Disable tls1.3 by default for compliance (#3828)

canada-ca · Jul 14, 2022 · 359eccd · 359eccd
1 parent a84caad
commit 359eccd
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/k8s/infrastructure/bases/istio/ingress-gateway.yaml b/k8s/infrastructure/bases/istio/ingress-gateway.yaml
@@ -29,6 +29,7 @@ spec:
         privateKey: sds
         serverCertificate: sds
         minProtocolVersion: TLSV1_2 # ITPIN 6.1.3 implements TLS 1.2, or subsequent versions
+        maxProtocolVersion: TLSV1_2
         cipherSuites: # ITPIN 6.1.3 uses supported cryptographic algorithms
           - ECDHE-ECDSA-AES256-GCM-SHA384
           - ECDHE-RSA-AES256-GCM-SHA384
diff --git a/k8s/infrastructure/overlays/production/ingress-gateway-tls-patch.yaml b/k8s/infrastructure/overlays/production/ingress-gateway-tls-patch.yaml
@@ -29,6 +29,7 @@ spec:
         privateKey: sds
         serverCertificate: sds
         minProtocolVersion: TLSV1_2
+        maxProtocolVersion: TLSV1_2
         cipherSuites:
         - TLS_AES_128_GCM_SHA256
         - TLS_AES_256_GCM_SHA384

diff --git a/k8s/infrastructure/overlays/staging/ingress-gateway-tls-patch.yaml b/k8s/infrastructure/overlays/staging/ingress-gateway-tls-patch.yaml
@@ -29,6 +29,7 @@ spec:
         privateKey: sds
         serverCertificate: sds
         minProtocolVersion: TLSV1_2
+        maxProtocolVersion: TLSV1_2
         cipherSuites:
         - TLS_AES_128_GCM_SHA256
         - TLS_AES_256_GCM_SHA384