OCPBUGS-14846: webhook - set minimum TLS version back to 1.2 to support FIPS clusters

[alebedev87]

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Note
kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers (as the upstream PR did), only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

# controller is there
$ oc -n aws-load-balancer-operator get pods
NAME                                                             READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4             1/1     Running   0          2m19s
aws-load-balancer-operator-controller-manager-85d94d56c5-mjpq6   2/2     Running   0          5m11s

# it uses a manually built image (same as in the operator PR, see above)
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4 -o yaml | yq .spec.containers[0].image
quay.io/aws-load-balancer-operator/aws-load-balancer-controller:8.10.234-tls12

# ingress webhook is on
$ oc -n aws-load-balancer-operator logs aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4 | grep 'webhook.*ingress'
{"level":"info","ts":1691706492.4913087,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/validate-networking-v1-ingress"}

# ingress resource got created with no TLS errors
$ oc -n echoserver get ing
NAME         CLASS   HOSTS   ADDRESS                                                                   PORTS   AGE
echoserver   alb     *       k8s-echoserv-echoserv-314d49d2d2-1425878010.us-east-1.elb.amazonaws.com   80      42s

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

The goal of this PR is to support environments where TLS versions other than 1.3 are still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: alebedev87

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• DOWNSTREAM_OWNERS [alebedev87]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

The goal of this PR is to support environments where TLS versions other than 1.3 are still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Upstream PR: kubernetes-sigs#3313

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[alebedev87]

kubernetes-sigs#3318 merged, we should carry patch this change, removing WIP.

/retitle OCPBUGS-14846: webhook - set minimum TLS version back to 1.2 to support FIPS clusters

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers, only the minimum TLS version.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[ShudiLi]

The issue seemed still there.
`
1.
% oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.14.0-0.test-2023-08-10-015323-ci-ln-4n63sjk-latest True False 3h4m Cluster version is 4.14.0-0.test-2023-08-10-015323-ci-ln-4n63sjk-latest

% oc get -n aws-load-balancer-operator pods
NAME READY STATUS RESTARTS AGE
aws-load-balancer-controller-cluster-6b8c4db884-q45j5 1/1 Running 0 9m38s
aws-load-balancer-operator-controller-manager-574896dcdc-lnz6j 2/2 Running 0 14m
%

% oc create -f ingress-test-internet-facing.yaml
Error from server (InternalError): error when creating "ingress-test-internet-facing.yaml": Internal error occurred: failed calling webhook "vingress.elbv2.k8s.aws": failed to call webhook: Post "https://aws-load-balancer-controller-cluster.aws-load-balancer-operator.svc:9443/validate-networking-v1-ingress?timeout=10s": remote error: tls: protocol version not supported
%
`

[alebedev87]

@ShudiLi : you are right. The new image with this controller's code needs to be added to ALBO. A PR for ALBO is coming.

UPD: but first, this PR has to be merged.

[openshift-ci]

@alebedev87: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers, only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Note
kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers (as the upstream PR did), only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is invalid:

• expected the bug to target the "4.14.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Note
kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers (as the upstream PR did), only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Note
kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers (as the upstream PR did), only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci-robot]

@alebedev87: This pull request references Jira Issue OCPBUGS-14846, which is valid.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.14.0) matches configured target version for branch (4.14.0)
• bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Note
kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers (as the upstream PR did), only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

# controller is there
$ oc -n aws-load-balancer-operator get pods
NAME                                                             READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4             1/1     Running   0          2m19s
aws-load-balancer-operator-controller-manager-85d94d56c5-mjpq6   2/2     Running   0          5m11s

# it uses a manually built image (same as in the operator PR, see above)
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4 -o yaml | yq .spec.containers[0].image
quay.io/aws-load-balancer-operator/aws-load-balancer-controller:8.10.234-tls12

# ingress webhook is on
$ oc -n aws-load-balancer-operator logs aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4 | grep 'webhook.*ingress'
{"level":"info","ts":1691706492.4913087,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/validate-networking-v1-ingress"}

# ingress resource got created with no TLS errors
$ oc -n echoserver get ing
NAME         CLASS   HOSTS   ADDRESS                                                                   PORTS   AGE
echoserver   alb     *       k8s-echoserv-echoserv-314d49d2d2-1425878010.us-east-1.elb.amazonaws.com   80      42s

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[frobware]

/lgtm

[openshift-ci-robot]

@alebedev87: Jira Issue OCPBUGS-14846: All pull requests linked via external trackers have merged:

• openshift/aws-load-balancer-controller#12

Jira Issue OCPBUGS-14846 has been moved to the MODIFIED state.

In response to this:

The goal of this PR is to support environments where TLS versions 1.2 is still used, mainly FIPS enabled systems. The boringcrypto enabled builds check for the maximum FIPS TLS version which is set to TLS1.2.

Initial upstream PR: kubernetes-sigs#3313
Upstream follow-up PR: kubernetes-sigs#3318

Note
kubernetes-sigs#3318 uses TLSOpts of the webhook server, it's a feature which is available in controller-runtime 0.14.x. The currently used controller-runtime doesn't have it, so we cannot specify ciphers (as the upstream PR did), only the minimum TLS version.

Test
Operator e2e (not FIPS): openshift/aws-load-balancer-operator#99
Manual test (FIPS):

# controller is there
$ oc -n aws-load-balancer-operator get pods
NAME                                                             READY   STATUS    RESTARTS   AGE
aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4             1/1     Running   0          2m19s
aws-load-balancer-operator-controller-manager-85d94d56c5-mjpq6   2/2     Running   0          5m11s

# it uses a manually built image (same as in the operator PR, see above)
$ oc -n aws-load-balancer-operator get pods aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4 -o yaml | yq .spec.containers[0].image
quay.io/aws-load-balancer-operator/aws-load-balancer-controller:8.10.234-tls12

# ingress webhook is on
$ oc -n aws-load-balancer-operator logs aws-load-balancer-controller-cluster-fcbc7bbdb-7rnx4 | grep 'webhook.*ingress'
{"level":"info","ts":1691706492.4913087,"logger":"controller-runtime.webhook","msg":"registering webhook","path":"/validate-networking-v1-ingress"}

# ingress resource got created with no TLS errors
$ oc -n echoserver get ing
NAME         CLASS   HOSTS   ADDRESS                                                                   PORTS   AGE
echoserver   alb     *       k8s-echoserv-echoserv-314d49d2d2-1425878010.us-east-1.elb.amazonaws.com   80      42s

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.