You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Is your feature request related to a problem? Please describe.
The allocator server can be configured to use TLS, relies on Go's crypto/tls package for TLS connection. Some of defaults cipher suits in Go's package may include less secure options that hardcoded into the library.(e.g. TLS_RSA_WITH_3DES_EDE_CBC_SHA).
How to reproduce it:
Install Agones with TLS certificates for the allocator(I'm using cert-manager with self-signed certificates). Expose allocator service using port-forwarding(k port-forward svc/agones-allocator 4443:443 -n $NS) or serviceType LoadBalancer. Use the nmap command to check the enabled ciphers: nmap --script ssl-enum-ciphers -p 443 $ENDPOINT
Environment:
Agones version: 1.42.0
Kubernetes version: client (1.25) and server (1.27)
Install method (yaml/helm): helm
Describe the solution you'd like
A new option to specify a preferred cipher suites could be added to the allocator, along with an option to select TLS version. Similar to how it's done in cert-manager here
Describe alternatives you've considered
Additional context
I believe it's low-priority security issue, as exploiting weak ciphers would still be challenging. However, adding flexibility in TLS configuration would enhance security and future-proof the allocator against vulnerabilities.
The text was updated successfully, but these errors were encountered:
Hi @RedShiba, for some reason I couldn't reproduce the same set of ciphers that include TLS_RSA_WITH_3DES_EDE_CBC_SHA, I don't know if it is because the version differences of Agones(I'm using 1.46) or Kubernetes? I installed Agones with helm and followed https://agones.dev/site/docs/advanced/allocator-service/#server-tls-certificate, using cert-manager and the bash script for the self-signed certificate.
Can you still reproduce the issue? If so, can you give more details on how you installed Agones with TLS certificates for the allocator?
Hi, @peterzhongyi , I tested different versions of Agones locally. Yes, you are right. I can't reproduce the issue anymore since version 1.44 of Agones. Seems the issue was fixed here after updating the Go library.
Is your feature request related to a problem? Please describe.
The allocator server can be configured to use TLS, relies on Go's crypto/tls package for TLS connection. Some of defaults cipher suits in Go's package may include less secure options that hardcoded into the library.(e.g. TLS_RSA_WITH_3DES_EDE_CBC_SHA).
How to reproduce it:
Install Agones with TLS certificates for the allocator(I'm using cert-manager with self-signed certificates). Expose allocator service using port-forwarding(
k port-forward svc/agones-allocator 4443:443 -n $NS
) or serviceType LoadBalancer. Use the nmap command to check the enabled ciphers:nmap --script ssl-enum-ciphers -p 443 $ENDPOINT
Environment:
Agones version: 1.42.0
Kubernetes version: client (1.25) and server (1.27)
Install method (yaml/helm): helm
Describe the solution you'd like
A new option to specify a preferred cipher suites could be added to the allocator, along with an option to select TLS version. Similar to how it's done in cert-manager here
Describe alternatives you've considered
Additional context
I believe it's low-priority security issue, as exploiting weak ciphers would still be challenging. However, adding flexibility in TLS configuration would enhance security and future-proof the allocator against vulnerabilities.
The text was updated successfully, but these errors were encountered: