Rahul Roshan Kachchap
787da633ef
When only TLS 1.3 ciphers are configured (e.g. tls-cipher-suite=
TLS_AES_256_GCM_SHA384 with tls-min-version=VersionTLS13), the
helm overrides incorrectly place TLS 1.3 cipher names into the
'ssl-ciphers' ConfigMap key. This key maps to nginx's ssl_ciphers
directive which calls SSL_CTX_set_cipher_list() — an API that only
accepts TLS 1.2 ciphers. OpenSSL rejects the TLS 1.3 name with
'no cipher match', causing nginx to fail every reload attempt and
continue serving with default TLS 1.2 configuration.
Fix by splitting configured ciphers into TLS 1.2 (ssl-ciphers,
using SSL_CTX_set_cipher_list) and TLS 1.3 (ssl-ciphersuites,
using SSL_CTX_set_ciphersuites) ConfigMap keys.
Test Plan:
PASS: Configured tls-cipher-suite with mixed TLS 1.2 and TLS 1.3
ciphers. Verified configmap in kube-system shows ssl-ciphers
with only TLS 1.2 OpenSSL names and ssl-ciphersuites with
only TLS 1.3 IANA names.
PASS: openssl s_client -tls1_3 negotiates TLS_AES_256_GCM_SHA384.
PASS: openssl s_client -tls1_2 negotiates ECDHE-RSA-AES256-GCM-SHA384.
PASS: nginx.conf inside pod contains only TLS 1.2 ciphers in
ssl_ciphers directive (no TLS 1.3 contamination).
PASS: nginx-ingress-controller app status is applied, no 750.xxx
alarms raised.
Story: 2011725
Task: 54897
Change-Id: Id1ce3cdb8b7cd6c894a3d17084ec7c54d79735b8
Signed-off-by: Rahul Roshan Kachchap <rahulroshan.kachchap@windriver.com>