Support for minimum TLS version for opa server #3517
Conversation
kale-amruta
force-pushed
the
amruta-3226
branch
2 times, most recently
from
eec8ea5 to
2997f32
Compare
|
@srenatus @anderseknert does this look good? |
|
@kale-amruta having another look just now 😃 |
| // print error to stderr, exit 1 | ||
| func fatal(err interface{}) { | ||
| fmt.Fprintf(os.Stderr, "%s\n", err) | ||
| os.Exit(1) | ||
| } | ||
|
|
||
| func TestMain(m *testing.M) { | ||
| minTLSVersion := flag.String("--min-TLS-Version", "1.2", "minimum TLS Version") | ||
| TLSVersion := minTLSVersions[*minTLSVersion] |
There was a problem hiding this comment.
Hrmm I don't quite understand why we're going through flag here. It seems quite indirect, and if this is why we need to mess with os.Args below, I'd rather keep looking for a different solution. (If this style is consistent with the other e2e tests, which I haven't check yet, please ignore me 😅)
I suppose we could set testServerParams.MinTLSVersion directly. If we need a different value for the other test below, could we change that field...?
There was a problem hiding this comment.
@srenatus all the tests in tls_test.go run through same opa server instance.
We have two set of testcases -
- default tls version set for server
- TLS1.3 set for server as implemented here
Hence to pass minTLSVersion to testServerParams through TestMain at runtime, I had to use os.Args, else I would have had to create two different servers for these testcases
Note: This flag is different from the one defined on server, its added to run the test with the command line parameter
Opa server now supports min TLS version, TLS versions supported are 1.0, 1.1, 1.2, 1.3. Since TLS 1.0 and 1.1 are deprecated, default min TLS version for opa is TLS 1.2 but if someone wants to restrict opa to use a specific minimum TLS version, they can specify it using cmd parameter --min-tls-version fixes open-policy-agent#3226 Signed-off-by: Amruta Kale <amruta.kale@styra.com>
Signed-off-by: Amruta Kale <amruta.kale@styra.com>
Signed-off-by: Amruta Kale <amruta.kale@styra.com>
|
awesome. Thanks @srenatus |
…y-agent#3517) * Support for minimum TLS version OPA server now supports min TLS version, TLS versions supported are 1.0, 1.1, 1.2, 1.3. Since TLS 1.0 and 1.1 are deprecated, default min TLS version for OPA is TLS 1.2 but if someone wants to restrict OPA to use a specific minimum TLS version, they can specify it using cmd parameter `--min-tls-version`. Fixes open-policy-agent#3226. Signed-off-by: Amruta Kale <amruta.kale@styra.com>
Opa server now supports minimum TLS version. Since TLS 1.0 and 1.1 are deprecated, default minimum TLS version for opa server is TLS 1.2 . If someone wants to restrict opa to start with a specific minimum tls version, they can specify it using cmd line parameter --min-tls-version. TLS versions supported are 1.0, 1.1, 1.2, 1.3.
fixes #3226
Signed-off-by: Amruta Kale amruta.kale@styra.com