Sweet32 still allowed after upgrading to kube-rbac-proxy 0.4.1 and setting minimum TLS version to 1.2 about kube-rbac-proxy HOT 7 CLOSED

Thanks for reporting! Yes we should definitely fix this.

from kube-rbac-proxy.

For what it's worth, the ciphers used you can configure with the --tls-cipher-suites flag, but we should make TLS 1.3 the new default and recompile with latest go version.

from kube-rbac-proxy.

For clarification, which version of OpenShift are you using and how is the kube-rbac-proxy started? It should be running only safe cipher suites.

from kube-rbac-proxy.

Using Openshift version 3.11 with the Openshift Monitoring GAP stack deployed using the openshift-monitoring playbook from openshift-ansible. By default it uses the kube-rbac-proxy 0.3.1 image from quay. I pulled the 0.4.1 image and edited only the image tag in the deployment. 0.3.1 to 0.4.1.

from kube-rbac-proxy.

There is no proper support for TLS 1.3 in go yet, so we will have to wait for that (it can be enabled but only via a debug flag). Regarding the cipher suites, is there anything you can't achieve with the existing --tls-cipher-suites flag?

from kube-rbac-proxy.

I was having issues with the pods with kube-rbac-proxy going into crashloop backoff but it was a configuration issue on my end. I was trying to be too restrictive with the cipher suites I allowed, and I was missing a AES_128_GCM_SHA256 cipher. Thank you for the help.

from kube-rbac-proxy.

Do you want to close this issue then and open a new one just for TLS 1.3?

from kube-rbac-proxy.