[release-4.3] Bug 1827540: pkg/server: disable weak TLS versions #1681

openshift-cherrypick-robot · 2020-04-24T01:58:15Z

This is an automated cherry-pick of #1649

/assign runcom

Coming from an user request but it makes sense as we (OpenShift) use and control that port. Signed-off-by: Antonio Murdaca <[email protected]>

Co-Authored-By: Colin Walters <[email protected]> Signed-off-by: Antonio Murdaca <[email protected]>

openshift-ci-robot · 2020-04-24T01:58:18Z

@openshift-cherrypick-robot: This pull request references Bugzilla bug 1823852, which is invalid:

expected the bug to target the "4.3.z" release, but it targets "4.5.0" instead
expected the bug to be in one of the following states: NEW, ASSIGNED, ON_DEV, POST, POST, but it is MODIFIED instead
expected Bugzilla bug 1823852 to depend on a bug targeting a release in 4.4.0, 4.4.z and in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but no dependents were found

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sinnykumari · 2020-04-24T05:27:41Z

/retest

openshift-ci-robot · 2020-04-24T07:01:49Z

@openshift-cherrypick-robot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is NEW instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sinnykumari · 2020-04-24T12:22:07Z

/approve
/lgtm

openshift-bot · 2020-04-25T01:00:50Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-04-25T01:00:54Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is NEW instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-04-26T01:01:14Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-04-26T01:01:18Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is NEW instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-04-27T01:01:11Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-04-27T01:01:15Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is NEW instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

ashcrow

LGTM. Deferring to 4.3 patch manager for the right time to merge.

openshift-ci-robot · 2020-04-27T13:15:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ashcrow, openshift-cherrypick-robot, sinnykumari

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [ashcrow,sinnykumari]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2020-04-28T01:01:11Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-04-28T01:01:15Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is NEW instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-04-29T01:01:29Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-04-29T01:01:33Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is NEW instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-05-23T01:01:21Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is POST instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-24T01:00:54Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-24T01:00:57Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is POST instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-25T01:00:54Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-25T01:00:57Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is POST instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-26T01:00:46Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-26T01:00:50Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is POST instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-27T01:01:14Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-27T01:01:17Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is POST instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-28T01:00:57Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-28T01:01:00Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-29T01:01:17Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-29T01:01:20Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-30T01:01:19Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-30T01:01:23Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-05-31T01:00:55Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-05-31T01:00:58Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-06-01T01:00:50Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-06-01T01:00:53Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1827539 to be in one of the following states: VERIFIED, RELEASE_PENDING, CLOSED (ERRATA), but it is ON_QA instead
expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-bot · 2020-06-02T01:01:19Z

/bugzilla refresh

Recalculating validity in case the underlying Bugzilla bug has changed.

openshift-ci-robot · 2020-06-02T01:01:23Z

@openshift-bot: This pull request references Bugzilla bug 1827540, which is invalid:

expected dependent Bugzilla bug 1823852 to target a release in 4.4.0, 4.4.z, but it targets "4.5.0" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sinnykumari · 2020-06-02T06:06:34Z

/bugzilla refresh

openshift-ci-robot · 2020-06-02T06:06:41Z

@sinnykumari: This pull request references Bugzilla bug 1827540, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

6 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.3.z) matches configured target release for branch (4.3.z)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
dependent bug Bugzilla bug 1827539 is in the state VERIFIED, which is one of the valid states (VERIFIED, RELEASE_PENDING, CLOSED (ERRATA))
dependent Bugzilla bug 1827539 targets the "4.4.z" release, which is one of the valid target releases: 4.4.0, 4.4.z
bug has dependents

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot · 2020-06-04T08:33:52Z

@openshift-cherrypick-robot: The following test failed, say /retest to rerun all failed tests:

Test name	Commit	Details	Rerun command
ci/prow/e2e-gcp-upgrade	`b3d27cd`	link	`/test e2e-gcp-upgrade`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-bot · 2020-06-04T08:46:03Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2020-06-04T08:55:33Z

@openshift-cherrypick-robot: All pull requests linked via external trackers have merged: openshift/machine-config-operator#1681. Bugzilla bug 1827540 has been moved to the MODIFIED state.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

runcom and others added 2 commits April 24, 2020 01:58

pkg/server: disable weak TLS versions

0312cb0

Coming from an user request but it makes sense as we (OpenShift) use and control that port. Signed-off-by: Antonio Murdaca <[email protected]>

pkg/server: add a note on disallowing tls 1.1/1.0

b3d27cd

Co-Authored-By: Colin Walters <[email protected]> Signed-off-by: Antonio Murdaca <[email protected]>

openshift-ci-robot assigned runcom Apr 24, 2020

openshift-cherrypick-robot mentioned this pull request Apr 24, 2020

Bug 1823852: pkg/server: disable weak TLS versions #1649

Merged

openshift-ci-robot added the bugzilla/medium label Apr 24, 2020

openshift-ci-robot added the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Apr 24, 2020

openshift-ci-robot requested review from ashcrow and LorbusChris April 24, 2020 01:58

runcom changed the title ~~[release-4.3] Bug 1823852: pkg/server: disable weak TLS versions~~ Bug 1827540: [release-4.3] pkg/server: disable weak TLS versions Apr 24, 2020

openshift-ci-robot assigned sinnykumari Apr 24, 2020

openshift-ci-robot added lgtm Indicates that a PR is ready to be merged. approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Apr 24, 2020

openshift-ci-robot added the bugzilla/severity-medium Referenced Bugzilla bug's severity is medium for the branch this PR is targeting. label Apr 25, 2020

ashcrow approved these changes Apr 27, 2020

View reviewed changes

openshift-ci-robot removed the bugzilla/medium label Apr 29, 2020

openshift-ci-robot added bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. and removed bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Jun 2, 2020

mfojtik added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jun 4, 2020

openshift-merge-robot merged commit 4417d57 into openshift:release-4.3 Jun 4, 2020

[release-4.3] Bug 1827540: pkg/server: disable weak TLS versions #1681

[release-4.3] Bug 1827540: pkg/server: disable weak TLS versions #1681

Conversation

openshift-cherrypick-robot commented Apr 24, 2020

openshift-ci-robot commented Apr 24, 2020

sinnykumari commented Apr 24, 2020

openshift-ci-robot commented Apr 24, 2020

sinnykumari commented Apr 24, 2020

openshift-bot commented Apr 25, 2020

openshift-ci-robot commented Apr 25, 2020

openshift-bot commented Apr 26, 2020

openshift-ci-robot commented Apr 26, 2020

openshift-bot commented Apr 27, 2020

openshift-ci-robot commented Apr 27, 2020

ashcrow left a comment

Choose a reason for hiding this comment

openshift-ci-robot commented Apr 27, 2020

openshift-bot commented Apr 28, 2020

openshift-ci-robot commented Apr 28, 2020

openshift-bot commented Apr 29, 2020

openshift-ci-robot commented Apr 29, 2020

openshift-ci-robot commented May 23, 2020

openshift-bot commented May 24, 2020

openshift-ci-robot commented May 24, 2020

openshift-bot commented May 25, 2020

openshift-ci-robot commented May 25, 2020

openshift-bot commented May 26, 2020

openshift-ci-robot commented May 26, 2020

openshift-bot commented May 27, 2020

openshift-ci-robot commented May 27, 2020

openshift-bot commented May 28, 2020

openshift-ci-robot commented May 28, 2020

openshift-bot commented May 29, 2020

openshift-ci-robot commented May 29, 2020

openshift-bot commented May 30, 2020

openshift-ci-robot commented May 30, 2020

openshift-bot commented May 31, 2020

openshift-ci-robot commented May 31, 2020

openshift-bot commented Jun 1, 2020

openshift-ci-robot commented Jun 1, 2020

openshift-bot commented Jun 2, 2020

openshift-ci-robot commented Jun 2, 2020

sinnykumari commented Jun 2, 2020

openshift-ci-robot commented Jun 2, 2020

openshift-ci-robot commented Jun 4, 2020

openshift-bot commented Jun 4, 2020

openshift-ci-robot commented Jun 4, 2020