SSL Medium Strength Cipher Suites Supported for operator

Signed-off-by: lan.tian <[email protected]>

Author: lance5890

bindata/assets/kube-apiserver/pod.yaml

@@ -239,6 +239,8 @@ spec:
     args:
       - --kubeconfig
       - /etc/kubernetes/static-pod-certs/configmaps/check-endpoints-kubeconfig/kubeconfig
+      - --config
+      - /etc/kubernetes/static-pod-certs/configmaps/kube-apiserver-operator-config/config.yaml
       - --listen
       - 0.0.0.0:17697
       - --namespace

manifests/0000_20_kube-apiserver-operator_03_configmap.yaml

@@ -11,3 +11,12 @@ data:
   config.yaml: |
     apiVersion: operator.openshift.io/v1
     kind: GenericOperatorConfig
+    servingInfo:
+      cipherSuites:
+      - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+      - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
+      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+      - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256
+      - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256
+      minTLSVersion: VersionTLS12

pkg/operator/resourcesynccontroller/resourcesynccontroller.go

@@ -95,5 +95,13 @@ func NewResourceSyncController(
 		return nil, err
 	}
 
+	// this config contains the cipherSuites and minTLSVersion which is used by check-endpoints
+	if err := resourceSyncController.SyncConfigMap(
+		resourcesynccontroller.ResourceLocation{Namespace: operatorclient.TargetNamespace, Name: "kube-apiserver-operator-config"},
+		resourcesynccontroller.ResourceLocation{Namespace: operatorclient.OperatorNamespace, Name: "kube-apiserver-operator-config"},
+	); err != nil {
+		return nil, err
+	}
+
 	return resourceSyncController, nil
 }

pkg/operator/starter.go

@@ -660,6 +660,9 @@ var CertConfigMaps = []installer.UnrevisionedResource{
 
 	// kubeconfig for check-endpoints
 	{Name: "check-endpoints-kubeconfig"},
+
+	// kube-apiserver-operator-config (TLS cipherSuites/minTLSVersion for check-endpoints).
+	{Name: "kube-apiserver-operator-config"},
 }
 
 var CertSecrets = []installer.UnrevisionedResource{