Merge pull request #738 from tesshuflower/rbac-proxy-tls1.3

Restrict rbac proxy to tls1.3 minimum (cherry picked from commit 499df0e) Signed-off-by: Tesshu Flower <tflower@redhat.com>
backube · May 16, 2023 · e4281e3 · e4281e3
1 parent 750dc2d
commit e4281e3
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 0 deletions.
diff --git a/bundle/manifests/volsync.clusterserviceversion.yaml b/bundle/manifests/volsync.clusterserviceversion.yaml
@@ -417,6 +417,7 @@ spec:
                 - --secure-listen-address=0.0.0.0:8443
                 - --upstream=http://127.0.0.1:8080/
                 - --logtostderr=true
+                - --tls-min-version=VersionTLS13
                 - --v=0
                 image: quay.io/brancz/kube-rbac-proxy:v0.14.0
                 name: kube-rbac-proxy

diff --git a/config/default/manager_auth_proxy_patch.yaml b/config/default/manager_auth_proxy_patch.yaml
@@ -37,6 +37,7 @@ spec:
         - "--secure-listen-address=0.0.0.0:8443"
         - "--upstream=http://127.0.0.1:8080/"
         - "--logtostderr=true"
+        - "--tls-min-version=VersionTLS13"
         - "--v=0"
         ports:
         - containerPort: 8443

diff --git a/helm/volsync/templates/deployment-controller.yaml b/helm/volsync/templates/deployment-controller.yaml
@@ -54,6 +54,7 @@ spec:
             - --secure-listen-address=0.0.0.0:8443
             - --upstream=http://127.0.0.1:8080/
             - --logtostderr=true
+            - "--tls-min-version=VersionTLS13"
             - --v=0
             {{- if .Values.metrics.disableAuth }}
             - --ignore-paths=/metrics