Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Be stricter validating custom TLSSecurityProfiles #2554

Merged
merged 1 commit into from
Oct 24, 2023
Merged

Be stricter validating custom TLSSecurityProfiles #2554

merged 1 commit into from
Oct 24, 2023

Conversation

tiraboschi
Copy link
Member

What this PR does / why we need it:
Explicitly fail with a clear error message also when:

  • minTLSVersion is invalid
  • custom ciphers are selected with minTLSVersion==VersionTLS13

Fixes: #2553
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2242207

Reviewer Checklist

Reviewers are supposed to review the PR for every aspect below one by one. To check an item means the PR is either "OK" or "Not Applicable" in terms of that item. All items are supposed to be checked before merging a PR.

  • PR Message
  • Commit Messages
  • How to test
  • Unit Tests
  • Functional Tests
  • User Documentation
  • Developer Documentation
  • Upgrade Scenario
  • Uninstallation Scenario
  • Backward Compatibility
  • Troubleshooting Friendly

Jira Ticket:

https://issues.redhat.com/browse/CNV-33686

Release note:

Be stricter validating custom TLSSecurityProfiles

@kubevirt-bot kubevirt-bot added release-note Denotes a PR that will be considered when it comes time to generate release notes. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. do-not-merge/invalid-commit-message labels Oct 18, 2023
@tiraboschi
Be stricter validating custom TLSSecurityProfiles
dc85fd5 
Explicitly fail with a clear error message also when:
- minTLSVersion is invalid
- custom ciphers are selected with minTLSVersion==VersionTLS13

Signed-off-by: Simone Tiraboschi <stirabos@redhat.com>
@hco-bot
Copy link
Collaborator

hco-bot commented Oct 18, 2023

hco-e2e-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-sno-azure

In response to this:

hco-e2e-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 18, 2023

hco-e2e-operator-sdk-aws, hco-e2e-operator-sdk-gcp lanes succeeded.
/override ci/prow/hco-e2e-operator-sdk-azure
hco-e2e-upgrade-prev-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-operator-sdk-azure, ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

In response to this:

hco-e2e-operator-sdk-aws, hco-e2e-operator-sdk-gcp lanes succeeded.
/override ci/prow/hco-e2e-operator-sdk-azure
hco-e2e-upgrade-prev-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 18, 2023

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-kv-smoke-azure

In response to this:

hco-e2e-kv-smoke-gcp lane succeeded.
/override ci/prow/hco-e2e-kv-smoke-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Copy link
Member Author

/retest

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 19, 2023

hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

In response to this:

hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 19, 2023

hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

In response to this:

hco-e2e-upgrade-operator-sdk-sno-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@tiraboschi
Copy link
Member Author

/retest

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 19, 2023

hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-operator-sdk-azure

In response to this:

hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci
Copy link

openshift-ci bot commented Oct 19, 2023 •
edited

@tiraboschi: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/hco-e2e-operator-sdk-sno-azure dc85fd5 link false /test hco-e2e-operator-sdk-sno-azure
ci/prow/hco-e2e-upgrade-prev-operator-sdk-azure dc85fd5 link true /test hco-e2e-upgrade-prev-operator-sdk-azure
ci/prow/hco-e2e-operator-sdk-azure dc85fd5 link true /test hco-e2e-operator-sdk-azure
ci/prow/hco-e2e-kv-smoke-azure dc85fd5 link true /test hco-e2e-kv-smoke-azure
ci/prow/hco-e2e-upgrade-operator-sdk-sno-azure dc85fd5 link false /test hco-e2e-upgrade-operator-sdk-sno-azure

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

@tiraboschi
Copy link
Member Author

/retest

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 19, 2023

hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-azure

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/hco-e2e-upgrade-operator-sdk-azure

In response to this:

hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/hco-e2e-upgrade-operator-sdk-azure

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@hco-bot
Copy link
Collaborator

hco-bot commented Oct 19, 2023

okd-hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp

@kubevirt-bot
Copy link
Contributor

@hco-bot: Overrode contexts on behalf of hco-bot: ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp

In response to this:

okd-hco-e2e-upgrade-operator-sdk-aws lane succeeded.
/override ci/prow/okd-hco-e2e-upgrade-operator-sdk-gcp

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

nunnatsa
nunnatsa approved these changes Oct 24, 2023
View reviewed changes
Copy link
Collaborator

@nunnatsa nunnatsa left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@kubevirt-bot kubevirt-bot added the lgtm Indicates that a PR is ready to be merged. label Oct 24, 2023
@kubevirt-bot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: nunnatsa

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@kubevirt-bot kubevirt-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Oct 24, 2023
@tiraboschi
Copy link
Member Author

/retest

1 similar comment
@tiraboschi
Copy link
Member Author

/retest

@kubevirt-bot kubevirt-bot merged commit 5a5bbc6 into kubevirt:main Oct 24, 2023
33 checks passed
@tiraboschi tiraboschi deleted the stricter_validation_tls branch October 24, 2023 15:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nunnatsa nunnatsa nunnatsa approved these changes

@machadovilaca machadovilaca Awaiting requested review from machadovilaca

@sradco sradco Awaiting requested review from sradco

Assignees

@nunnatsa nunnatsa

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. dco-signoff: yes Indicates the PR's author has DCO signed all their commits. lgtm Indicates that a PR is ready to be merged. release-note Denotes a PR that will be considered when it comes time to generate release notes. size/M
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

When using TLS13 it should not be allowed to specify any ciphers
4 participants
@tiraboschi @hco-bot @kubevirt-bot @nunnatsa