Skip to content

Commit 6c94d8f

Browse files
knative-automationknative-automation
authored
upgrade to latest dependencies (#2211)
bumping knative.dev/caching 2e73993...ca66f55: > ca66f55 upgrade to latest dependencies (# 982) bumping knative.dev/serving fcb2e4d...2b62189: > 2b62189 Update net-kourier nightly (# 16311) > fcaad85 Update net-contour nightly (# 16310) > 753105b Update net-gateway-api nightly (# 16309) > 343df7e Add terminationGracePeriodSeconds support to user and sidecar container probes (# 15823) (# 16255) > edc1c64 Validate networking annotations on RevisionTemplateSpec (# 16296) > cc306d4 Prevent cross-service revision traffic routing (# 16294) > cc1012c Update net-istio nightly (# 16308) > 1e52818 upgrade to latest dependencies (# 16306) bumping knative.dev/networking 5082b02...9b53ca0: > 9b53ca0 upgrade to latest dependencies (# 1104) bumping knative.dev/pkg 9c8140b...80c8bc4: > 80c8bc4 Add TLSMaxVersion, TLSCipherSuites, and TLSCurvePreferences to webhook.Options for enhanced TLS control (# 3300) bumping knative.dev/reconciler-test 7b51b2a...d67001b: > d67001b upgrade to latest dependencies (# 851) Signed-off-by: Knative Automation <[email protected]>
1 parent 0ecd245 commit 6c94d8f

File tree

8 files changed

+203
-21
lines changed

8 files changed

+203
-21
lines changed

‎go.mod‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,12 +20,12 @@ require (
2020
k8s.io/apimachinery v0.34.3
2121
k8s.io/client-go v0.34.3
2222
k8s.io/code-generator v0.34.3
23-
knative.dev/caching v0.0.0-20251216133124-2e739933d68e
23+
knative.dev/caching v0.0.0-20251217015426-ca66f558da49
2424
knative.dev/eventing v0.47.1-0.20251216143128-de3db52821ed
2525
knative.dev/hack v0.0.0-20251126013634-1484a9e9b641
26-
knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1
27-
knative.dev/reconciler-test v0.0.0-20251216135827-7b51b2a66f40
28-
knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b
26+
knative.dev/pkg v0.0.0-20251217214024-80c8bc434670
27+
knative.dev/reconciler-test v0.0.0-20251217021727-d67001b5cfe8
28+
knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e
2929
sigs.k8s.io/yaml v1.6.0
3030
)
3131

@@ -163,7 +163,7 @@ require (
163163
k8s.io/klog/v2 v2.130.1 // indirect
164164
k8s.io/kube-openapi v0.0.0-20250710124328-f3f2b991d03b // indirect
165165
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 // indirect
166-
knative.dev/networking v0.0.0-20251127155419-5082b02af8c1 // indirect
166+
knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a // indirect
167167
sigs.k8s.io/controller-runtime v0.19.0 // indirect
168168
sigs.k8s.io/gateway-api v1.1.0 // indirect
169169
sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect

‎go.sum‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1712,20 +1712,20 @@ k8s.io/utils v0.0.0-20210819203725-bdf08cb9a70a/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
17121712
k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
17131713
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397 h1:hwvWFiBzdWw1FhfY1FooPn3kzWuJ8tmbZBHi4zVsl1Y=
17141714
k8s.io/utils v0.0.0-20250604170112-4c0f3b243397/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
1715-
knative.dev/caching v0.0.0-20251216133124-2e739933d68e h1:edSrbljmQ1Of6kwITD+2s0WxHlb3znirV5PATyRMa9U=
1716-
knative.dev/caching v0.0.0-20251216133124-2e739933d68e/go.mod h1:dVixpGQv0Z5i7yvzTS6BGG/N0YRcPn2K6Mf9/cG7gCw=
1715+
knative.dev/caching v0.0.0-20251217015426-ca66f558da49 h1:9Y7FO0YRgWBtP+oDG/n338xi7SgovzQFX7TYe4xiZuU=
1716+
knative.dev/caching v0.0.0-20251217015426-ca66f558da49/go.mod h1:TCKRvTMlMsaHartet7axY20EFT8xsU/O3EE39fi4Gl8=
17171717
knative.dev/eventing v0.47.1-0.20251216143128-de3db52821ed h1:WRRrn0VC0MnS4f7ub3L1porV3JgibGJA+p6Poz0zwhY=
17181718
knative.dev/eventing v0.47.1-0.20251216143128-de3db52821ed/go.mod h1:g9yjoJnpE1tuQRb7ccqx31GLLKN5J6mSMlAVcVJZLQw=
17191719
knative.dev/hack v0.0.0-20251126013634-1484a9e9b641 h1:N9Xqx3YLUNFN1WIc3UXTanK4je8VMQ36ZnAmECSsloc=
17201720
knative.dev/hack v0.0.0-20251126013634-1484a9e9b641/go.mod h1:L5RzHgbvam0u8QFHfzCX6MKxu/a/gIGEdaRBqNiVbl0=
1721-
knative.dev/networking v0.0.0-20251127155419-5082b02af8c1 h1:cZToEK7gp9ZQP+De14NFjt6874PdsrH7DH1DPxjCKVc=
1722-
knative.dev/networking v0.0.0-20251127155419-5082b02af8c1/go.mod h1:nxN+sYiQCoT2FLgSMTShXYmYYcb7rALHSOz6l5RjCp4=
1723-
knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1 h1:pSZ4sRKm/Kq1ec+7Yhow6jUH0FKZjzrUHpPsy6Lu8pE=
1724-
knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1/go.mod h1:jU9OxeX3zL4W6aHpdMjMA/B7kgkm5JQv6PGMod2Qu/M=
1725-
knative.dev/reconciler-test v0.0.0-20251216135827-7b51b2a66f40 h1:l2wkSzK8EMv30UypsG4s5hjwCFxMZ1PxiDzGhGy48yk=
1726-
knative.dev/reconciler-test v0.0.0-20251216135827-7b51b2a66f40/go.mod h1:qso1gDknkL/+DJh6hD0Z8EuWgyPvaXE/LKAdokEarZY=
1727-
knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b h1:ryyfEOYDc42GVbf5ZhikAcGg5zAXAhNu5LJNwPb1GiM=
1728-
knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b/go.mod h1:FDSziSYWrPQZ/RwX/fONtpTXZhDwXtOIBjIY5BbB7Wc=
1721+
knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a h1:IRy795/m6VioHzXIRtuYXzp7CHeF47STsP3W4++h4w0=
1722+
knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a/go.mod h1:BDVceWHtCs3jrBQzkd83vSw98zhOkO1Q7hJSuPU3hDM=
1723+
knative.dev/pkg v0.0.0-20251217214024-80c8bc434670 h1:MKgHnTvNprMn+Tr73CRB088PqR22q4KuVFIBTLFltwA=
1724+
knative.dev/pkg v0.0.0-20251217214024-80c8bc434670/go.mod h1:jU9OxeX3zL4W6aHpdMjMA/B7kgkm5JQv6PGMod2Qu/M=
1725+
knative.dev/reconciler-test v0.0.0-20251217021727-d67001b5cfe8 h1:1Ilv2iZEvRTSMO2JRYFCnYIpbMSEgMUphkSkj336VMU=
1726+
knative.dev/reconciler-test v0.0.0-20251217021727-d67001b5cfe8/go.mod h1:qZfVnTPMH0YPk3fBo09BsIJkk2HbdSMoq1rhHuWTtow=
1727+
knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e h1:GN399Z2pWdIL1uU3zU/mmnApdYwAvClu6yQjpeZ6NJU=
1728+
knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e/go.mod h1:SEhF2H2ZtmDwJNHOBi97TEiGKbF2so3/+m5prHGOu7o=
17291729
nhooyr.io/websocket v1.8.6/go.mod h1:B70DZP8IakI65RVQ51MsWP/8jndNma26DVA/nFSCgW0=
17301730
pgregory.net/rapid v1.1.0 h1:CMa0sjHSru3puNx+J0MIAuiiEV4N0qj8/cMWGBBCsjw=
17311731
pgregory.net/rapid v1.1.0/go.mod h1:PY5XlDGj0+V1FCq0o192FdRhpKHGTRIWBgqjDBTrq04=

‎vendor/knative.dev/pkg/webhook/README.md‎

Lines changed: 143 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,149 @@ func main() {
7878
There is also a config map validation admission controller built in under
7979
`knative.dev/pkg/webhook/configmaps`.
8080

81+
## TLS Configuration
82+
83+
The webhook server supports configuring TLS parameters through the `webhook.Options` struct. This allows you to control the TLS version, cipher suites, and elliptic curve preferences for enhanced security.
84+
85+
### Available TLS Options
86+
87+
```go
88+
type Options struct {
89+
// ... other fields ...
90+
91+
// TLSMinVersion contains the minimum TLS version that is acceptable.
92+
// Default is TLS 1.3 if not specified.
93+
// Supported values: tls.VersionTLS12, tls.VersionTLS13
94+
TLSMinVersion uint16
95+
96+
// TLSMaxVersion contains the maximum TLS version that is acceptable.
97+
// If not set (0), the maximum version supported by the implementation will be used.
98+
// Useful for enforcing Modern profile (TLS 1.3 only) by setting both
99+
// TLSMinVersion and TLSMaxVersion to tls.VersionTLS13.
100+
TLSMaxVersion uint16
101+
102+
// TLSCipherSuites specifies the list of enabled cipher suites.
103+
// If empty, a default list of secure cipher suites will be used.
104+
// Note: Cipher suites are not configurable in TLS 1.3; they are
105+
// determined by the implementation.
106+
TLSCipherSuites []uint16
107+
108+
// TLSCurvePreferences specifies the elliptic curves that will be used
109+
// in an ECDHE handshake. If empty, the default curves will be used.
110+
TLSCurvePreferences []tls.CurveID
111+
}
112+
```
113+
114+
### Environment Variable Configuration
115+
116+
You can also configure the minimum TLS version via the `WEBHOOK_TLS_MIN_VERSION` environment variable:
117+
118+
```yaml
119+
env:
120+
- name: WEBHOOK_TLS_MIN_VERSION
121+
value: "1.3" # or "1.2"
122+
```
123+
124+
### Usage Examples
125+
126+
#### Example 1: Default Configuration (Recommended)
127+
128+
By default, the webhook uses TLS 1.3 as the minimum version with secure defaults:
129+
130+
```go
131+
ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
132+
ServiceName: "webhook",
133+
Port: 8443,
134+
SecretName: "webhook-certs",
135+
// TLS defaults: MinVersion=1.3, secure cipher suites and curves
136+
})
137+
```
138+
139+
#### Example 2: Modern Profile (TLS 1.3 Only)
140+
141+
To enforce TLS 1.3 only (highest security profile):
142+
143+
```go
144+
ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
145+
ServiceName: "webhook",
146+
Port: 8443,
147+
SecretName: "webhook-certs",
148+
TLSMinVersion: tls.VersionTLS13,
149+
TLSMaxVersion: tls.VersionTLS13, // Enforce TLS 1.3 only
150+
})
151+
```
152+
153+
#### Example 3: Intermediate Profile (TLS 1.2+)
154+
155+
For broader compatibility while maintaining security:
156+
157+
```go
158+
ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
159+
ServiceName: "webhook",
160+
Port: 8443,
161+
SecretName: "webhook-certs",
162+
TLSMinVersion: tls.VersionTLS12,
163+
})
164+
```
165+
166+
#### Example 4: Custom Cipher Suites
167+
168+
To specify custom cipher suites (for TLS 1.2):
169+
170+
```go
171+
ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
172+
ServiceName: "webhook",
173+
Port: 8443,
174+
SecretName: "webhook-certs",
175+
TLSMinVersion: tls.VersionTLS12,
176+
TLSCipherSuites: []uint16{
177+
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
178+
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
179+
tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
180+
tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
181+
},
182+
})
183+
```
184+
185+
#### Example 5: Custom Elliptic Curves
186+
187+
To specify elliptic curve preferences:
188+
189+
```go
190+
ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
191+
ServiceName: "webhook",
192+
Port: 8443,
193+
SecretName: "webhook-certs",
194+
TLSCurvePreferences: []tls.CurveID{
195+
tls.X25519, // Preferred
196+
tls.CurveP256,
197+
tls.CurveP384,
198+
},
199+
})
200+
```
201+
202+
#### Example 6: Complete Custom Configuration
203+
204+
For full control over TLS parameters:
205+
206+
```go
207+
ctx := webhook.WithOptions(signals.NewContext(), webhook.Options{
208+
ServiceName: "webhook",
209+
Port: 8443,
210+
SecretName: "webhook-certs",
211+
TLSMinVersion: tls.VersionTLS12,
212+
TLSMaxVersion: tls.VersionTLS13,
213+
TLSCipherSuites: []uint16{
214+
tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
215+
tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
216+
},
217+
TLSCurvePreferences: []tls.CurveID{
218+
tls.X25519,
219+
tls.CurveP256,
220+
},
221+
})
222+
```
223+
81224
## Writing new Admission Controllers
82225

83226
To implement your own admission controller akin to the resource defaulting and

‎vendor/knative.dev/pkg/webhook/webhook.go‎

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,21 @@ type Options struct {
5252
// TLS 1.3 is the minimum version if not specified otherwise.
5353
TLSMinVersion uint16
5454

55+
// TLSMaxVersion contains the maximum TLS version that is acceptable.
56+
// If not set (0), the maximum version supported by the implementation will be used.
57+
// This is useful for enforcing Modern profile (TLS 1.3 only) by setting both
58+
// TLSMinVersion and TLSMaxVersion to tls.VersionTLS13.
59+
TLSMaxVersion uint16
60+
61+
// TLSCipherSuites specifies the list of enabled cipher suites.
62+
// If empty, a default list of secure cipher suites will be used.
63+
// Note: Cipher suites are not configurable in TLS 1.3; they are determined by the implementation.
64+
TLSCipherSuites []uint16
65+
66+
// TLSCurvePreferences specifies the elliptic curves that will be used in an ECDHE handshake.
67+
// If empty, the default curves will be used.
68+
TLSCurvePreferences []tls.CurveID
69+
5570
// ServiceName is the service name of the webhook.
5671
ServiceName string
5772

@@ -191,7 +206,10 @@ func New(
191206

192207
//nolint:gosec // operator configures TLS min version (default is 1.3)
193208
webhook.tlsConfig = &tls.Config{
194-
MinVersion: opts.TLSMinVersion,
209+
MinVersion: opts.TLSMinVersion,
210+
MaxVersion: opts.TLSMaxVersion,
211+
CipherSuites: opts.TLSCipherSuites,
212+
CurvePreferences: opts.TLSCurvePreferences,
195213

196214
// If we return (nil, error) the client sees - 'tls: internal error"
197215
// If we return (nil, nil) the client sees - 'tls: no certificates configured'

‎vendor/knative.dev/serving/pkg/apis/serving/fieldmask.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"slices"
2525

2626
corev1 "k8s.io/api/core/v1"
27+
2728
"knative.dev/serving/pkg/apis/config"
2829
)
2930

@@ -384,6 +385,7 @@ func ProbeMask(in *corev1.Probe) *corev1.Probe {
384385
out.PeriodSeconds = in.PeriodSeconds
385386
out.SuccessThreshold = in.SuccessThreshold
386387
out.FailureThreshold = in.FailureThreshold
388+
out.TerminationGracePeriodSeconds = in.TerminationGracePeriodSeconds
387389

388390
return out
389391
}

‎vendor/knative.dev/serving/pkg/apis/serving/v1/revision_validation.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import (
2525

2626
"k8s.io/apimachinery/pkg/api/resource"
2727
"k8s.io/apimachinery/pkg/api/validation"
28+
"knative.dev/networking/pkg/apis/networking"
2829
"knative.dev/pkg/apis"
2930
"knative.dev/pkg/kmap"
3031
"knative.dev/pkg/kmp"
@@ -66,6 +67,7 @@ func (rts *RevisionTemplateSpec) Validate(ctx context.Context) *apis.FieldError
6667
errs := rts.Spec.Validate(apis.WithinSpec(ctx)).ViaField("spec")
6768
errs = errs.Also(autoscaling.ValidateAnnotations(ctx, config.FromContextOrDefaults(ctx).Autoscaler,
6869
rts.GetAnnotations()).ViaField("metadata.annotations"))
70+
errs = errs.Also(networking.ValidateAnnotations(rts.GetAnnotations()).ViaField("metadata.annotations"))
6971

7072
// If the RevisionTemplateSpec has a name specified, then check that
7173
// it follows the requirements on the name.

‎vendor/knative.dev/serving/pkg/apis/serving/v1/route_lifecycle.go‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,23 @@ func (rs *RouteStatus) MarkRevisionFailed(name string) {
155155
"Revision %q failed to become ready.", name)
156156
}
157157

158+
// MarkRevisionNotOwned marks the RouteConditionAllTrafficAssigned condition
159+
// to indicate the Revision does not belong to the expected Service.
160+
func (rs *RouteStatus) MarkRevisionNotOwned(revisionName, expectedService, actualService string) {
161+
if actualService == "" {
162+
// Revision was created from a standalone Configuration (no known service)
163+
routeCondSet.Manage(rs).MarkFalse(RouteConditionAllTrafficAssigned,
164+
"RevisionNotOwned",
165+
"Revision %q does not belong to Service %q.", revisionName, expectedService)
166+
} else {
167+
// Revision belongs to a different Service
168+
routeCondSet.Manage(rs).MarkFalse(RouteConditionAllTrafficAssigned,
169+
"RevisionNotOwned",
170+
"Revision %q belongs to Service %q, not Service %q.",
171+
revisionName, actualService, expectedService)
172+
}
173+
}
174+
158175
// MarkMissingTrafficTarget marks the RouteConditionAllTrafficAssigned
159176
// condition to indicate a reference traffic target was not found.
160177
func (rs *RouteStatus) MarkMissingTrafficTarget(kind, name string) {

‎vendor/modules.txt‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1504,7 +1504,7 @@ k8s.io/utils/net
15041504
k8s.io/utils/pointer
15051505
k8s.io/utils/ptr
15061506
k8s.io/utils/trace
1507-
# knative.dev/caching v0.0.0-20251216133124-2e739933d68e
1507+
# knative.dev/caching v0.0.0-20251217015426-ca66f558da49
15081508
## explicit; go 1.24.0
15091509
knative.dev/caching/pkg/apis/caching
15101510
knative.dev/caching/pkg/apis/caching/v1alpha1
@@ -1604,7 +1604,7 @@ knative.dev/eventing/test/upgrade/prober/wathola/sender
16041604
# knative.dev/hack v0.0.0-20251126013634-1484a9e9b641
16051605
## explicit; go 1.24
16061606
knative.dev/hack
1607-
# knative.dev/networking v0.0.0-20251127155419-5082b02af8c1
1607+
# knative.dev/networking v0.0.0-20251216133826-9b53ca077e6a
16081608
## explicit; go 1.24.0
16091609
knative.dev/networking/pkg/apis/networking
16101610
knative.dev/networking/pkg/apis/networking/v1alpha1
@@ -1615,7 +1615,7 @@ knative.dev/networking/pkg/client/clientset/versioned/typed/networking/v1alpha1
16151615
knative.dev/networking/pkg/config
16161616
knative.dev/networking/pkg/http/header
16171617
knative.dev/networking/pkg/ingress
1618-
# knative.dev/pkg v0.0.0-20251216153728-9c8140b780d1
1618+
# knative.dev/pkg v0.0.0-20251217214024-80c8bc434670
16191619
## explicit; go 1.24.0
16201620
knative.dev/pkg/apiextensions/storageversion
16211621
knative.dev/pkg/apiextensions/storageversion/cmd/migrate
@@ -1706,7 +1706,7 @@ knative.dev/pkg/webhook
17061706
knative.dev/pkg/webhook/certificates
17071707
knative.dev/pkg/webhook/certificates/resources
17081708
knative.dev/pkg/webhook/resourcesemantics/conversion
1709-
# knative.dev/reconciler-test v0.0.0-20251216135827-7b51b2a66f40
1709+
# knative.dev/reconciler-test v0.0.0-20251217021727-d67001b5cfe8
17101710
## explicit; go 1.24.0
17111711
knative.dev/reconciler-test/cmd/eventshub
17121712
knative.dev/reconciler-test/pkg/environment
@@ -1735,7 +1735,7 @@ knative.dev/reconciler-test/pkg/resources/service
17351735
knative.dev/reconciler-test/pkg/resources/serviceaccount
17361736
knative.dev/reconciler-test/pkg/state
17371737
knative.dev/reconciler-test/resources/certificate
1738-
# knative.dev/serving v0.47.1-0.20251216154926-fcb2e4d0f74b
1738+
# knative.dev/serving v0.47.1-0.20251218010245-2b621899e32e
17391739
## explicit; go 1.24.0
17401740
knative.dev/serving/pkg/apis/autoscaling
17411741
knative.dev/serving/pkg/apis/autoscaling/v1alpha1

0 commit comments

Comments
 (0)