You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
The allocator server can be configured to use TLS, relies on Go's crypto/tls package for TLS connection. Some of defaults cipher suits in Go's package may include less secure options that hardcoded into the library.(e.g. TLS_RSA_WITH_3DES_EDE_CBC_SHA).
How to reproduce it:
Install Agones with TLS certificates for the allocator(I'm using cert-manager with self-signed certificates). Expose allocator service using port-forwarding(k port-forward svc/agones-allocator 4443:443 -n $NS) or serviceType LoadBalancer. Use the nmap command to check the enabled ciphers: nmap --script ssl-enum-ciphers -p 443 $ENDPOINT
Environment:
Agones version: 1.42.0
Kubernetes version: client (1.25) and server (1.27)
Install method (yaml/helm): helm
Describe the solution you'd like
A new option to specify a preferred cipher suites could be added to the allocator, along with an option to select TLS version. Similar to how it's done in cert-manager here
Describe alternatives you've considered
Additional context
I believe it's low-priority security issue, as exploiting weak ciphers would still be challenging. However, adding flexibility in TLS configuration would enhance security and future-proof the allocator against vulnerabilities.
The text was updated successfully, but these errors were encountered:
Is your feature request related to a problem? Please describe.
The allocator server can be configured to use TLS, relies on Go's crypto/tls package for TLS connection. Some of defaults cipher suits in Go's package may include less secure options that hardcoded into the library.(e.g. TLS_RSA_WITH_3DES_EDE_CBC_SHA).
How to reproduce it:
Install Agones with TLS certificates for the allocator(I'm using cert-manager with self-signed certificates). Expose allocator service using port-forwarding(
k port-forward svc/agones-allocator 4443:443 -n $NS
) or serviceType LoadBalancer. Use the nmap command to check the enabled ciphers:nmap --script ssl-enum-ciphers -p 443 $ENDPOINT
Environment:
Agones version: 1.42.0
Kubernetes version: client (1.25) and server (1.27)
Install method (yaml/helm): helm
Describe the solution you'd like
A new option to specify a preferred cipher suites could be added to the allocator, along with an option to select TLS version. Similar to how it's done in cert-manager here
Describe alternatives you've considered
Additional context
I believe it's low-priority security issue, as exploiting weak ciphers would still be challenging. However, adding flexibility in TLS configuration would enhance security and future-proof the allocator against vulnerabilities.
The text was updated successfully, but these errors were encountered: