Skip to content

Commit 4659b47

Browse files
ahmedwaleedmalikahmedwaleedmalik
authored
Update TLS Cipher Suites config for kubelet and restrict the allowed values (kubermatic#1077)
* Update TLS Cipher Suites config for kubelet and restrict the allowed values * Update fixtures * Update allowed semver for e2e provisioing tests * Update fixtures * Fix formatting error for kubelet.go * Improve code styling * Update kubectl version for ci e2e environment * Update e2e cluster configuration to use k8s v1.22.2 with containerd as CRI * Templatize container runtime health check to pick container runtime dynamically * Update test fixture for flatcard instance with cri containerd * Update script to install master node for integration tests * Remove invalid trailing slash from run-machine-controller.sh * Fix linting errors * Remove deprecated commands for terraform
1 parent 75fea2b commit 4659b47

72 files changed

Lines changed: 656 additions & 24 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎hack/ci-e2e-test.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ function cleanup {
2828
for try in {1..20}; do
2929
# Clean up master
3030
echo "Cleaning up controller, attempt ${try}"
31-
terraform destroy -force
31+
terraform apply -destroy -auto-approve
3232
if [[ $? == 0 ]]; then break; fi
3333
echo "Sleeping for $try seconds"
3434
sleep ${try}s

‎hack/run-machine-controller.sh‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,5 @@ $(dirname $0)/../machine-controller \
3030
-enable-profiling \
3131
-metrics-address=0.0.0.0:8080 \
3232
-use-osm \
33-
-health-probe-address=0.0.0.0:8085
33+
-health-probe-address=0.0.0.0:8085 \
34+
-node-container-runtime=containerd

‎pkg/userdata/amzn2/testdata/containerd-kubelet-v1.20-aws.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -325,6 +325,16 @@ write_files:
325325
cpu: 200m
326326
ephemeral-storage: 1Gi
327327
memory: 200Mi
328+
tlsCipherSuites:
329+
- TLS_AES_128_GCM_SHA256
330+
- TLS_AES_256_GCM_SHA384
331+
- TLS_CHACHA20_POLY1305_SHA256
332+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
333+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
334+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
335+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
336+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
337+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
328338
volumePluginDir: /var/lib/kubelet/volumeplugins
329339
volumeStatsAggPeriod: 0s
330340

‎pkg/userdata/amzn2/testdata/kubelet-v1.16-aws.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,16 @@ write_files:
321321
cpu: 200m
322322
ephemeral-storage: 1Gi
323323
memory: 200Mi
324+
tlsCipherSuites:
325+
- TLS_AES_128_GCM_SHA256
326+
- TLS_AES_256_GCM_SHA384
327+
- TLS_CHACHA20_POLY1305_SHA256
328+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
329+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
330+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
331+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
332+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
333+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
324334
volumePluginDir: /var/lib/kubelet/volumeplugins
325335
volumeStatsAggPeriod: 0s
326336

‎pkg/userdata/amzn2/testdata/kubelet-v1.17-aws-external.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,16 @@ write_files:
322322
cpu: 200m
323323
ephemeral-storage: 1Gi
324324
memory: 200Mi
325+
tlsCipherSuites:
326+
- TLS_AES_128_GCM_SHA256
327+
- TLS_AES_256_GCM_SHA384
328+
- TLS_CHACHA20_POLY1305_SHA256
329+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
330+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
331+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
332+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
333+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
334+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
325335
volumePluginDir: /var/lib/kubelet/volumeplugins
326336
volumeStatsAggPeriod: 0s
327337

‎pkg/userdata/amzn2/testdata/kubelet-v1.17-aws.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,16 @@ write_files:
322322
cpu: 200m
323323
ephemeral-storage: 1Gi
324324
memory: 200Mi
325+
tlsCipherSuites:
326+
- TLS_AES_128_GCM_SHA256
327+
- TLS_AES_256_GCM_SHA384
328+
- TLS_CHACHA20_POLY1305_SHA256
329+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
330+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
331+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
332+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
333+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
334+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
325335
volumePluginDir: /var/lib/kubelet/volumeplugins
326336
volumeStatsAggPeriod: 0s
327337

‎pkg/userdata/amzn2/testdata/kubelet-v1.17-vsphere-mirrors.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,16 @@ write_files:
339339
cpu: 200m
340340
ephemeral-storage: 1Gi
341341
memory: 200Mi
342+
tlsCipherSuites:
343+
- TLS_AES_128_GCM_SHA256
344+
- TLS_AES_256_GCM_SHA384
345+
- TLS_CHACHA20_POLY1305_SHA256
346+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
347+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
348+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
349+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
350+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
351+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
342352
volumePluginDir: /var/lib/kubelet/volumeplugins
343353
volumeStatsAggPeriod: 0s
344354

‎pkg/userdata/amzn2/testdata/kubelet-v1.17-vsphere-proxy.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,16 @@ write_files:
339339
cpu: 200m
340340
ephemeral-storage: 1Gi
341341
memory: 200Mi
342+
tlsCipherSuites:
343+
- TLS_AES_128_GCM_SHA256
344+
- TLS_AES_256_GCM_SHA384
345+
- TLS_CHACHA20_POLY1305_SHA256
346+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
347+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
348+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
349+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
350+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
351+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
342352
volumePluginDir: /var/lib/kubelet/volumeplugins
343353
volumeStatsAggPeriod: 0s
344354

‎pkg/userdata/amzn2/testdata/kubelet-v1.17-vsphere.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -330,6 +330,16 @@ write_files:
330330
cpu: 200m
331331
ephemeral-storage: 1Gi
332332
memory: 200Mi
333+
tlsCipherSuites:
334+
- TLS_AES_128_GCM_SHA256
335+
- TLS_AES_256_GCM_SHA384
336+
- TLS_CHACHA20_POLY1305_SHA256
337+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
338+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
339+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
340+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
341+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
342+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
333343
volumePluginDir: /var/lib/kubelet/volumeplugins
334344
volumeStatsAggPeriod: 0s
335345

‎pkg/userdata/amzn2/testdata/kubelet-v1.18-aws.yaml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -322,6 +322,16 @@ write_files:
322322
cpu: 200m
323323
ephemeral-storage: 1Gi
324324
memory: 200Mi
325+
tlsCipherSuites:
326+
- TLS_AES_128_GCM_SHA256
327+
- TLS_AES_256_GCM_SHA384
328+
- TLS_CHACHA20_POLY1305_SHA256
329+
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
330+
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
331+
- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
332+
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
333+
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
334+
- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
325335
volumePluginDir: /var/lib/kubelet/volumeplugins
326336
volumeStatsAggPeriod: 0s
327337

0 commit comments

Comments
 (0)