CORENET-7054: Use TLS profile to render CLI args for deployed components

bindata/kube-proxy/kube-proxy.yaml

@@ -144,7 +144,14 @@ spec:
           exec /usr/bin/kube-rbac-proxy \
             --logtostderr \
             --secure-listen-address=:{{.MetricsPort}} \
+{{- if .UseTLSProfile }}
+            --tls-min-version={{.TLSMinVersion}} \
+  {{- if .TLSCipherSuites }}
+            --tls-cipher-suites={{.TLSCipherSuites}} \
+  {{- end }}
+{{- else }}
             --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 \
+{{- end }}
             --upstream=http://127.0.0.1:29102/ \
             --tls-private-key-file=${TLS_PK} \
             --tls-cert-file=${TLS_CERT}

bindata/network-diagnostics/network-check-source.yaml

@@ -48,8 +48,12 @@ spec:
         args:
           - --listen
           - 0.0.0.0:17698
-          - --namespace
-          - $(POD_NAMESPACE)
+{{- if .UseTLSProfile }}
+          - --tls-min-version={{.TLSMinVersion}}
+{{- if .TLSCipherSuites }}
+          - --tls-cipher-suites={{.TLSCipherSuites}}
+{{- end }}
+{{- end }}
         env:
           - name: POD_NAME
             valueFrom:

bindata/network/frr-k8s/frr-k8s.yaml

@@ -99,6 +99,12 @@ spec:
         - --namespace=$(NAMESPACE)
         - --metrics-bind-address=0.0.0.0:9140
         - --metrics-cert-dir=/etc/metrics
+{{- if .UseTLSProfile }}
+        - --tls-min-version={{.TLSMinVersion}}
+  {{- if .TLSCipherSuites }}
+        - --tls-cipher-suites={{.TLSCipherSuites}}
+  {{- end }}
+{{- end }}
         - $(LOG_LEVEL)
         env:
         - name: FRR_CONFIG_FILE
@@ -230,6 +236,12 @@ spec:
         - --metrics-bind-address=0.0.0.0
         - --tls-cert-file=/etc/metrics/tls.crt
         - --tls-private-key-file=/etc/metrics/tls.key
+{{- if .UseTLSProfile }}
+        - --tls-min-version={{.TLSMinVersion}}
+  {{- if .TLSCipherSuites }}
+        - --tls-cipher-suites={{.TLSCipherSuites}}
+  {{- end }}
+{{- end }}
         ports:
         - containerPort: 9141
           name: frrmetricshttps

bindata/network/frr-k8s/node-status-cleaner.yaml

@@ -28,6 +28,12 @@ spec:
         - --namespace=$(NAMESPACE)
         - --webhook-port=9123
         - --frrk8s-selector=component=frr-k8s
+{{- if .UseTLSProfile }}
+        - --tls-min-version={{.TLSMinVersion}}
+  {{- if .TLSCipherSuites }}
+        - --tls-cipher-suites={{.TLSCipherSuites}}
+  {{- end }}
+{{- end }}
         - $(LOG_LEVEL)
         env:
         - name: NAMESPACE

bindata/network/multus-admission-controller/admission-controller.yaml

@@ -166,6 +166,12 @@ spec:
             -metrics-listen-address=:9091 \
 {{- else }}
             -metrics-listen-address=127.0.0.1:9091 \
+{{- end }}
+{{- if .UseTLSProfile }}
+            --tls-min-version={{.TLSMinVersion}} \
+{{- if .TLSCipherSuites }}
+            --tls-cipher-suites={{.TLSCipherSuites}} \
+{{- end }}
 {{- end }}
             -alsologtostderr=true \
             -ignore-namespaces=openshift-etcd,openshift-console,openshift-ingress-canary,{{.IgnoredNamespace}}
@@ -198,7 +204,14 @@ spec:
         args:
         - --logtostderr
         - --secure-listen-address=:8443
+{{- if .UseTLSProfile }}
+        - --tls-min-version={{.TLSMinVersion}}
+{{- if .TLSCipherSuites }}
+        - --tls-cipher-suites={{.TLSCipherSuites}}
+{{- end }}
+{{- else }}
         - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
+{{- end }}
         - --upstream=http://127.0.0.1:9091/
         - --tls-private-key-file=/etc/webhook/tls.key
         - --tls-cert-file=/etc/webhook/tls.crt

bindata/network/network-metrics/001-daemonset.yaml

@@ -65,7 +65,14 @@ spec:
           args:
             - --logtostderr
             - --secure-listen-address=:8443
+{{- if .UseTLSProfile }}
+            - --tls-min-version={{.TLSMinVersion}}
+  {{- if .TLSCipherSuites }}
+            - --tls-cipher-suites={{.TLSCipherSuites}}
+  {{- end }}
+{{- else }}
             - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+{{- end }}
             - --upstream=http://127.0.0.1:9091/
             - --tls-private-key-file=/etc/metrics/tls.key
             - --tls-cert-file=/etc/metrics/tls.crt

bindata/network/node-identity/managed/node-identity.yaml

@@ -145,6 +145,12 @@ spec:
                 --disable-approver \
                 --extra-allowed-user="system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-control-plane" \
                 --pod-admission-conditions="/var/run/ovnkube-identity-config/additional-pod-admission-cond.json" \
+             {{- if .UseTLSProfile }}
+                --tls-min-version={{.TLSMinVersion}} \
+             {{- if .TLSCipherSuites }}
+                --tls-cipher-suites={{.TLSCipherSuites}} \
+             {{- end }}
+             {{- end }}
                 --loglevel="${LOGLEVEL}"
         env:
           - name: LOGLEVEL

bindata/network/node-identity/self-hosted/node-identity.yaml

@@ -57,7 +57,8 @@ spec:
             echo "I$(date "+%m%d %H:%M:%S.%N") - network-node-identity - start webhook"
             # extra-allowed-user: service account `ovn-kubernetes-control-plane`
             # sets pod annotations in multi-homing layer3 network controller (cluster-manager)
-            exec /usr/bin/ovnkube-identity  --k8s-apiserver={{.K8S_APISERVER}} \
+            exec /usr/bin/ovnkube-identity \
+                --k8s-apiserver={{.K8S_APISERVER}} \
                 --webhook-cert-dir="/etc/webhook-cert" \
                 --webhook-host={{.NetworkNodeIdentityIP}} \
                 --webhook-port={{.NetworkNodeIdentityPort}} \
@@ -67,6 +68,12 @@ spec:
                 --extra-allowed-user="system:serviceaccount:openshift-ovn-kubernetes:ovn-kubernetes-control-plane" \
                 --wait-for-kubernetes-api={{.NetworkNodeIdentityTerminationDurationSeconds}}s \
                 --pod-admission-conditions="/var/run/ovnkube-identity-config/additional-pod-admission-cond.json" \
+             {{- if .UseTLSProfile }}
+                --tls-min-version={{.TLSMinVersion}} \
+             {{- if .TLSCipherSuites }}
+                --tls-cipher-suites={{.TLSCipherSuites}} \
+             {{- end }}
+             {{- end }}
                 --loglevel="${LOGLEVEL}"
         env:
           - name: LOGLEVEL

bindata/network/ovn-kubernetes/common/008-script-lib.yaml

@@ -209,7 +209,7 @@ data:
     #
     # Requires the following volume mounts:
     #   /etc/pki/tls/metrics-cert
-    start-rbac-proxy-node()
+    start-rbac-proxy()
     {
       local detail=$1
       local listen_port=$2
@@ -223,17 +223,23 @@ data:
       fi
 
       # As the secret mount is optional we must wait for the files to be present.
-      # The service is created in monitor-node.yaml but start-rbac-proxy-node is
-      # called from ovnkube-node.yaml. If the certificate isn't created there is
-      # probably an issue so we want to crashloop.
+      # If the certificate isn't created there is probably an issue so we want to
+      # crashloop.
       echo "$(date -Iseconds) INFO: waiting for ${detail} certs to be mounted"
       wait-for-certs "${detail}" "${privkey}" "${clientcert}"
 
       echo "$(date -Iseconds) INFO: ${detail} certs mounted, starting kube-rbac-proxy"
       exec /usr/bin/kube-rbac-proxy \
         --logtostderr \
         --secure-listen-address=:${listen_port} \
+{{- if .UseTLSProfile }}
+        --tls-min-version={{.TLSMinVersion}} \
+  {{- if .TLSCipherSuites }}
+        --tls-cipher-suites={{.TLSCipherSuites}} \
+  {{- end }}
+{{- else }}
         --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 \
+{{- end }}
         --upstream=http://127.0.0.1:${upstream_port}/ \
         --tls-private-key-file=${privkey} \
         --tls-cert-file=${clientcert}

bindata/network/ovn-kubernetes/managed/ovnkube-control-plane.yaml

@@ -219,6 +219,12 @@ spec:
             --metrics-enable-config-duration \
             --node-server-privkey ${TLS_PK} \
             --node-server-cert ${TLS_CERT} \
+{{- if .UseTLSProfile }}
+            --tls-min-version={{.TLSMinVersion}} \
+  {{- if .TLSCipherSuites }}
+            --tls-cipher-suites={{.TLSCipherSuites}} \
+  {{- end }}
+{{- end }}
             ${ovn_v4_join_subnet_opt} \
             ${ovn_v6_join_subnet_opt} \
             ${ovn_v4_transit_switch_subnet_opt} \

bindata/network/ovn-kubernetes/managed/ovnkube-node.yaml

@@ -183,7 +183,7 @@ spec:
           #!/bin/bash
           set -euo pipefail
           . /ovnkube-lib/ovnkube-lib.sh || exit 1
-          start-rbac-proxy-node ovn-node-metrics 9103 29103 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
+          start-rbac-proxy ovn-node-metrics 9103 29103 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
         ports:
         - containerPort: 9103
           name: https
@@ -208,7 +208,7 @@ spec:
           #!/bin/bash
           set -euo pipefail
           . /ovnkube-lib/ovnkube-lib.sh || exit 1
-          start-rbac-proxy-node ovn-metrics 9105 29105 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
+          start-rbac-proxy ovn-metrics 9105 29105 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
         ports:
         - containerPort: 9105
           name: https

bindata/network/ovn-kubernetes/self-hosted/ovnkube-control-plane.yaml

@@ -47,36 +47,8 @@ spec:
         - |
           #!/bin/bash
           set -euo pipefail
-          TLS_PK=/etc/pki/tls/metrics-cert/tls.key
-          TLS_CERT=/etc/pki/tls/metrics-cert/tls.crt
-          # As the secret mount is optional we must wait for the files to be present.
-          # The service is created in monitor-control-plane.yaml.
-          TS=$(date +%s)
-          WARN_TS=$(( ${TS} + $(( 20 * 60)) ))
-          HAS_LOGGED_INFO=0
-
-          log_missing_certs(){
-              CUR_TS=$(date +%s)
-              if [[ "${CUR_TS}" -gt "WARN_TS"  ]]; then
-                echo $(date -Iseconds) WARN: ovn-control-plane-metrics-cert not mounted after 20 minutes.
-              elif [[ "${HAS_LOGGED_INFO}" -eq 0 ]] ; then
-                echo $(date -Iseconds) INFO: ovn-control-plane-metrics-cert not mounted. Waiting 20 minutes.
-                HAS_LOGGED_INFO=1
-              fi
-          }
-          while [[ ! -f "${TLS_PK}" ||  ! -f "${TLS_CERT}" ]] ; do
-            log_missing_certs
-            sleep 5
-          done
-
-          echo $(date -Iseconds) INFO: ovn-control-plane-metrics-certs mounted, starting kube-rbac-proxy
-          exec /usr/bin/kube-rbac-proxy \
-            --logtostderr \
-            --secure-listen-address=:9108 \
-            --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 \
-            --upstream=http://127.0.0.1:29108/ \
-            --tls-private-key-file=${TLS_PK} \
-            --tls-cert-file=${TLS_CERT}
+          . /ovnkube-lib/ovnkube-lib.sh || exit 1
+          start-rbac-proxy ovn-control-plane-metrics 9108 29108 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
         ports:
         - containerPort: 9108
           name: https
@@ -89,6 +61,8 @@ spec:
         - name: ovn-control-plane-metrics-cert
           mountPath: /etc/pki/tls/metrics-cert
           readOnly: True
+        - name: ovnkube-script-lib
+          mountPath: /ovnkube-lib
       # ovnkube-control-plane: central component that allocates IPAM for each node in the cluster
       - name: ovnkube-cluster-manager
         image: "{{.OvnControlPlaneImage}}"
@@ -223,6 +197,9 @@ spec:
         secret:
           secretName: ovn-control-plane-metrics-cert
           optional: true
+      - name: ovnkube-script-lib
+        configMap:
+          name: ovnkube-script-lib
       tolerations:
       - key: "node-role.kubernetes.io/master"
         operator: "Exists"

bindata/network/ovn-kubernetes/self-hosted/ovnkube-node.yaml

@@ -219,7 +219,7 @@ spec:
           #!/bin/bash
           set -euo pipefail
           . /ovnkube-lib/ovnkube-lib.sh || exit 1
-          start-rbac-proxy-node ovn-node-metrics 9103 29103 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
+          start-rbac-proxy ovn-node-metrics 9103 29103 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
         ports:
         - containerPort: 9103
           name: https
@@ -244,7 +244,7 @@ spec:
           #!/bin/bash
           set -euo pipefail
           . /ovnkube-lib/ovnkube-lib.sh || exit 1
-          start-rbac-proxy-node ovn-metrics 9105 29105 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
+          start-rbac-proxy ovn-metrics 9105 29105 /etc/pki/tls/metrics-cert/tls.key /etc/pki/tls/metrics-cert/tls.crt
         ports:
         - containerPort: 9105
           name: https

bindata/networking-console-plugin/002-config-map.yaml

@@ -12,6 +12,13 @@ data:
         listen              [::]:9443 ssl;
         ssl_certificate     /var/cert/tls.crt;
         ssl_certificate_key /var/cert/tls.key;
+{{- if .UseTLSProfile }}
+        ssl_protocols       {{.NginxTLSProtocols}};
+{{- if .NginxTLSCiphers }}
+        ssl_ciphers         {{.NginxTLSCiphers}};
+{{- end }}
+        ssl_prefer_server_ciphers on;
+{{- end }}
         root                /opt/app-root/src;
 
         # Prevent caching for plugin-manifest.json