Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

For VPA, make the admission-controller expose the minimum TLS version and/or the TLS ciphers #6624

Closed
allenmun197 opened this issue Mar 12, 2024 · 1 comment · Fixed by #6625
Labels
kind/feature Categorizes issue or PR as related to a new feature.

Comments

@allenmun197
Copy link
Contributor

Which component are you using?:

Vertical Pod Autoscaler
Is your feature request designed to solve a problem? If so describe the problem this feature should solve.:

At my company we have stricter TLS rules than normal. Currently VPA's admission controller is accepting TLS ciphers for ECDHE-RSA-DES-CBC3-SHA and DES-CBC3-SHA which are considered to be weak ciphers. We are being pinged for vulnerabilities when we use VPA.

With this feature, it would solve our issue as we could just have an allow-list of ciphers we accept or just bump the minimum TLS version to 1.3.
Describe the solution you'd like.:

I would like to see two new flags exposed --min-tls-version and --tls-ciphers on the VPA admission-controller as it would allow for customers to adjust the server to their needs.
Describe any alternative solutions you've considered.:

N/A
Additional context.:

@xiazhan
Copy link

xiazhan commented Jun 5, 2024

Do we have any plan to migrate the change to existing releases 1.1 and/or 1.0? @allenmun197

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/feature Categorizes issue or PR as related to a new feature.
Projects
None yet
2 participants