Repository: knative-sandbox/net-kourier
Pull request #1058 (2023-06-06 02:59:35)

Set TLS 1.3 for min and max versions
This patch make a change that traffic from Kourier to Activator/QP uses TLS 1.3
when internal encryption is enabled.

Due to an issue of Envoy https://github.com/envoyproxy/envoy/issues/9300,
we need to set TLS 1.3 for min and max version.

Part of https://github.com/knative/serving/issues/14057

**Release Note**

```release-note
Traffic from Kourier to Activator/QP uses TLS 1.3 when internal encryption is enabled.
```

/cc @dprotaso @skonto @ReToCode 

knative-prow[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/1058#" title="Author self-approved">nak3</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)~~ [nak3]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
nak3: Verified on serving side:

* https://github.com/nak3/serving/actions/runs/5183705185 (current serving code)
* https://github.com/nak3/serving/actions/runs/5183817244 (set minTLS to 1.3 on serving side https://github.com/nak3/serving/pull/59/commits/7b175abfa55b4e4c4e26e30eaac40773e4fe4d4a)
knative-prow[bot]: @nak3: The following test **failed**, say `/retest` to rerun all failed tests or `/retest-required` to rerun all mandatory failed tests:

Test name | Commit | Details | Required | Rerun command
--- | --- | --- | --- | ---
unit-tests_net-kourier_main | 60904c5d8e15ee51d3b0b3ec5315022dd70d4840 | [link](https://prow.knative.dev/view/gs/knative-prow/pr-logs/pull/knative-sandbox_net-kourier/1058/unit-tests_net-kourier_main/1665916322220871680) | true | `/test unit-tests`

[Your PR dashboard](https://prow.knative.dev/pr).

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
codecov[bot]: ## [Codecov](https://app.codecov.io/gh/knative-sandbox/net-kourier/pull/1058?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) Report
> Merging [#1058](https://app.codecov.io/gh/knative-sandbox/net-kourier/pull/1058?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (5936f1f) into [main](https://app.codecov.io/gh/knative-sandbox/net-kourier/commit/3cd3437c0308b2dc9cf1997535a1976605a7cfd1?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) (3cd3437) will **increase** coverage by `0.01%`.
> The diff coverage is `100.00%`.

```diff
@@            Coverage Diff             @@
##             main    #1058      +/-   ##
==========================================
+ Coverage   80.94%   80.95%   +0.01%     
==========================================
  Files          18       18              
  Lines        1354     1355       +1     
==========================================
+ Hits         1096     1097       +1     
  Misses        205      205              
  Partials       53       53              
```


| [Impacted Files](https://app.codecov.io/gh/knative-sandbox/net-kourier/pull/1058?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox) | Coverage Δ | |
|---|---|---|
| [pkg/generator/ingress\_translator.go](https://app.codecov.io/gh/knative-sandbox/net-kourier/pull/1058?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=knative-sandbox#diff-cGtnL2dlbmVyYXRvci9pbmdyZXNzX3RyYW5zbGF0b3IuZ28=) | `84.06% <100.00%> (+0.04%)` | :arrow_up: |


knative-prow[bot]: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/knative-sandbox/net-kourier/pull/1058#" title="Author self-approved">nak3</a>*, *<a href="https://github.com/knative-sandbox/net-kourier/pull/1058#pullrequestreview-1464522512" title="LGTM">ReToCode</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=knative-sandbox%2Fnet-kourier).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/knative-sandbox/net-kourier/blob/main/OWNERS)~~ [nak3]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/pkg/generator/ingress_translator.go b/pkg/generator/ingress_translator.go
index 405b9406..2d5481ac 100644
--- a/pkg/generator/ingress_translator.go
+++ b/pkg/generator/ingress_translator.go
@@ -345,7 +345,8 @@ func createUpstreamTLSContext(caCertificate []byte, alpnProtocols ...string) *tl
 		CommonTlsContext: &tlsv3.CommonTlsContext{
 			AlpnProtocols: alpnProtocols,
 			TlsParams: &tlsv3.TlsParameters{
-				TlsMinimumProtocolVersion: tlsv3.TlsParameters_TLSv1_2,
+				TlsMinimumProtocolVersion: tlsv3.TlsParameters_TLSv1_3,
+				TlsMaximumProtocolVersion: tlsv3.TlsParameters_TLSv1_3,
 			},
 			ValidationContextType: &tlsv3.CommonTlsContext_ValidationContext{
 				ValidationContext: &tlsv3.CertificateValidationContext{


Test patch:
diff --git a/pkg/generator/ingress_translator_test.go b/pkg/generator/ingress_translator_test.go
index 3360888c..31934cd7 100644
--- a/pkg/generator/ingress_translator_test.go
+++ b/pkg/generator/ingress_translator_test.go
@@ -1646,7 +1646,8 @@ func typedConfig(http2 bool) *envoycorev3.TransportSocket_TypedConfig {
 		CommonTlsContext: &auth.CommonTlsContext{
 			AlpnProtocols: alpn,
 			TlsParams: &auth.TlsParameters{
-				TlsMinimumProtocolVersion: auth.TlsParameters_TLSv1_2,
+				TlsMinimumProtocolVersion: auth.TlsParameters_TLSv1_3,
+				TlsMaximumProtocolVersion: auth.TlsParameters_TLSv1_3,
 			},
 			ValidationContextType: &auth.CommonTlsContext_ValidationContext{
 				ValidationContext: &auth.CertificateValidationContext{