Enable TLSv1.2 for ZTunnel when in FIPS mode#1547
Enable TLSv1.2 for ZTunnel when in FIPS mode#1547istio-testing merged 2 commits intoistio-ecosystem:mainfrom
Conversation
|
Adding a hold until I can test this on an actual FIPS-enabled cluster |
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1547 +/- ##
==========================================
+ Coverage 80.75% 80.85% +0.10%
==========================================
Files 50 50
Lines 2458 2466 +8
==========================================
+ Hits 1985 1994 +9
+ Misses 348 346 -2
- Partials 125 126 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This change builds on istio/ztunnel#1711 which adds TLSv1.2 support to ZTunnel when `TLS12_ENABLED` is set to `true`. This patch will always set the env var when in FIPS mode, for all versions of ZTunnel, even though it is only supported from 1.29+, but the env var will simply be ignored by versions that don't support it. Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
dgn
force-pushed
the
ztunnel-fips-140-2
branch
from
84cacf3 to
74932ae
Compare
sridhargaddam
left a comment
sridhargaddam
left a comment
There was a problem hiding this comment.
One small observation, otherwise LGTM.
| values := helm.Values{} | ||
| for _, tt := range tests { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| FipsEnabled = tt.fipsEnabled |
There was a problem hiding this comment.
FipsEnabled seems to be a global variable and we are mutating its state. I think we should restore its state to the original value after calling ApplyZTunnelFipsValues.
There was a problem hiding this comment.
I added a separate commit for that, PTAL
In our tests, we sometimes set FipsEnabled manually. We should make sure to reset it to its original value during test cleanup. Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
|
/hold cancel I was able to verify this on a FIPS-enabled cluster. |
|
/retest |
|
/cherry-pick release-1.28 |
|
@dgn: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
In response to a cherrypick label: #1547 failed to apply on top of branch "release-1.28": |
|
In response to a cherrypick label: new issue created for failed cherrypick: #1593 |
3 participants
This change builds on istio/ztunnel#1711 which adds TLSv1.2 support to ZTunnel when
TLS12_ENABLEDis set totrue. This patch will always set the env var when in FIPS mode, for all versions of ZTunnel, even though it is only supported from 1.29+, but the env var will simply be ignored by versions that don't support it.