easylinux/kube-prometheus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #1216 from fpetkovski/prometheus-adapter-cipher-suites

Browse Source 
jsonnet: disable insecure cypher suites for prometheus-adapter
This commit is contained in:
Damien Grisonnet
2021-06-23 21:19:24 +02:00
committed by GitHub
parent 7932456718 0ff173efea
commit 2c5c20cfff
2 changed files with 19 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
View File

@@ -53,6 +53,23 @@ local defaults = {
window: '5m',
},
},
tlsCipherSuites: [
'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305',
'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305',
'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',
'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256',
'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA',
'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',
'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA',
'TLS_RSA_WITH_AES_128_GCM_SHA256',
'TLS_RSA_WITH_AES_256_GCM_SHA384',
'TLS_RSA_WITH_AES_128_CBC_SHA',
'TLS_RSA_WITH_AES_256_CBC_SHA',
],
};
function(params) {
@@ -145,6 +162,7 @@ function(params) {
'--metrics-relist-interval=1m',
'--prometheus-url=' + pa._config.prometheusURL,
'--secure-port=6443',
'--tls-cipher-suites=' + std.join(',', pa._config.tlsCipherSuites),
],
ports: [{ containerPort: 6443 }],
volumeMounts: [