Skip to content

Commit f8d0be6

Browse files
pacevedompacevedom
committed
update docs
1 parent 12c71d4 commit f8d0be6

2 files changed

Lines changed: 36 additions & 102 deletions

File tree

‎cmd/generate-config/config/config-openapi-spec.json‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -762,19 +762,19 @@
762762
"type": "object",
763763
"properties": {
764764
"custom": {
765-
"description": "custom is a user-defined TLS security profile. Be extremely careful using a custom\nprofile as invalid configurations can be catastrophic. An example custom profile\nlooks like this:\n\n ciphers:\n\n - ECDHE-ECDSA-CHACHA20-POLY1305\n\n - ECDHE-RSA-CHACHA20-POLY1305\n\n - ECDHE-RSA-AES128-GCM-SHA256\n\n - ECDHE-ECDSA-AES128-GCM-SHA256\n\n minTLSVersion: VersionTLS11",
765+
"description": "custom is a user-defined TLS security profile. Be extremely careful using a custom\nprofile as invalid configurations can be catastrophic. An example custom profile\nlooks like this:\n\n minTLSVersion: VersionTLS11\n ciphers:\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256",
766766
"type": "object",
767767
"properties": {
768768
"ciphers": {
769-
"description": "ciphers is used to specify the cipher algorithms that are negotiated\nduring the TLS handshake. Operators may remove entries their operands\ndo not support. For example, to use DES-CBC3-SHA (yaml):\n\n ciphers:\n - DES-CBC3-SHA",
769+
"description": "ciphers is used to specify the cipher algorithms that are negotiated\nduring the TLS handshake. Operators may remove entries that their operands\ndo not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml):\n\n ciphers:\n - ECDHE-RSA-AES128-GCM-SHA256\n\nTLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable\nand are always enabled when TLS 1.3 is negotiated.",
770770
"type": "array",
771771
"items": {
772772
"type": "string"
773773
},
774774
"x-kubernetes-list-type": "atomic"
775775
},
776776
"minTLSVersion": {
777-
"description": "minTLSVersion is used to specify the minimal version of the TLS protocol\nthat is negotiated during the TLS handshake. For example, to use TLS\nversions 1.1, 1.2 and 1.3 (yaml):\n\n minTLSVersion: VersionTLS11\n\nNOTE: currently the highest minTLSVersion allowed is VersionTLS12",
777+
"description": "minTLSVersion is used to specify the minimal version of the TLS protocol\nthat is negotiated during the TLS handshake. For example, to use TLS\nversions 1.1, 1.2 and 1.3 (yaml):\n\n minTLSVersion: VersionTLS11",
778778
"type": "string",
779779
"enum": [
780780
"VersionTLS10",
@@ -787,22 +787,22 @@
787787
"nullable": true
788788
},
789789
"intermediate": {
790-
"description": "intermediate is a TLS security profile based on:\n\nhttps://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29\n\nand looks like this (yaml):\n\n ciphers:\n\n - TLS_AES_128_GCM_SHA256\n\n - TLS_AES_256_GCM_SHA384\n\n - TLS_CHACHA20_POLY1305_SHA256\n\n - ECDHE-ECDSA-AES128-GCM-SHA256\n\n - ECDHE-RSA-AES128-GCM-SHA256\n\n - ECDHE-ECDSA-AES256-GCM-SHA384\n\n - ECDHE-RSA-AES256-GCM-SHA384\n\n - ECDHE-ECDSA-CHACHA20-POLY1305\n\n - ECDHE-RSA-CHACHA20-POLY1305\n\n - DHE-RSA-AES128-GCM-SHA256\n\n - DHE-RSA-AES256-GCM-SHA384\n\n minTLSVersion: VersionTLS12",
790+
"description": "intermediate is a TLS profile for use when you do not need compatibility with\nlegacy clients and want to remain highly secure while being compatible with\nmost clients currently in use.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS12\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305",
791791
"type": "object",
792792
"nullable": true
793793
},
794794
"modern": {
795-
"description": "modern is a TLS security profile based on:\n\nhttps://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility\n\nand looks like this (yaml):\n\n ciphers:\n\n - TLS_AES_128_GCM_SHA256\n\n - TLS_AES_256_GCM_SHA384\n\n - TLS_CHACHA20_POLY1305_SHA256\n\n minTLSVersion: VersionTLS13",
795+
"description": "modern is a TLS security profile for use with clients that support TLS 1.3 and\ndo not need backward compatibility for older clients.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS13\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256",
796796
"type": "object",
797797
"nullable": true
798798
},
799799
"old": {
800-
"description": "old is a TLS security profile based on:\n\nhttps://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility\n\nand looks like this (yaml):\n\n ciphers:\n\n - TLS_AES_128_GCM_SHA256\n\n - TLS_AES_256_GCM_SHA384\n\n - TLS_CHACHA20_POLY1305_SHA256\n\n - ECDHE-ECDSA-AES128-GCM-SHA256\n\n - ECDHE-RSA-AES128-GCM-SHA256\n\n - ECDHE-ECDSA-AES256-GCM-SHA384\n\n - ECDHE-RSA-AES256-GCM-SHA384\n\n - ECDHE-ECDSA-CHACHA20-POLY1305\n\n - ECDHE-RSA-CHACHA20-POLY1305\n\n - DHE-RSA-AES128-GCM-SHA256\n\n - DHE-RSA-AES256-GCM-SHA384\n\n - DHE-RSA-CHACHA20-POLY1305\n\n - ECDHE-ECDSA-AES128-SHA256\n\n - ECDHE-RSA-AES128-SHA256\n\n - ECDHE-ECDSA-AES128-SHA\n\n - ECDHE-RSA-AES128-SHA\n\n - ECDHE-ECDSA-AES256-SHA384\n\n - ECDHE-RSA-AES256-SHA384\n\n - ECDHE-ECDSA-AES256-SHA\n\n - ECDHE-RSA-AES256-SHA\n\n - DHE-RSA-AES128-SHA256\n\n - DHE-RSA-AES256-SHA256\n\n - AES128-GCM-SHA256\n\n - AES256-GCM-SHA384\n\n - AES128-SHA256\n\n - AES256-SHA256\n\n - AES128-SHA\n\n - AES256-SHA\n\n - DES-CBC3-SHA\n\n minTLSVersion: VersionTLS10",
800+
"description": "old is a TLS profile for use when services need to be accessed by very old\nclients or libraries and should be used only as a last resort.\n\nThis profile is equivalent to a Custom profile specified as:\n minTLSVersion: VersionTLS10\n ciphers:\n - TLS_AES_128_GCM_SHA256\n - TLS_AES_256_GCM_SHA384\n - TLS_CHACHA20_POLY1305_SHA256\n - ECDHE-ECDSA-AES128-GCM-SHA256\n - ECDHE-RSA-AES128-GCM-SHA256\n - ECDHE-ECDSA-AES256-GCM-SHA384\n - ECDHE-RSA-AES256-GCM-SHA384\n - ECDHE-ECDSA-CHACHA20-POLY1305\n - ECDHE-RSA-CHACHA20-POLY1305\n - ECDHE-ECDSA-AES128-SHA256\n - ECDHE-RSA-AES128-SHA256\n - ECDHE-ECDSA-AES128-SHA\n - ECDHE-RSA-AES128-SHA\n - ECDHE-ECDSA-AES256-SHA\n - ECDHE-RSA-AES256-SHA\n - AES128-GCM-SHA256\n - AES256-GCM-SHA384\n - AES128-SHA256\n - AES128-SHA\n - AES256-SHA\n - DES-CBC3-SHA",
801801
"type": "object",
802802
"nullable": true
803803
},
804804
"type": {
805-
"description": "type is one of Old, Intermediate, Modern or Custom. Custom provides\nthe ability to specify individual TLS security profile parameters.\nOld, Intermediate and Modern are TLS security profiles based on:\n\nhttps://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations\n\nThe profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers\nare found to be insecure. Depending on precisely which ciphers are available to a process, the list may be\nreduced.\n\nNote that the Modern profile is currently not supported because it is not\nyet well adopted by common software libraries.",
805+
"description": "type is one of Old, Intermediate, Modern or Custom. Custom provides the\nability to specify individual TLS security profile parameters.\n\nThe profiles are based on version 5.7 of the Mozilla Server Side TLS\nconfiguration guidelines. The cipher lists consist of the configuration's\n\"ciphersuites\" followed by the Go-specific \"ciphers\" from the guidelines.\nSee: https://ssl-config.mozilla.org/guidelines/5.7.json\n\nThe profiles are intent based, so they may change over time as new ciphers are\ndeveloped and existing ciphers are found to be insecure. Depending on\nprecisely which ciphers are available to a process, the list may be reduced.",
806806
"type": "string",
807807
"enum": [
808808
"Old",

‎packaging/microshift/config.yaml‎

Lines changed: 29 additions & 95 deletions
Original file line numberDiff line numberDiff line change
@@ -423,161 +423,95 @@ ingress:
423423
# profile as invalid configurations can be catastrophic. An example custom profile
424424
# looks like this:
425425

426+
# minTLSVersion: VersionTLS11
426427
# ciphers:
427-
428428
# - ECDHE-ECDSA-CHACHA20-POLY1305
429-
430429
# - ECDHE-RSA-CHACHA20-POLY1305
431-
432430
# - ECDHE-RSA-AES128-GCM-SHA256
433-
434431
# - ECDHE-ECDSA-AES128-GCM-SHA256
435-
436-
# minTLSVersion: VersionTLS11
437432
custom:
438433
# ciphers is used to specify the cipher algorithms that are negotiated
439-
# during the TLS handshake. Operators may remove entries their operands
440-
# do not support. For example, to use DES-CBC3-SHA (yaml):
434+
# during the TLS handshake. Operators may remove entries that their operands
435+
# do not support. For example, to use only ECDHE-RSA-AES128-GCM-SHA256 (yaml):
441436

442437
# ciphers:
443-
# - DES-CBC3-SHA
438+
# - ECDHE-RSA-AES128-GCM-SHA256
439+
440+
# TLS 1.3 cipher suites (e.g. TLS_AES_128_GCM_SHA256) are not configurable
441+
# and are always enabled when TLS 1.3 is negotiated.
444442
ciphers: []
445443
# minTLSVersion is used to specify the minimal version of the TLS protocol
446444
# that is negotiated during the TLS handshake. For example, to use TLS
447445
# versions 1.1, 1.2 and 1.3 (yaml):
448446

449447
# minTLSVersion: VersionTLS11
450-
451-
# NOTE: currently the highest minTLSVersion allowed is VersionTLS12
452448
minTLSVersion: ""
453-
# intermediate is a TLS security profile based on:
454-
455-
# https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility_.28recommended.29
456-
457-
# and looks like this (yaml):
449+
# intermediate is a TLS profile for use when you do not need compatibility with
450+
# legacy clients and want to remain highly secure while being compatible with
451+
# most clients currently in use.
458452

453+
# This profile is equivalent to a Custom profile specified as:
454+
# minTLSVersion: VersionTLS12
459455
# ciphers:
460-
461456
# - TLS_AES_128_GCM_SHA256
462-
463457
# - TLS_AES_256_GCM_SHA384
464-
465458
# - TLS_CHACHA20_POLY1305_SHA256
466-
467459
# - ECDHE-ECDSA-AES128-GCM-SHA256
468-
469460
# - ECDHE-RSA-AES128-GCM-SHA256
470-
471461
# - ECDHE-ECDSA-AES256-GCM-SHA384
472-
473462
# - ECDHE-RSA-AES256-GCM-SHA384
474-
475463
# - ECDHE-ECDSA-CHACHA20-POLY1305
476-
477464
# - ECDHE-RSA-CHACHA20-POLY1305
478-
479-
# - DHE-RSA-AES128-GCM-SHA256
480-
481-
# - DHE-RSA-AES256-GCM-SHA384
482-
483-
# minTLSVersion: VersionTLS12
484465
intermediate: {}
485-
# modern is a TLS security profile based on:
486-
487-
# https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility
488-
489-
# and looks like this (yaml):
466+
# modern is a TLS security profile for use with clients that support TLS 1.3 and
467+
# do not need backward compatibility for older clients.
490468

469+
# This profile is equivalent to a Custom profile specified as:
470+
# minTLSVersion: VersionTLS13
491471
# ciphers:
492-
493472
# - TLS_AES_128_GCM_SHA256
494-
495473
# - TLS_AES_256_GCM_SHA384
496-
497474
# - TLS_CHACHA20_POLY1305_SHA256
498-
499-
# minTLSVersion: VersionTLS13
500475
modern: {}
501-
# old is a TLS security profile based on:
502-
503-
# https://wiki.mozilla.org/Security/Server_Side_TLS#Old_backward_compatibility
504-
505-
# and looks like this (yaml):
476+
# old is a TLS profile for use when services need to be accessed by very old
477+
# clients or libraries and should be used only as a last resort.
506478

479+
# This profile is equivalent to a Custom profile specified as:
480+
# minTLSVersion: VersionTLS10
507481
# ciphers:
508-
509482
# - TLS_AES_128_GCM_SHA256
510-
511483
# - TLS_AES_256_GCM_SHA384
512-
513484
# - TLS_CHACHA20_POLY1305_SHA256
514-
515485
# - ECDHE-ECDSA-AES128-GCM-SHA256
516-
517486
# - ECDHE-RSA-AES128-GCM-SHA256
518-
519487
# - ECDHE-ECDSA-AES256-GCM-SHA384
520-
521488
# - ECDHE-RSA-AES256-GCM-SHA384
522-
523489
# - ECDHE-ECDSA-CHACHA20-POLY1305
524-
525490
# - ECDHE-RSA-CHACHA20-POLY1305
526-
527-
# - DHE-RSA-AES128-GCM-SHA256
528-
529-
# - DHE-RSA-AES256-GCM-SHA384
530-
531-
# - DHE-RSA-CHACHA20-POLY1305
532-
533491
# - ECDHE-ECDSA-AES128-SHA256
534-
535492
# - ECDHE-RSA-AES128-SHA256
536-
537493
# - ECDHE-ECDSA-AES128-SHA
538-
539494
# - ECDHE-RSA-AES128-SHA
540-
541-
# - ECDHE-ECDSA-AES256-SHA384
542-
543-
# - ECDHE-RSA-AES256-SHA384
544-
545495
# - ECDHE-ECDSA-AES256-SHA
546-
547496
# - ECDHE-RSA-AES256-SHA
548-
549-
# - DHE-RSA-AES128-SHA256
550-
551-
# - DHE-RSA-AES256-SHA256
552-
553497
# - AES128-GCM-SHA256
554-
555498
# - AES256-GCM-SHA384
556-
557499
# - AES128-SHA256
558-
559-
# - AES256-SHA256
560-
561500
# - AES128-SHA
562-
563501
# - AES256-SHA
564-
565502
# - DES-CBC3-SHA
566-
567-
# minTLSVersion: VersionTLS10
568503
old: {}
569-
# type is one of Old, Intermediate, Modern or Custom. Custom provides
570-
# the ability to specify individual TLS security profile parameters.
571-
# Old, Intermediate and Modern are TLS security profiles based on:
572-
573-
# https://wiki.mozilla.org/Security/Server_Side_TLS#Recommended_configurations
504+
# type is one of Old, Intermediate, Modern or Custom. Custom provides the
505+
# ability to specify individual TLS security profile parameters.
574506

575-
# The profiles are intent based, so they may change over time as new ciphers are developed and existing ciphers
576-
# are found to be insecure. Depending on precisely which ciphers are available to a process, the list may be
577-
# reduced.
507+
# The profiles are based on version 5.7 of the Mozilla Server Side TLS
508+
# configuration guidelines. The cipher lists consist of the configuration's
509+
# "ciphersuites" followed by the Go-specific "ciphers" from the guidelines.
510+
# See: https://ssl-config.mozilla.org/guidelines/5.7.json
578511

579-
# Note that the Modern profile is currently not supported because it is not
580-
# yet well adopted by common software libraries.
512+
# The profiles are intent based, so they may change over time as new ciphers are
513+
# developed and existing ciphers are found to be insecure. Depending on
514+
# precisely which ciphers are available to a process, the list may be reduced.
581515
type: ""
582516
# IngressControllerTuningOptions specifies options for tuning the performance
583517
# of ingress controller pods

0 commit comments

Comments
 (0)