Merge pull request #826 from pgier/bz1847318

Bug 1847318: set TLS min version to 1.2
openshift · Jul 4, 2020 · 6c2ec7a · 6c2ec7a
2 parents 57d3e97 + b641192
commit 6c2ec7a
Show file tree

Hide file tree

Showing 3 changed files with 4 additions and 2 deletions.
diff --git a/assets/prometheus-operator/deployment.yaml b/assets/prometheus-operator/deployment.yaml
@@ -34,6 +34,7 @@ spec:
         - --config-reloader-memory=0
         - --web.enable-tls=true
         - --web.tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
+        - --web.tls-min-version=VersionTLS12
         - --manage-crds=false
         image: quay.io/coreos/prometheus-operator:v0.38.1
         name: prometheus-operator

diff --git a/jsonnet/prometheus-operator.jsonnet b/jsonnet/prometheus-operator.jsonnet
@@ -39,6 +39,7 @@ local certsCAVolumeName = 'operator-certs-ca-bundle';
                           '--config-reloader-memory=0',
                           '--web.enable-tls=true',
                           '--web.tls-cipher-suites=' + std.join(',', $._config.tlsCipherSuites),
+                          '--web.tls-min-version=VersionTLS12',
                           '--manage-crds=false',
                         ],
                         securityContext: {},

diff --git a/pkg/manifests/bindata.go b/pkg/manifests/bindata.go