[release-1.21] Backport centralized TLS configuration#8966
[release-1.21] Backport centralized TLS configuration#8966Fedosin wants to merge 2 commits intoknative:release-1.21from
Conversation
…#8901) Bump knative.dev/pkg to pick up the new knative.dev/pkg/tls package and replace the hardcoded TLS server config in eventingtls with the shared DefaultConfigFromEnv utility. This enables environment-based control of MinVersion, MaxVersion, CipherSuites, and CurvePreferences for all eventing TLS servers (broker filter/ingress, IMC dispatcher, job sink, auth proxy, request-reply). Since DefaultConfigFromEnv defaults to TLS 1.3 but eventing historically defaults to TLS 1.2, GetTLSServerConfig falls back to 1.2 unless TLS_MIN_VERSION is explicitly set. Also wires up TLS for the RequestReply data plane, which previously had a TODO placeholder. Signed-off-by: Mikhail Fedosin <mfedosin@redhat.com>
The knative.dev/pkg/tls package has been relocated to knative.dev/pkg/network/tls. Update all import references accordingly.
knative-prow
bot
added
the
size/L
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: Fedosin The full list of commands accepted by this bot can be found here. DetailsNeeds approval from an approver in each of these files:Approvers can indicate their approval by writing |
|
@Fedosin: The following tests failed, say
DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
Proposed Changes
Backport of #8901 and #8912 to
release-1.21.Cherry-picked commits
feat: use centralized TLS configuration from knative/pkg/tls (feat: use centralized TLS configuration from knative/pkg/tls #8901)
Bump knative.dev/pkg to pick up the new knative.dev/pkg/tls package and replace the hardcoded TLS server config in eventingtls with the shared DefaultConfigFromEnv utility. This enables environment-based control of MinVersion, MaxVersion, CipherSuites, and CurvePreferences for all eventing TLS servers (broker filter/ingress, IMC dispatcher, job sink, auth proxy, request-reply).
Since DefaultConfigFromEnv defaults to TLS 1.3 but eventing historically defaults to TLS 1.2, GetTLSServerConfig falls back to 1.2 unless TLS_MIN_VERSION is explicitly set.
Also wires up TLS for the RequestReply data plane, which previously had a TODO placeholder.
Update TLS import path to knative.dev/pkg/network/tls (Update TLS import path to knative.dev/pkg/network/tls #8912)
The knative.dev/pkg/tls package has been relocated to knative.dev/pkg/network/tls. Update all import references accordingly.
Release Note