Consider changing default tls stack from openssl-tls to rustls-tls

[clux]

If the latest mass-closure of rustls issues does not come with any negative side-effects, we should consider finally moving over to rustls as a default.

Issue comparison

• openssl issues
• rustls issues

Feature Comparison

Based on above issues; moving now would give us default support for tls-server-name.
It could also potentially give us a much faster windows ci (experimentation pending) due to how long the openssl install takes.

Cross compilation

Minor point, but the standard glibc based x86_64 linux -> musl x86_64 cross compile technically becomes viable locally without build containers using cargo build --target x86_64-unknown-linux-musl (works in version-rs which is now using rustls-tls).

Questions

1. Are there any features that are lacking on rustls over openssl that we should take into consideration?
2. Anything else worth considering?
3. If it all seems fine, and no issues are reported, how long do we wait?

[goenning]

FWIW I’m moving Aptakube to rustls on the next version. The app is being used in a large variety of environments, but always from outside the cluster.

I’ll report back how it goes🤞

[clux]

Have started migration most my controllers to rustls as well this month given a bunch more openssl security vulnerabilities have started surfacing from security scanners, so will make another update next month on how that turned out.

[aviramha]

https://github.com/metalbear-co/mirrord uses kube-rs + rustls and it works great. I think making it the default would be awesome :)

[goenning]

I forgot about this threqs, but I'm using rustls on Aptakube for the last 3 months and had zero issues reported 👍