OCPBUGS-58040: haproxy-config.template: Allow empty ciphers #661
Conversation
* haproxy-config.template: Simplify the default ciphers configuration
by combining {{else}} and {{if}} stanzas into {{else if}}.
* haproxy-config.template: Define a variable $routerCiphers and use it to avoid unnecessarily calling the env helper repeatedly.
* haproxy-config.template: Define a variable $routerCiphersuites for consistency with $routerCiphers.
Allow the empty value for TLS ciphers (TLSv1.2 and earlier) and cipher suites (TLSv1.3), and use the empty value instead of setting a default value. Specifying the empty value means that the corresponding TLS version cannot be used. This commit fixes bug OCPBUGS-58040. https://issues.redhat.com/browse/OCPBUGS-58040 * haproxy-config.template: Allow the empty value for ROUTER_CIPHERS and ROUTER_CIPHERSUITES. Rather than using a default value, pass an empty value through to HAProxy (which in turn passes it through to OpenSSL).
openshift-ci-robot
added
jira/severity-important
|
@Miciah: This pull request references Jira Issue OCPBUGS-58040, which is valid. The bug has been moved to the POST state. 3 validation(s) were run on this bug
Requesting review from QA contact: The bug has been updated to refer to the pull request using the external bug tracker. In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
@Miciah: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
openshift-ci
bot
added
the
do-not-merge/work-in-progress
haproxy-config.template: SimplifyROUTER_CIPHERSSimplify the default ciphers configuration in the configuration template by combining
{{else}}and{{if}}stanzas into{{else if}}.haproxy-config.template: Introduce$routerCiphersDefine a template variable
$routerCiphersand use it to avoid unnecessarily calling theenvhelper repeatedly.Introduce
$routerCiphersuitesDefine a template variable
$routerCiphersuitesfor consistency with$routerCiphers.haproxy-config.template: Allow empty ciphersAllow the empty value for TLS ciphers (TLSv1.2 and earlier) and cipher suites (TLSv1.3). Rather than filling in a default value, pass the empty value through to HAProxy, which in turn passes it through to OpenSSL. Specifying the empty value means that the corresponding TLS version cannot be used.