From 39140174efbdf9015f75543dae9d32d8c6bc4a26 Mon Sep 17 00:00:00 2001 From: zhzhuang-zju Date: Fri, 17 Nov 2023 17:54:06 +0800 Subject: [PATCH] set golang's secure cipher suites as etcd's cipher suites Signed-off-by: zhzhuang-zju --- artifacts/deploy/karmada-etcd.yaml | 1 + charts/karmada/templates/etcd.yaml | 1 + operator/pkg/controlplane/etcd/mainfests.go | 1 + pkg/karmadactl/cmdinit/kubernetes/statefulset.go | 5 +++++ 4 files changed, 8 insertions(+) diff --git a/artifacts/deploy/karmada-etcd.yaml b/artifacts/deploy/karmada-etcd.yaml index 0a316f3b4fb9..addcd7f8cb25 100644 --- a/artifacts/deploy/karmada-etcd.yaml +++ b/artifacts/deploy/karmada-etcd.yaml @@ -82,6 +82,7 @@ spec: - --trusted-ca-file=/etc/karmada/pki/etcd-ca.crt - --data-dir=/var/lib/etcd - --snapshot-count=10000 + - --cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 volumes: - hostPath: path: /var/lib/karmada-etcd diff --git a/charts/karmada/templates/etcd.yaml b/charts/karmada/templates/etcd.yaml index de4e61a58a00..1ba590b32a4e 100644 --- a/charts/karmada/templates/etcd.yaml +++ b/charts/karmada/templates/etcd.yaml @@ -97,6 +97,7 @@ spec: - --key-file=/etc/kubernetes/pki/etcd/karmada.key - --trusted-ca-file=/etc/kubernetes/pki/etcd/server-ca.crt - --data-dir=/var/lib/etcd + - --cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 volumes: - name: etcd-cert secret: diff --git a/operator/pkg/controlplane/etcd/mainfests.go b/operator/pkg/controlplane/etcd/mainfests.go index a0e8d8b8aa52..e7be0b95a92e 100644 --- a/operator/pkg/controlplane/etcd/mainfests.go +++ b/operator/pkg/controlplane/etcd/mainfests.go @@ -45,6 +45,7 @@ spec: - --data-dir=/var/lib/etcd - --snapshot-count=10000 - --log-level=debug + - --cipher-suites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 env: - name: KARMADA_ETCD_NAME valueFrom: diff --git a/pkg/karmadactl/cmdinit/kubernetes/statefulset.go b/pkg/karmadactl/cmdinit/kubernetes/statefulset.go index 5310ad09c81f..95e22aed7c07 100644 --- a/pkg/karmadactl/cmdinit/kubernetes/statefulset.go +++ b/pkg/karmadactl/cmdinit/kubernetes/statefulset.go @@ -31,6 +31,9 @@ const ( etcdEnvPodIP = "POD_IP" //secrets name etcdCertName = "etcd-cert" + // Setting Golang's secure cipher suites as etcd's cipher suites + // More details please refer to: https://github.com/karmada-io/karmada/pull/4253 + etcdCipherSuites = "[\"TLS_RSA_WITH_AES_128_CBC_SHA\",\"TLS_RSA_WITH_AES_256_CBC_SHA\",\"TLS_RSA_WITH_AES_128_GCM_SHA256\",\"TLS_RSA_WITH_AES_256_GCM_SHA384\",\"TLS_AES_128_GCM_SHA256\",\"TLS_AES_256_GCM_SHA384\",\"TLS_CHACHA20_POLY1305_SHA256\",\"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA\",\"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA\",\"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\",\"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\",\"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\",\"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\",\"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\",\"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\",\"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\",\"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\",\"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305\",\"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305\"]" ) var ( @@ -141,6 +144,7 @@ listen-client-urls: https://${%s}:%v,http://127.0.0.1:%v initial-advertise-peer-urls: http://${%s}:%v advertise-client-urls: https://${%s}.%s.%s.svc.%s:%v data-dir: %s +cipher-suites: %s `, etcdContainerConfigDataMountPath, etcdConfigName, @@ -159,6 +163,7 @@ data-dir: %s i.Namespace, i.HostClusterDomain, etcdContainerClientPort, etcdContainerDataVolumeMountPath, + etcdCipherSuites, ), }