Repository: vmware-tanzu/tanzu-framework (language: go)

Issue:
Make minimum TLS version used by webhook server configurable
<!-- This is used to request new product features -->

**Describe the feature request**
- currently the webhook servers in tanzu-framework controllers accept TLSv1.0, TLSv1.1 and TLSv1.2. Using TLSv1.0 and TLSv1.1 is no longer recommended for security reasons. So users wish to set minimum TLS version to "1.2"
- it would be great if minimum TLS version for webhooks could be configurable via a command-line argument and/or an environment variable provided at controller start-up time.

**Describe alternative(s) you've considered**

**Affected product area (please put an X in all that apply)**

- ( ) APIs
- ( ) Addons
- ( ) CLI
- ( ) Docs
- ( ) IAM
- ( ) Installation
- ( ) Plugin
- (X ) Security
- ( ) Test and Release
- ( ) User Experience
- ( ) Developer Experience

**Additional context**



Discussion / hints:

Fix patch:
diff --git a/addons/main.go b/addons/main.go
index 7603074ceb..abc549e556 100644
--- a/addons/main.go
+++ b/addons/main.go
@@ -106,6 +106,7 @@ type addonFlags struct {
 	featureGatePackageInstallStatus bool
 	enablePprof                     bool
 	pprofBindAddress                string
+	tlsMinVersion                   string
 }
 
 func parseAddonFlags(addonFlags *addonFlags) {
@@ -148,6 +149,7 @@ func parseAddonFlags(addonFlags *addonFlags) {
 	flag.BoolVar(&addonFlags.featureGatePackageInstallStatus, "feature-gate-package-install-status", false, "Feature gate to enable packageinstallstatus controller")
 	flag.BoolVar(&addonFlags.enablePprof, "enable-pprof", false, "Enable pprof web server")
 	flag.StringVar(&addonFlags.pprofBindAddress, "pprof-bind-addr", ":18318", "Bind address of pprof web server if enabled")
+	flag.StringVar(&addonFlags.tlsMinVersion, "tls-min-version", "1.2", "minimum TLS version in use by the webhook server. Recommended values are \"1.2\" and \"1.3\".")
 
 	flag.Parse()
 }
@@ -213,6 +215,7 @@ func main() {
 		os.Exit(1)
 	}
 
+	mgr.GetWebhookServer().TLSMinVersion = flags.tlsMinVersion
 	addonReconciler := &controllers.AddonReconciler{
 		Client: mgr.GetClient(),
 		Log:    ctrl.Log.WithName("controllers").WithName("Addon"),
diff --git a/cmd/managers/featuregate/main.go b/cmd/managers/featuregate/main.go
index 0b4baa4843..c7032be7b4 100644
--- a/cmd/managers/featuregate/main.go
+++ b/cmd/managers/featuregate/main.go
@@ -34,7 +34,9 @@ func init() {
 
 func main() {
 	var webhookServerPort int
+	var tlsMinVersion string
 	flag.IntVar(&webhookServerPort, "webhook-server-port", 9443, "The port that the webhook server serves at.")
+	flag.StringVar(&tlsMinVersion, "tls-min-version", "1.2", "minimum TLS version in use by the webhook server. Recommended values are \"1.2\" and \"1.3\".")
 
 	opts := zap.Options{
 		Development: true,
@@ -53,6 +55,7 @@ func main() {
 		os.Exit(1)
 	}
 
+	mgr.GetWebhookServer().TLSMinVersion = tlsMinVersion
 	if err = (&controllers.FeatureGateReconciler{
 		Client: mgr.GetClient(),
 		Log:    ctrl.Log.WithName("controllers").WithName("FeatureGate"),
diff --git a/pkg/v2/tkr/webhook/cluster/tkr-resolver/main.go b/pkg/v2/tkr/webhook/cluster/tkr-resolver/main.go
index aae8159de2..2a61ecb17b 100644
--- a/pkg/v2/tkr/webhook/cluster/tkr-resolver/main.go
+++ b/pkg/v2/tkr/webhook/cluster/tkr-resolver/main.go
@@ -39,10 +39,12 @@ func main() {
 	var metricsAddr string
 	var webhookServerPort int
 	var customImageRepositoryCCVar string
+	var tlsMinVersion string
 	flag.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/", "Webhook cert directory.")
 	flag.StringVar(&metricsAddr, "metrics-bind-addr", ":8080", "The address the metric endpoint binds to.")
 	flag.StringVar(&customImageRepositoryCCVar, "custom-image-repository-cc-var", "imageRepository", "Custom imageRepository ClusterClass variable")
 	flag.IntVar(&webhookServerPort, "webhook-server-port", 9443, "The port that the webhook server serves at.")
+	flag.StringVar(&tlsMinVersion, "tls-min-version", "1.2", "minimum TLS version in use by the webhook server. Recommended values are \"1.2\" and \"1.3\".")
 
 	opts := zap.Options{
 		Development: true,
@@ -67,6 +69,7 @@ func main() {
 		os.Exit(1)
 	}
 
+	mgr.GetWebhookServer().TLSMinVersion = tlsMinVersion
 	tkrResolver := resolver.New()
 
 	if err := (&cache.Reconciler{
diff --git a/pkg/v2/tkr/webhook/tkr-conversion/main.go b/pkg/v2/tkr/webhook/tkr-conversion/main.go
index d50af1657b..e7e3b3d258 100644
--- a/pkg/v2/tkr/webhook/tkr-conversion/main.go
+++ b/pkg/v2/tkr/webhook/tkr-conversion/main.go
@@ -36,10 +36,11 @@ func main() {
 	var webhookCertDir string
 	var metricsAddr string
 	var webhookServerPort int
+	var tlsMinVersion string
 	flag.StringVar(&webhookCertDir, "webhook-cert-dir", "/tmp/k8s-webhook-server/serving-certs/", "Webhook cert directory.")
 	flag.StringVar(&metricsAddr, "metrics-bind-addr", ":8080", "The address the metric endpoint binds to.")
 	flag.IntVar(&webhookServerPort, "webhook-server-port", 9443, "The port that the webhook server serves at.")
-
+	flag.StringVar(&tlsMinVersion, "tls-min-version", "1.2", "minimum TLS version in use by the webhook server. Recommended values are \"1.2\" and \"1.3\".")
 	opts := zap.Options{
 		Development: true,
 	}
@@ -63,6 +64,7 @@ func main() {
 		os.Exit(1)
 	}
 
+	mgr.GetWebhookServer().TLSMinVersion = tlsMinVersion
 	setupWebhooks(mgr)
 
 	setupLog.Info("starting manager")


Test patch: