Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bug 1847318: set TLS min version to 1.2 #826

Merged
merged 1 commit into from Jul 4, 2020
Merged

Bug 1847318: set TLS min version to 1.2 #826

merged 1 commit into from Jul 4, 2020

Conversation

pgier
Copy link
Contributor

@pgier pgier commented Jun 25, 2020 •
edited

Change the TLS min version in prometheus-operator to 1.2 from the default of 1.3.

  • No user facing changes, so no entry in CHANGELOG was needed.

@openshift-ci-robot openshift-ci-robot added the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Jun 25, 2020
@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jun 25, 2020
@pgier
Copy link
Contributor Author

pgier commented Jun 25, 2020

/hold
Creating this PR for testing possible fix for bz1847318

@openshift-ci-robot openshift-ci-robot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 25, 2020
@pgier
Copy link
Contributor Author

pgier commented Jun 25, 2020

/retest

@s-urbaniak
Copy link
Contributor

/test e2e-aws

@s-urbaniak
Copy link
Contributor

@pgier can you give some references why we need to remove configuring tls cipher suites for the webhooks?

@pgier
Copy link
Contributor Author

pgier commented Jun 26, 2020

@s-urbaniak I noticed that the other validation webhooks currently in openshift do not set any TLS cipher suites, so just wanted to test this.

@pgier pgier force-pushed the bz1847318 branch 2 times, most recently from 98a59fa to 2894fa2 Compare June 29, 2020 18:05
@pgier pgier changed the title [WIP] remove TLS cipher suites for prometheus-operator Bug 1847318: set TLS min version to 1.2 Jun 29, 2020
@openshift-ci-robot openshift-ci-robot added bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. labels Jun 29, 2020
@openshift-ci-robot
Copy link
Contributor

@pgier: This pull request references Bugzilla bug 1847318, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.6.0) matches configured target release for branch (4.6.0)
  • bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1847318: set TLS min version to 1.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@pgier
Copy link
Contributor Author

pgier commented Jun 29, 2020

/hold cancel

@openshift-ci-robot openshift-ci-robot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Jun 29, 2020
@openshift-ci-robot
Copy link
Contributor

@pgier: This pull request references Bugzilla bug 1847318, which is valid.

3 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.6.0) matches configured target release for branch (4.6.0)
  • bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

Bug 1847318: set TLS min version to 1.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@s-urbaniak
Copy link
Contributor

@pgier we had some issues in CI yesterday. do you mind to rebase and retest?

@pgier
Copy link
Contributor Author

pgier commented Jun 30, 2020

/retest

1 similar comment
@lilic
Copy link
Contributor

lilic commented Jul 1, 2020

/retest

@pgier
Bug 1847318: set prometheus operator TLS min version to 1.2
b641192 
The default TLS min version in prometheus operator is 1.3.
TLS version 1.3 causes a communication failure between the API server and
prometheus-operator "tls: protocol version not supported".
@pgier
Copy link
Contributor Author

pgier commented Jul 1, 2020

/retest

@pgier
Copy link
Contributor Author

pgier commented Jul 1, 2020

@s-urbaniak please take a look again

@s-urbaniak
Copy link
Contributor

/lgtm

@openshift-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pgier, s-urbaniak

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 2, 2020
@s-urbaniak
Copy link
Contributor

@bparees i am very sorry, can you remind me again whom we can ping about the FIPS compliance and verify "we are doing the right thing" here?

@bparees
Copy link
Contributor

bparees commented Jul 2, 2020

@bparees i am very sorry, can you remind me again whom we can ping about the FIPS compliance and verify "we are doing the right thing" here?

Kirsten Newcomer was the PM who might be able to point you to some experts. David Eads also suggested Simo Sorce as a security engineer who was involved.

@pgier
Copy link
Contributor Author

pgier commented Jul 2, 2020

/retest

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

22 similar comments
@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-bot
Copy link
Contributor

/retest

Please review the full test history for this PR and help us cut down flakes.

@openshift-merge-robot openshift-merge-robot merged commit 6c2ec7a into openshift:master Jul 4, 2020
@openshift-ci-robot
Copy link
Contributor

@pgier: All pull requests linked via external trackers have merged: openshift/cluster-monitoring-operator#826. Bugzilla bug 1847318 has been moved to the MODIFIED state.

In response to this:

Bug 1847318: set TLS min version to 1.2

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@s-urbaniak s-urbaniak Awaiting requested review from s-urbaniak

@simonpasquier simonpasquier Awaiting requested review from simonpasquier

Assignees

@s-urbaniak s-urbaniak

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-high Referenced Bugzilla bug's severity is high for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
7 participants
@pgier @s-urbaniak @openshift-ci-robot @lilic @bparees @openshift-bot @openshift-merge-robot