TLS 1.0 and Weak cipher suites enabled on ports 9001 & 9002 & 6443
Bug #2043217 reported by
Karla Felix
This bug affects 1 person
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
StarlingX |
Fix Released
|
Medium
|
Karla Felix |
Bug Description
Description of failure
The team has concerns with SSL and TLS 1.0 in Starlingx. TLS 1.0 is still supported on ports 9001 & 9002. Also, ports 6443 and 9002 support weak cipher suites. Please see the list attached. Document shows TLS 1.3 is already supported.
Issue intermittent (Frequency of occurrence) or 100% Reproducible?
Issue seen on environment
Impact of Failure
Medium - security concern
Changed in starlingx: | |
status: | New → In Progress |
description: | updated |
tags: | added: stx.9.0 stx.security |
information type: | Public → Public Security |
Changed in starlingx: | |
importance: | Undecided → Medium |
description: | updated |
Changed in starlingx: | |
status: | Fix Released → In Progress |
assignee: | nobody → Karla Felix (kkarolin) |
To post a comment you must log in.
Reviewed: https:/ /review. opendev. org/c/starlingx /ansible- playbooks/ +/899984 /opendev. org/starlingx/ ansible- playbooks/ commit/ ae20ef5fd27d2dc 4371443c00e795b 2bf9417650
Committed: https:/
Submitter: "Zuul (22348)"
Branch: master
commit ae20ef5fd27d2dc 4371443c00e795b 2bf9417650
Author: Karla Felix <email address hidden>
Date: Thu Nov 2 16:51:23 2023 -0300
Add var for minimum tls version and cipher suites
This commit will add variables to minimum tls version and the kubernetes/ manifests/ kube-apiserver. yaml.
allowed specific cipher suites in the bootstrap playbook. This
variables will be added to
/etc/
The yamline disable-line is used because during the parse to apiserver. yaml the string could not have any blank spaces
kube-
or kubelet service will not start.
Test Plan:
PASS: Run build-image.
"tls- cipher- suites" are present in
/etc/ kubernetes/ manifests/ kube-apiserver. yaml.
PASS: Run build-pkgs -c -p playbookconfig.
PASS: Verify if the flags "--tls-min-version" and
PASS: Verify if port 6443 is blocking tls version 1.0,
1.1 and weak cipher suites.
Closes-Bug: 2043217
Change-Id: I2af86387dc14ec 89f9c3d652dfc49 83c8fc06e5c
Signed-off-by: Karla Felix <email address hidden>