Skip to content

Commit da6e527

Browse files
bmcelveebmcelvee
authored
Merge pull request #64926 from skopacz1/OSDOCS-7826
OSDOCS#7826: Migrate Configuring custom TLS ciphers from MOBB to ROSA
2 parents 9c712e6 + f6a5693 commit da6e527

File tree

2 files changed

+224
-2
lines changed

2 files changed

+224
-2
lines changed

‎_topic_maps/_topic_map_rosa.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -78,12 +78,14 @@ Topics:
7878
# - Name: Training for ROSA
7979
# File: rosa-training
8080
---
81-
Name: Tutorials
82-
Dir: rosa_tutorials
81+
Name: Tutorials
82+
Dir: rosa_tutorials
8383
Distros: openshift-rosa
8484
Topics:
8585
- Name: ROSA prerequisites
8686
File: rosa-mobb-prerequisites-tutorial
87+
- Name: Configuring ROSA/OSD to use custom TLS ciphers on the ingress controllers
88+
File: rosa-mobb-configure-custom-tls-ciphers
8789
---
8890
Name: Getting started
8991
Dir: rosa_getting_started

‎rosa_tutorials/rosa-mobb-configure-custom-tls-ciphers.adoc

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,220 @@
1+
:_content-type: ASSEMBLY
2+
[id="rosa-mobb-configure-cutsom-tls-ciphers"]
3+
= Tutorial: Configuring ROSA/OSD to use custom TLS ciphers on the ingress controllers
4+
include::_attributes/attributes-openshift-dedicated.adoc[]
5+
:context: rosa-mobb-configure-cutsom-tls-ciphers
6+
7+
toc::[]
8+
9+
// ---
10+
// date: '2022-08-24'
11+
// title: Configure ROSA/OSD to use custom TLS ciphers on the ingress controllers
12+
// aliases: ['/docs/ingress/tls-cipher-customization']
13+
// tags: ["ROSA", "AWS", "OSD"]
14+
// authors:
15+
// - Michael McNeill
16+
// - Connor Wooley
17+
// ---
18+
19+
This guide demonstrates how to properly patch the cluster ingress controllers, as well as ingress controllers created by the Custom Domain Operator.
20+
This functionality allows customers to modify the `tlsSecurityProfile` value on cluster ingress controllers.
21+
This guide will demonstrate how to apply a custom `tlsSecurityProfile`, a scoped service account (with the associated role and role binding), and a CronJob that the cipher changes are reapplied with 60 minutes (in the event that an ingress controller is recreated or modified).
22+
23+
.Prerequisites
24+
25+
* Review the link:https://docs.openshift.com/container-platform/4.13/networking/ingress-operator.html#configuring-ingress-controller-tls[OpenShift Documentation that explains the options for the `tlsSecurityProfile`]. By default, ingress controllers are configured to use the `Intermediate` profile, which corresponds to the link:https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29[Intermediate Mozilla profile].
26+
27+
.Procedure
28+
29+
. Create a service account for the CronJob to use.
30+
+
31+
A service account allows our CronJob to directly access the cluster API, without using a regular user's credentials.
32+
To create a service account, run the following command:
33+
+
34+
[source,terminal]
35+
----
36+
$ oc create sa cron-ingress-patch-sa -n openshift-ingress-operator
37+
----
38+
39+
. Create a role and role binding that allows limited access to patch the ingress controllers.
40+
+
41+
Role-based access control (RBAC) is critical to ensuring security inside your cluster.
42+
Creating a role allows us to provide scoped access to only the API resources we need within the cluster. To create the role, run the following command:
43+
+
44+
[source,terminal]
45+
----
46+
$ oc create role cron-ingress-patch-role --verb=get,patch,update --resource=ingresscontroller.operator.openshift.io -n openshift-ingress-operator
47+
----
48+
+
49+
Once the role has been created, you need to bind the role to the service account using a role binding.
50+
To create the role binding, run the following command:
51+
+
52+
[source,terminal]
53+
----
54+
$ oc create rolebinding cron-ingress-patch-rolebinding --role=cron-ingress-patch-role --serviceaccount=openshift-ingress-operator:cron-ingress-patch-sa -n openshift-ingress-operator
55+
----
56+
57+
. Patch the ingress controller.
58+
+
59+
[IMPORTANT]
60+
====
61+
The examples provided below add an additional cipher to the ingress controller's `tlsSecurityProfile` to allow IE 11 access from Windows Server 2008 R2.
62+
You should modify this command to meet your specific business requirements.
63+
====
64+
+
65+
Before we create the CronJob, we first want to apply the `tlsSecurityProfile` configuration to validate our changes.
66+
This process depends on if you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator].
67+
+
68+
.. Clusters not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
69+
+
70+
If you are only using the default ingress controller, and not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], run the following command to patch the ingress controller:
71+
+
72+
[source,terminal]
73+
----
74+
$ oc patch ingresscontroller/default -n openshift-ingress-operator --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Custom","custom":{"ciphers":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-CHACHA20-POLY1305","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"],"minTLSVersion":"VersionTLS12"}}}}'
75+
----
76+
+
77+
This patch will add the `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA` cipher which allows access from IE 11 on Windows Server 2008 R2 when using RSA certificates.
78+
+
79+
Once you have run the command, you will receive a response that looks like this:
80+
+
81+
.Example output
82+
[source,terminal]
83+
----
84+
ingresscontroller.operator.openshift.io/default patched
85+
----
86+
+
87+
.. Clusters using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
88+
+
89+
Customers who are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator] will need to loop through each of their ingress controllers to patch each one.
90+
To patch all of your cluster's ingress controllers, run the following command:
91+
+
92+
[source,terminal]
93+
----
94+
$ for ic in $(oc get ingresscontroller -o name -n openshift-ingress-operator); do oc patch ${ic} -n openshift-ingress-operator --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Custom","custom":{"ciphers":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-CHACHA20-POLY1305","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"],"minTLSVersion":"VersionTLS12"}}}}'; done
95+
----
96+
+
97+
Once you have run the command, you will receive a response that looks like this:
98+
+
99+
.Example output
100+
[source,terminal]
101+
----
102+
ingresscontroller.operator.openshift.io/default patched
103+
ingresscontroller.operator.openshift.io/custom1 patched
104+
ingresscontroller.operator.openshift.io/custom2 patched
105+
----
106+
107+
. Create the CronJob to ensure that the TLS configuration is not overwritten.
108+
+
109+
Occasionally, the cluster's ingress controller can get recreated. In these cases, the ingress controller will likely not retain the `tlsSecurityProfile` changes that we have made.
110+
To ensure this does not happen, we will create a CronJob that goes through and updates the cluster's ingress controller(s).
111+
This process depends on if you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator].
112+
+
113+
.. Clusters not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
114+
+
115+
If you are not using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], creating the CronJob is as simple as running the following command:
116+
+
117+
[source,terminal]
118+
----
119+
$ cat << EOF | oc apply -f -
120+
apiVersion: batch/v1
121+
kind: CronJob
122+
metadata:
123+
name: tls-patch
124+
namespace: openshift-ingress-operator
125+
spec:
126+
schedule: '@hourly'
127+
jobTemplate:
128+
spec:
129+
template:
130+
spec:
131+
containers:
132+
- name: tls-patch
133+
image: registry.redhat.io/openshift4/ose-tools-rhel8:latest
134+
args:
135+
- /bin/sh
136+
- '-c'
137+
- oc patch ingresscontroller/default -n openshift-ingress-operator --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Custom","custom":{"ciphers":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-CHACHA20-POLY1305","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"],"minTLSVersion":"VersionTLS12"}}}}'
138+
restartPolicy: Never
139+
serviceAccountName: cron-ingress-patch-sa
140+
EOF
141+
----
142+
+
143+
[NOTE]
144+
====
145+
This CronJob will run every hour, and will patch the ingress controller, if necessary.
146+
It is important that this CronJob does not run constantly, as it can trigger reconciles that could overload the OpenShift Ingress Operator.
147+
Most of the time, the logs of the CronJob pod will look something like this, as it will not be changing anything:
148+
149+
.Example output
150+
[source,terminal]
151+
----
152+
ingresscontroller.operator.openshift.io/default patched (no change)
153+
----
154+
====
155+
+
156+
.. Clusters using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator]:
157+
+
158+
If you are using the xref:../applications/deployments/osd-config-custom-domains-applications.adoc#osd-config-custom-domains-applications[Custom Domain Operator], the CronJob will need to loop through and patch each ingress controller.
159+
To create this CronJob, run the following command:
160+
+
161+
[source,terminal]
162+
----
163+
$ cat << EOF | oc apply -f -
164+
apiVersion: batch/v1
165+
kind: CronJob
166+
metadata:
167+
name: tls-patch
168+
namespace: openshift-ingress-operator
169+
spec:
170+
schedule: '@hourly'
171+
jobTemplate:
172+
spec:
173+
template:
174+
spec:
175+
containers:
176+
- name: tls-patch
177+
image: registry.redhat.io/openshift4/ose-tools-rhel8:latest
178+
args:
179+
- /bin/sh
180+
- '-c'
181+
- for ic in $(oc get ingresscontroller -o name -n openshift-ingress-operator); do oc patch ${ic} -n openshift-ingress-operator --type=merge -p '{"spec":{"tlsSecurityProfile":{"type":"Custom","custom":{"ciphers":["TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-CHACHA20-POLY1305","ECDHE-RSA-CHACHA20-POLY1305","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384","TLS_CHACHA20_POLY1305_SHA256","TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA"],"minTLSVersion":"VersionTLS12"}}}}'; done
182+
restartPolicy: Never
183+
serviceAccountName: cron-ingress-patch-sa
184+
EOF
185+
----
186+
+
187+
[NOTE]
188+
====
189+
This CronJob will run every hour, and will patch the ingress controller, if necessary. It is important that this CronJob does not run constantly, as it can trigger reconciles that could overload the OpenShift Ingress Operator. Most of the time, the logs of the CronJob pod will look something like this, as it will not be changing anything:
190+
191+
.Example output
192+
[source,terminal]
193+
----
194+
ingresscontroller.operator.openshift.io/default patched (no change)
195+
ingresscontroller.operator.openshift.io/custom1 patched (no change)
196+
ingresscontroller.operator.openshift.io/custom2 patched (no change)
197+
----
198+
====
199+
200+
201+
202+
203+
204+
205+
206+
207+
208+
209+
210+
211+
212+
213+
214+
215+
216+
217+
218+
219+
220+

0 commit comments

Comments
 (0)