djpbessems/ContainerImage.Pinniped
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
6a68c6532c
ContainerImage.Pinniped/test/integration
History
Monis Khan cd686ffdf3
Force the use of secure TLS config 
This change updates the TLS config used by all pinniped components.
There are no configuration knobs associated with this change.  Thus
this change tightens our static defaults.

There are four TLS config levels:

1. Secure (TLS 1.3 only)
2. Default (TLS 1.2+ best ciphers that are well supported)
3. Default LDAP (TLS 1.2+ with less good ciphers)
4. Legacy (currently unused, TLS 1.2+ with all non-broken ciphers)

Highlights per component:

1. pinniped CLI
   - uses "secure" config against KAS
   - uses "default" for all other connections
2. concierge
   - uses "secure" config as an aggregated API server
   - uses "default" config as a impersonation proxy API server
   - uses "secure" config against KAS
   - uses "default" config for JWT authenticater (mostly, see code)
   - no changes to webhook authenticater (see code)
3. supervisor
   - uses "default" config as a server
   - uses "secure" config against KAS
   - uses "default" config against OIDC IDPs
   - uses "default LDAP" config against LDAP IDPs

Signed-off-by: Monis Khan <mok@vmware.com>
2021-11-17 16:55:35 -05:00
..
category_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
cli_test.go Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
concierge_api_serving_certs_test.go test/integration: mark certain tests as disruptive 2021-08-26 15:11:47 -04:00
concierge_availability_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
concierge_client_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
concierge_credentialissuer_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
concierge_credentialrequest_test.go Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
concierge_impersonation_proxy_test.go Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
concierge_kubecertagent_test.go Update TestKubeCertAgent to use new "v3" label value 2021-09-15 11:09:07 -07:00
concierge_kubectl_test.go test/integration: run parallel tests concurrently with serial tests 2021-08-26 12:59:52 -04:00
controllerinit_test.go Ensure concierge and supervisor gracefully exit 2021-08-30 20:29:52 -04:00
e2e_test.go Change some comments on API docs, fix lint error by ignoring it 2021-08-26 16:55:43 -07:00
formposthtml_test.go Add offline_access scope for integration tests when using Dex 2021-10-19 12:25:51 -07:00
kube_api_discovery_test.go Update a comment 2021-09-21 14:07:08 -07:00
kubeclient_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
ldap_client_test.go Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
leaderelection_test.go leader election test: approximate that followers have observed change 2021-08-26 12:59:52 -04:00
main_test.go Allow focused integration tests to be run from the GoLand UI again 2021-09-21 12:04:45 -07:00
rbac_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
securetls_test.go Force the use of secure TLS config 2021-11-17 16:55:35 -05:00
supervisor_discovery_test.go test/integration: use short timeouts with distinct requests to prevent hangs 2021-08-27 16:10:36 -04:00
supervisor_healthz_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
supervisor_login_test.go extract ldap refresh search into helper function 2021-11-05 14:22:43 -07:00
supervisor_secrets_test.go test/integration: run parallel tests concurrently with serial tests 2021-08-26 12:59:52 -04:00
supervisor_storage_garbage_collection_test.go test/integration: run parallel tests concurrently with serial tests 2021-08-26 12:59:52 -04:00
supervisor_storage_test.go Fix bad test package name 2021-06-22 11:23:19 -04:00
supervisor_upstream_test.go TestSupervisorUpstreamOIDCDiscovery: include AdditionalAuthorizeParametersValid condition 2021-10-25 10:21:51 -04:00
whoami_test.go Tests use CertificatesV1 when available, otherwise use CertificatesV1beta1 2021-09-20 17:14:58 -07:00