From 264cf11bf0120529679c2275a137e163005f9eb9 Mon Sep 17 00:00:00 2001
From: Matthias Loibl <mail@matthiasloibl.com>
Date: Mon, 21 Jan 2019 20:04:42 +0100
Subject: [PATCH] contrib/kube-prometheus: Begin to fix cipher suites
---
jsonnet/kube-prometheus/kube-prometheus.libsonnet | 12 ++++++------
.../kube-state-metrics/kube-state-metrics.libsonnet | 1 +
.../node-exporter/node-exporter.libsonnet | 1 +
3 files changed, 8 insertions(+), 6 deletions(-)
diff --git a/jsonnet/kube-prometheus/kube-prometheus.libsonnet b/jsonnet/kube-prometheus/kube-prometheus.libsonnet
index 7dae5f38..4b0d5a22 100644
--- a/jsonnet/kube-prometheus/kube-prometheus.libsonnet
+++ b/jsonnet/kube-prometheus/kube-prometheus.libsonnet
@@ -59,12 +59,12 @@ local configMapList = k.core.v1.configMapList;
'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',
'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256',
'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256',
- 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
- 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
- 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
- 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
- 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305',
- 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305',
+ // 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256', // Doesn't work with h2
+ // 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256', // Doesn't work with h2
+ // 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', // TODO: Might not work with h2
+ // 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384', // TODO: Might not work with h2
+ // 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305', // TODO: Might not work with h2
+ // 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305', // TODO: Might not work with h2
],
cadvisorSelector: 'job="kubelet"',
diff --git a/jsonnet/kube-prometheus/kube-state-metrics/kube-state-metrics.libsonnet b/jsonnet/kube-prometheus/kube-state-metrics/kube-state-metrics.libsonnet
index 30a176f5..2cf7ebbc 100644
--- a/jsonnet/kube-prometheus/kube-state-metrics/kube-state-metrics.libsonnet
+++ b/jsonnet/kube-prometheus/kube-state-metrics/kube-state-metrics.libsonnet
@@ -134,6 +134,7 @@ local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
local proxyClusterMetrics =
container.new('kube-rbac-proxy-main', $._config.imageRepos.kubeRbacProxy + ':' + $._config.versions.kubeRbacProxy) +
container.withArgs([
+ '--logtostderr',
'--secure-listen-address=:8443',
'--tls-cipher-suites=' + std.join(',', $._config.tlsCipherSuites),
'--upstream=http://127.0.0.1:8081/',
diff --git a/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet b/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
index 7030d2f9..052f8dc6 100644
--- a/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
+++ b/jsonnet/kube-prometheus/node-exporter/node-exporter.libsonnet
@@ -106,6 +106,7 @@ local k = import 'ksonnet/ksonnet.beta.3/k.libsonnet';
local proxy =
container.new('kube-rbac-proxy', $._config.imageRepos.kubeRbacProxy + ':' + $._config.versions.kubeRbacProxy) +
container.withArgs([
+ '--logtostderr',
'--secure-listen-address=$(IP):' + $._config.nodeExporter.port,
'--tls-cipher-suites=' + std.join(',', $._config.tlsCipherSuites),
'--upstream=http://127.0.0.1:' + $._config.nodeExporter.port + '/',
--
GitLab