djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Explicitly set defaultServing ciphers in FIPS mode

Browse Source 
This is a no-op today, but could change in the future when we add
support for FIPS in non-strict mode.

Signed-off-by: Monis Khan <mok@vmware.com>
This commit is contained in:
Monis Khan 2022-03-31 17:07:47 -04:00
parent 3f0753ec5a
commit 07066e020d
No known key found for this signature in database
GPG Key ID: 52C90ADA01B269B8
3 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
internal/crypto/ptls/fips_strict.go
View File

@ -17,6 +17,8 @@ import (
"C" // explicitly import cgo so that runtime/cgo gets linked into the kube-cert-agent "C" // explicitly import cgo so that runtime/cgo gets linked into the kube-cert-agent
_ "crypto/tls/fipsonly" // restricts all TLS configuration to FIPS-approved settings. _ "crypto/tls/fipsonly" // restricts all TLS configuration to FIPS-approved settings.
"k8s.io/apiserver/pkg/server/options"
"go.pinniped.dev/internal/plog" "go.pinniped.dev/internal/plog"
) )
@ -63,3 +65,7 @@ func Secure(rootCAs *x509.CertPool) *tls.Config {
func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config { func DefaultLDAP(rootCAs *x509.CertPool) *tls.Config {
return Default(rootCAs) return Default(rootCAs)
} }
func secureServing(opts *options.SecureServingOptionsWithLoopback) {
defaultServing(opts)
}

5
internal/crypto/ptls/ptls.go
View File

@ -82,11 +82,6 @@ func defaultServing(opts *options.SecureServingOptionsWithLoopback) {
opts.MinTLSVersion = defaultServingOptionsMinTLSVersion opts.MinTLSVersion = defaultServingOptionsMinTLSVersion
} }
func secureServing(opts *options.SecureServingOptionsWithLoopback) {
opts.MinTLSVersion = secureServingOptionsMinTLSVersion
opts.CipherSuites = nil
}
func secureClient(opts *options.RecommendedOptions, f RestConfigFunc) error { func secureClient(opts *options.RecommendedOptions, f RestConfigFunc) error {
inClusterClient, inClusterConfig, err := f(nil) inClusterClient, inClusterConfig, err := f(nil)
if err != nil { if err != nil {

7
internal/crypto/ptls/secure.go
View File

@ -9,6 +9,8 @@ package ptls
import ( import (
"crypto/tls" "crypto/tls"
"crypto/x509" "crypto/x509"
"k8s.io/apiserver/pkg/server/options"
) )
// secureServingOptionsMinTLSVersion is the minimum tls version in the format // secureServingOptionsMinTLSVersion is the minimum tls version in the format
@ -42,3 +44,8 @@ func Secure(rootCAs *x509.CertPool) *tls.Config {
} }
return c return c
} }
func secureServing(opts *options.SecureServingOptionsWithLoopback) {
opts.MinTLSVersion = secureServingOptionsMinTLSVersion
opts.CipherSuites = nil
}