Merge "Update traefik options"

doc/source/user/index.rst

@@ -1249,7 +1249,7 @@ _`container_infra_prefix`
   * docker.io/grafana/grafana:5.1.5
   * docker.io/prom/node-exporter:latest
   * docker.io/prom/prometheus:latest
-  * docker.io/traefik:v1.7.10
+  * docker.io/traefik:v1.7.28
   * gcr.io/google_containers/kubernetes-dashboard-amd64:v1.5.1
   * gcr.io/google_containers/metrics-server-amd64:v0.3.6
   * k8s.gcr.io/node-problem-detector:v0.6.2

magnum/drivers/common/templates/kubernetes/fragments/enable-ingress-traefik.sh

@@ -22,9 +22,8 @@ data:
         address = ":80"
       [entryPoints.https]
         address = ":443"
-      [entryPoints.metrics]
-        address = ":8082"
         [entryPoints.https.tls]
+          minVersion = "VersionTLS12"
           cipherSuites = [
             "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
             "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
@@ -44,6 +43,8 @@ data:
             "TLS_RSA_WITH_AES_256_CBC_SHA",
             "TLS_RSA_WITH_AES_128_CBC_SHA"
           ]
+      [entryPoints.metrics]
+        address = ":8082"
 ---
 kind: DaemonSet
 apiVersion: apps/v1

magnum/drivers/k8s_fedora_atomic_v1/templates/kubecluster.yaml

@@ -281,7 +281,7 @@ parameters:
   traefik_ingress_controller_tag:
     type: string
     description: tag of the traefik containers to be used.
-    default: v1.7.19
+    default: v1.7.28
 
   wait_condition_timeout:
     type: number

magnum/drivers/k8s_fedora_coreos_v1/templates/kubecluster.yaml

@@ -283,7 +283,7 @@ parameters:
   traefik_ingress_controller_tag:
     type: string
     description: tag of the traefik containers to be used.
-    default: v1.7.19
+    default: v1.7.28
 
   wait_condition_timeout:
     type: number

releasenotes/notes/update-traefik-min-tls-protocol-de7e36de90c1a2f3.yaml

@@ -0,0 +1,7 @@
+---
+upgrade:
+  - |
+    Upgrade traefik version to v1.7.28
+security:
+  - |
+    Force traefik https port connections to use TLSv1.2 or greater