allow configuration of upstream TLS connection settings

apis/projectcontour/v1alpha1/contourconfig.go

@@ -688,6 +688,11 @@ type ClusterParameters struct {
 	// +kubebuilder:validation:Minimum=1
 	// +optional
 	PerConnectionBufferLimitBytes *uint32 `json:"per-connection-buffer-limit-bytes,omitempty"`
+
+	// UpstreamTLS contains the TLS policy parameters for upstream connections
+	//
+	// +optional
+	UpstreamTLS *EnvoyTLS `json:"upstreamTLS,omitempty"`
 }
 
 // HTTPProxyConfig defines parameters on HTTPProxy.

changelogs/unreleased/5828-KauzClay-minor.md

@@ -0,0 +1,8 @@
+## Allow Configuration of Upstream TLS Options
+
+In a similar way to how Contour users can configure Min/Max TLS version and
+Cipher Suites for Envoy's listeners, this change allows users to specify the
+same information for upstream connections. In the ContourConfiguration, this is
+available under `spec.envoy.cluster.upstreamTLS`. The equivalent config file
+parameter is `cluster.upstream-tls` .This change also defaults the Max TLS
+version for upstream connections to 1.3, instead of the Envoy default of 1.2.

cmd/contour/serve.go

@@ -560,6 +560,11 @@
 		globalRateLimitService:             contourConfiguration.RateLimitService,
 		maxRequestsPerConnection:           contourConfiguration.Envoy.Cluster.MaxRequestsPerConnection,
 		perConnectionBufferLimitBytes:      contourConfiguration.Envoy.Cluster.PerConnectionBufferLimitBytes,
+		upstreamTLS: &contour_api_v1alpha1.EnvoyTLS{
+			MinimumProtocolVersion: annotation.TLSVersion(contourConfiguration.Envoy.Cluster.UpstreamTLS.MinimumProtocolVersion, "1.2"),
+			MaximumProtocolVersion: annotation.TLSVersion(contourConfiguration.Envoy.Cluster.UpstreamTLS.MaximumProtocolVersion, "1.3"),
+			CipherSuites:           contourConfiguration.Envoy.Cluster.UpstreamTLS.SanitizedCipherSuites(),
+		},
 	})
 
 	// Build the core Kubernetes event handler.
@@ -1117,6 +1122,7 @@
 	maxRequestsPerConnection           *uint32
 	perConnectionBufferLimitBytes      *uint32
 	globalRateLimitService             *contour_api_v1alpha1.RateLimitServiceConfig
+	upstreamTLS                        *contour_api_v1alpha1.EnvoyTLS
 }
 
 func (s *Server) getDAGBuilder(dbc dagBuilderConfig) *dag.Builder {
@@ -1194,6 +1200,7 @@
 			FieldLogger:       s.log.WithField("context", "ExtensionServiceProcessor"),
 			ClientCertificate: dbc.clientCert,
 			ConnectTimeout:    dbc.connectTimeout,
+			UpstreamTLS:       dbc.upstreamTLS,
 		},
 		&dag.HTTPProxyProcessor{
 			EnableExternalNameService:     dbc.enableExternalNameService,
@@ -1209,6 +1216,7 @@
 			GlobalRateLimitService:        dbc.globalRateLimitService,
 			PerConnectionBufferLimitBytes: dbc.perConnectionBufferLimitBytes,
 			SetSourceMetadataOnRoutes:     true,
+			UpstreamTLS:                   dbc.upstreamTLS,
 		},
 	}
 

cmd/contour/servecontext.go

@@ -307,7 +307,7 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
 	}
 
 	var cipherSuites []string
-	for _, suite := range ctx.Config.TLS.CipherSuites {
+	for _, suite := range ctx.Config.TLS.ProtocolParameters.CipherSuites {
 		cipherSuites = append(cipherSuites, suite)
 	}
 
@@ -531,8 +531,8 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
 				MaxRequestsPerIOCycle:         ctx.Config.Listener.MaxRequestsPerIOCycle,
 				HTTP2MaxConcurrentStreams:     ctx.Config.Listener.HTTP2MaxConcurrentStreams,
 				TLS: &contour_api_v1alpha1.EnvoyTLS{
-					MinimumProtocolVersion: ctx.Config.TLS.MinimumProtocolVersion,
-					MaximumProtocolVersion: ctx.Config.TLS.MaximumProtocolVersion,
+					MinimumProtocolVersion: ctx.Config.TLS.ProtocolParameters.MinimumProtocolVersion,
+					MaximumProtocolVersion: ctx.Config.TLS.ProtocolParameters.MaximumProtocolVersion,
 					CipherSuites:           cipherSuites,
 				},
 				SocketOptions: &contour_api_v1alpha1.SocketOptions{
@@ -572,6 +572,11 @@ func (ctx *serveContext) convertToContourConfigurationSpec() contour_api_v1alpha
 				DNSLookupFamily:               dnsLookupFamily,
 				MaxRequestsPerConnection:      ctx.Config.Cluster.MaxRequestsPerConnection,
 				PerConnectionBufferLimitBytes: ctx.Config.Cluster.PerConnectionBufferLimitBytes,
+				UpstreamTLS: &contour_api_v1alpha1.EnvoyTLS{
+					MinimumProtocolVersion: ctx.Config.Cluster.UpstreamTLS.MinimumProtocolVersion,
+					MaximumProtocolVersion: ctx.Config.Cluster.UpstreamTLS.MaximumProtocolVersion,
+					CipherSuites:           ctx.Config.Cluster.UpstreamTLS.CipherSuites,
+				},
 			},
 			Network: &contour_api_v1alpha1.NetworkParameters{
 				XffNumTrustedHops: &ctx.Config.Network.XffNumTrustedHops,

cmd/contour/servecontext_test.go

@@ -474,6 +474,10 @@ func TestConvertServeContext(t *testing.T) {
 				},
 				Cluster: &contour_api_v1alpha1.ClusterParameters{
 					DNSLookupFamily: contour_api_v1alpha1.AutoClusterDNSFamily,
+					UpstreamTLS: &contour_api_v1alpha1.EnvoyTLS{
+						MinimumProtocolVersion: "",
+						MaximumProtocolVersion: "",
+					},
 				},
 				Network: &contour_api_v1alpha1.NetworkParameters{
 					EnvoyAdminPort:    ref.To(9001),

examples/contour/01-crds.yaml

@@ -111,6 +111,48 @@ spec:
                         format: int32
                         minimum: 1
                         type: integer
+                      upstreamTLS:
+                        description: UpstreamTLS contains the TLS policy parameters
+                          for upstream connections
+                        properties:
+                          cipherSuites:
+                            description: "CipherSuites defines the TLS ciphers to
+                              be supported by Envoy TLS listeners when negotiating
+                              TLS 1.2. Ciphers are validated against the set that
+                              Envoy supports by default. This parameter should only
+                              be used by advanced users. Note that these will be ignored
+                              when TLS 1.3 is in use. \n This field is optional; when
+                              it is undefined, a Contour-managed ciphersuite list
+                              will be used, which may be updated to keep it secure.
+                              \n Contour's default list is: - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\"
+                              - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\"
+                              - \"ECDHE-ECDSA-AES256-GCM-SHA384\" - \"ECDHE-RSA-AES256-GCM-SHA384\"
+                              \n Ciphers provided are validated against the following
+                              list: - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\"
+                              - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\"
+                              - \"ECDHE-ECDSA-AES128-GCM-SHA256\" - \"ECDHE-RSA-AES128-GCM-SHA256\"
+                              - \"ECDHE-ECDSA-AES128-SHA\" - \"ECDHE-RSA-AES128-SHA\"
+                              - \"AES128-GCM-SHA256\" - \"AES128-SHA\" - \"ECDHE-ECDSA-AES256-GCM-SHA384\"
+                              - \"ECDHE-RSA-AES256-GCM-SHA384\" - \"ECDHE-ECDSA-AES256-SHA\"
+                              - \"ECDHE-RSA-AES256-SHA\" - \"AES256-GCM-SHA384\" -
+                              \"AES256-SHA\" \n Contour recommends leaving this undefined
+                              unless you are sure you must. \n See: https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
+                              Note: This list is a superset of what is valid for stock
+                              Envoy builds and those using BoringSSL FIPS."
+                            items:
+                              type: string
+                            type: array
+                          maximumProtocolVersion:
+                            description: "MaximumProtocolVersion is the maximum TLS
+                              version this vhost should negotiate. \n Values: `1.2`,
+                              `1.3`(default). \n Other values will produce an error."
+                            type: string
+                          minimumProtocolVersion:
+                            description: "MinimumProtocolVersion is the minimum TLS
+                              version this vhost should negotiate. \n Values: `1.2`
+                              (default), `1.3`. \n Other values will produce an error."
+                            type: string
+                        type: object
                     type: object
                   defaultHTTPVersions:
                     description: "DefaultHTTPVersions defines the default set of HTTPS
@@ -3579,6 +3621,52 @@ spec:
                             format: int32
                             minimum: 1
                             type: integer
+                          upstreamTLS:
+                            description: UpstreamTLS contains the TLS policy parameters
+                              for upstream connections
+                            properties:
+                              cipherSuites:
+                                description: "CipherSuites defines the TLS ciphers
+                                  to be supported by Envoy TLS listeners when negotiating
+                                  TLS 1.2. Ciphers are validated against the set that
+                                  Envoy supports by default. This parameter should
+                                  only be used by advanced users. Note that these
+                                  will be ignored when TLS 1.3 is in use. \n This
+                                  field is optional; when it is undefined, a Contour-managed
+                                  ciphersuite list will be used, which may be updated
+                                  to keep it secure. \n Contour's default list is:
+                                  - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\"
+                                  - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\"
+                                  - \"ECDHE-ECDSA-AES256-GCM-SHA384\" - \"ECDHE-RSA-AES256-GCM-SHA384\"
+                                  \n Ciphers provided are validated against the following
+                                  list: - \"[ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305]\"
+                                  - \"[ECDHE-RSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305]\"
+                                  - \"ECDHE-ECDSA-AES128-GCM-SHA256\" - \"ECDHE-RSA-AES128-GCM-SHA256\"
+                                  - \"ECDHE-ECDSA-AES128-SHA\" - \"ECDHE-RSA-AES128-SHA\"
+                                  - \"AES128-GCM-SHA256\" - \"AES128-SHA\" - \"ECDHE-ECDSA-AES256-GCM-SHA384\"
+                                  - \"ECDHE-RSA-AES256-GCM-SHA384\" - \"ECDHE-ECDSA-AES256-SHA\"
+                                  - \"ECDHE-RSA-AES256-SHA\" - \"AES256-GCM-SHA384\"
+                                  - \"AES256-SHA\" \n Contour recommends leaving this
+                                  undefined unless you are sure you must. \n See:
+                                  https://www.envoyproxy.io/docs/envoy/latest/api-v3/extensions/transport_sockets/tls/v3/common.proto#extensions-transport-sockets-tls-v3-tlsparameters
+                                  Note: This list is a superset of what is valid for
+                                  stock Envoy builds and those using BoringSSL FIPS."
+                                items:
+                                  type: string
+                                type: array
+                              maximumProtocolVersion:
+                                description: "MaximumProtocolVersion is the maximum
+                                  TLS version this vhost should negotiate. \n Values:
+                                  `1.2`, `1.3`(default). \n Other values will produce
+                                  an error."
+                                type: string
+                              minimumProtocolVersion:
+                                description: "MinimumProtocolVersion is the minimum
+                                  TLS version this vhost should negotiate. \n Values:
+                                  `1.2` (default), `1.3`. \n Other values will produce
+                                  an error."
+                                type: string
+                            type: object
                         type: object
                       defaultHTTPVersions:
                         description: "DefaultHTTPVersions defines the default set