Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Operator: Configure kube-rbac-proxy sidecar to use Intermediate TLS security profile in OCP #7092

Merged
merged 2 commits into from
Sep 7, 2022

Conversation

aminesnow
Copy link
Contributor

@aminesnow aminesnow commented Sep 7, 2022

What this PR does / why we need it:
This PR adds Intermediate security profile to the kube-rbac-proxy operator sidecar.

Checklist

  • Documentation added
  • Tests updated
  • Is this an important fix or new feature? Add an entry in the CHANGELOG.md.
  • Changes that require user attention or interaction to upgrade are documented in docs/sources/upgrading/_index.md

@aminesnow aminesnow changed the title operator: Configure kube-rbac-proxy sidecar to use Intermediate TLS security profile in OCP Operator: Configure kube-rbac-proxy sidecar to use Intermediate TLS security profile in OCP Sep 7, 2022
@aminesnow aminesnow marked this pull request as ready for review September 7, 2022 14:52
@aminesnow aminesnow requested a review from a team as a code owner September 7, 2022 14:52
@grafanabot
Copy link
Collaborator

./tools/diff_coverage.sh ../loki-main/test_results.txt test_results.txt ingester,distributor,querier,querier/queryrange,iter,storage,chunkenc,logql,loki

Change in test coverage per package. Green indicates 0 or positive change, red indicates that test coverage for a package fell.

+           ingester	0%
+        distributor	0%
+            querier	0%
+ querier/queryrange	0%
+               iter	0%
+            storage	0%
+           chunkenc	0%
+              logql	0%
+               loki	0%

@periklis periklis merged commit defba23 into grafana:main Sep 7, 2022
Copy link
Contributor

@alanconway alanconway left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think this implements https://issues.redhat.com/browse/OCPPLAN-4379
which says: "Goal: Cluster-wide TLS configuration"
I believe the goal is to use the same TLS profile as the apiserver/cluster object by default, not to hard-code a set of cipher suites. The cluster admin is supposed to be able to configure the desired cluster-wide default by modifying apiserver.spec.tlsSecurityProfile

oc get apiserver/cluster -o template='{{.spec.tlsSecurityProfile}}'

@periklis
Copy link
Collaborator

periklis commented Sep 9, 2022

@alanconway I believe you grabbed to wrong PR. You are probably looking for #6870 that implements what you are saying for our gateway. A pending PR for Loki is in progress by @Red-GV

lxwzy pushed a commit to lxwzy/loki that referenced this pull request Nov 7, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants