fips: force stackdriver to use TLSv1.2 #5339
Conversation
Change-Id: Icd1cd577c039512bb90234642719a8b5d3523567 Signed-off-by: Kuat Yessenov <kuat@google.com>
| @@ -80,16 +81,19 @@ getStackdriverOptions(const Wasm::Common::FlatNode& local_node_info, | |||
| } | |||
| } | |||
|
|
|||
| auto ssl_creds_options = grpc::SslCredentialsOptions(); | |||
| grpc::experimental::TlsChannelCredentialsOptions tls_options; | |||
| tls_options.set_max_tls_version(grpc_tls_version::TLS1_2); | |||
There was a problem hiding this comment.
Is the intension to 1) only use TLS 1.2 or 2) avoid using TLS 1.3?
From the following code in the CL, the intension seems to be 2) but the title of the CL seems to indicate 1).
tls_options.set_max_tls_version(grpc_tls_version::TLS1_2);
There was a problem hiding this comment.
It's the same. gRPC sets TLS 1.2 as a minimum version.
| @@ -80,16 +81,19 @@ getStackdriverOptions(const Wasm::Common::FlatNode& local_node_info, | |||
| } | |||
| } | |||
|
|
|||
| auto ssl_creds_options = grpc::SslCredentialsOptions(); | |||
| grpc::experimental::TlsChannelCredentialsOptions tls_options; | |||
There was a problem hiding this comment.
Based on its name, "grpc::experimental::TlsChannelCredentialsOptions" seems to be an experimental feature. Do we have a more stable API to set the max TLS version? If this experimental feature becomes deprecated, we need to find a replacement for it.
There was a problem hiding this comment.
gRPC team specifically backported this experimental feature for us. A similar change in Envoy was approved envoyproxy/envoy#32315.
|
In response to a cherrypick label: new pull request created: #5342 |
|
In response to a cherrypick label: new pull request created: #5343 |
|
In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/proxy#release-1.19 from head istio-testing:cherry-pick-5339-to-release-1.19: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-5339-to-release-1.19."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"} |
|
In response to a cherrypick label: new pull request created: #5344 |
|
In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/proxy#release-1.19 from head istio-testing:cherry-pick-5339-to-release-1.19: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-5339-to-release-1.19."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"} |
|
In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/proxy#release-1.21 from head istio-testing:cherry-pick-5339-to-release-1.21: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-5339-to-release-1.21."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"} |
|
In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/proxy#release-1.20 from head istio-testing:cherry-pick-5339-to-release-1.20: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-5339-to-release-1.20."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"} |
1 similar comment
|
In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/proxy#release-1.20 from head istio-testing:cherry-pick-5339-to-release-1.20: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-5339-to-release-1.20."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"} |
|
In response to a cherrypick label: new pull request could not be created: failed to create pull request against istio/proxy#release-1.21 from head istio-testing:cherry-pick-5339-to-release-1.21: status code 422 not one of [201], body: {"message":"Validation Failed","errors":[{"resource":"PullRequest","code":"custom","message":"A pull request already exists for istio-testing:cherry-pick-5339-to-release-1.21."}],"documentation_url":"https://docs.github.com/rest/pulls/pulls#create-a-pull-request"} |
Change-Id: Icd1cd577c039512bb90234642719a8b5d3523567
Unconditional enforcement of istio/istio#49081 for GCP Stackdriver, since TLSv1.2 is sufficient.