search

kubernetes / kubernetes

Production-Grade Container Scheduling and Management
https://kubernetes.io
Apache License 2.0
108.85k stars 39.02k forks source link

Use TLS 1.3 by default #110346

Closed dalgibbard closed 2 weeks ago

dalgibbard commented 2 years ago

Hi all, In relation to: https://github.com/kubernetes-sigs/metrics-server/issues/985

Given that pretty much all libraries/clients out there have supported TLS1.3 for quite a while now, it would be great to move towards deprecating TLS1.2 and lower -- this removes the need to employ Server-side Ciper ordering, and/or enabling/disabling various ciphers which are deemed insecure (ie. 3DES, CBC); mitigating potential issues like GOLDENDOODLE / SWEET32 / LUCKY13 for all clients.

Thanks in advance!

dims commented 2 years ago

/transfer kubernetes

neolit123 commented 2 years ago

/sig auth

enj commented 1 year ago

/triage accepted

I do not believe we could change the implicit default of this flag as that would be a backwards incompatible change (we have no way of knowing if clients support TLS 1.3 in a particular env). I could see us removing the default of the flag altogether and requiring that it be specified. The documentation could then recommend 1.3 for environments where it is known to be supported, and 1.2 for environments where compatibility is desired over maximum security.

I would recommend bringing this up during a SIG Auth and API machinery biweekly meeting before taking any further action.

k8s-triage-robot commented 1 year ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

vaibhav2107 commented 1 year ago

/remove-lifecycle stale

sftim commented 1 year ago

/area security ?

k8s-triage-robot commented 5 months ago

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

k8s-triage-robot commented 2 months ago

The Kubernetes project currently lacks enough contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot commented 1 month ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues.

This bot triages un-triaged issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot commented 2 weeks ago

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues according to the following rules:

You can:

Please send feedback to sig-contributor-experience at kubernetes/community.

/close not-planned

k8s-ci-robot commented 2 weeks ago

@k8s-triage-robot: Closing this issue, marking it as "Not Planned".

In response to [this](https://github.com/kubernetes/kubernetes/issues/110346#issuecomment-2227450687): >The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs. > >This bot triages issues according to the following rules: >- After 90d of inactivity, `lifecycle/stale` is applied >- After 30d of inactivity since `lifecycle/stale` was applied, `lifecycle/rotten` is applied >- After 30d of inactivity since `lifecycle/rotten` was applied, the issue is closed > >You can: >- Reopen this issue with `/reopen` >- Mark this issue as fresh with `/remove-lifecycle rotten` >- Offer to help out with [Issue Triage][1] > >Please send feedback to sig-contributor-experience at [kubernetes/community](https://github.com/kubernetes/community). > >/close not-planned > >[1]: https://www.kubernetes.dev/docs/guide/issue-triage/ Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.