { - deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), configv1.TLSProfileSpec{MinTLSVersion: configv1.VersionTLS13, Ciphers: []string{"dummy1", "dummy2"}}) + t.Run("TLS Min Version 1.2 maps and filters TLS 1.3 cipher suites", func(t *testing.T) { + deployment := newBackendDeployment(ns, corev1.PullPolicy(corev1.PullIfNotPresent), tlsprofile.TLSConfigProfile{ + MinVersion: configv1.VersionTLS12, + Ciphers: []string{ + "TLS_AES_128_GCM_SHA256", + "ECDHE-ECDSA-AES128-GCM-SHA256", + "ECDHE-RSA-AES128-GCM-SHA256", + }, + }) var gotTLSMinVersion string var gotTLSCiphers string for _, env := range deployment.Spec.Template.Spec.Containers[0].Env { if env.Name == "TLS_MIN_VERSION" { gotTLSMinVersion = env.Value - break } if env.Name == "TLS_CIPHER_SUITES" { gotTLSCiphers = env.Value - break } } - if gotTLSMinVersion != "1.3" && gotTLSCiphers != "dummy1:dummy2" { - t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.3") - t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, "dummy1:dummy2") + if gotTLSMinVersion != "1.2" { + t.Errorf("TLS Min Version mismatch: got %s, want %s", gotTLSMinVersion, "1.2") + } + want := "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" + if gotTLSCiphers != want { + t.Errorf("TLS Cipher mismatch: got %s, want %s", gotTLSCiphers, want) } }) } diff --git a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go index e7e0db055c5..81713ca4306 100644 --- a/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go +++ b/test/openshift/e2e/ginkgo/sequential/1-143_validate_deployment_Env_Args_For_Tls_Configuration_test.go @@ -264,10 +264,11 @@ var _ = Describe("Validate Deployment Env Args For TLS Configuration", Label("op })) Expect(env).To(ContainElement(corev1.EnvVar{ Name: "TLS_CIPHER_SUITES", - Value: "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:" + - "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:" + - "ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:" + - "ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305", + // OpenSSL names from the cluster TLS profile are mapped to IANA/Go + // names; TLS 1.3 suites are omitted when min version is 1.2. + Value: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256:" + + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384:TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384:" + + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256:TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", })) return nil