From bc3f1a1e8738302ab4a346f26e8bcc02f4020d60 Mon Sep 17 00:00:00 2001 From: Samuel Liu Date: Mon, 7 Dec 2020 10:20:39 +0800 Subject: [PATCH 1/2] Add etcd tls cipher suites --- roles/etcd/defaults/main.yml | 27 +++++++++++++++++++ roles/etcd/templates/etcd-events.env.j2 | 4 +++ roles/etcd/templates/etcd.env.j2 | 4 +++ ...t_centos7-flannel-containerd-addons-ha.yml | 5 ++++ 4 files changed, 40 insertions(+) diff --git a/roles/etcd/defaults/main.yml b/roles/etcd/defaults/main.yml index e23f0f6efed..5ebb09b4abb 100644 --- a/roles/etcd/defaults/main.yml +++ b/roles/etcd/defaults/main.yml @@ -65,3 +65,30 @@ etcd_peer_client_auth: true # Number of loop retries etcd_retries: 4 + +# Support tls cipher suites. +# etcd_tls_cipher_suites: {} + # - TLS_RSA_WITH_RC4_128_SHA + # - TLS_RSA_WITH_3DES_EDE_CBC_SHA + # - TLS_RSA_WITH_AES_128_CBC_SHA + # - TLS_RSA_WITH_AES_256_CBC_SHA + # - TLS_RSA_WITH_AES_128_CBC_SHA256 + # - TLS_RSA_WITH_AES_128_GCM_SHA256 + # - TLS_RSA_WITH_AES_256_GCM_SHA384 + # - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA + # - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA + # - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA + # - TLS_ECDHE_RSA_WITH_RC4_128_SHA + # - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA + # - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA + # - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA + # - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 + # - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 + # - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + # - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + # - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 + # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 + # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 + # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 + # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 diff --git a/roles/etcd/templates/etcd-events.env.j2 b/roles/etcd/templates/etcd-events.env.j2 index 99820fb2a67..da676beeae4 100644 --- a/roles/etcd/templates/etcd-events.env.j2 +++ b/roles/etcd/templates/etcd-events.env.j2 @@ -31,6 +31,10 @@ ETCD_PEER_CERT_FILE={{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem ETCD_PEER_KEY_FILE={{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem ETCD_PEER_CLIENT_CERT_AUTH={{ etcd_peer_client_auth }} +{% if etcd_tls_cipher_suites is defined %} +ETCD_CIPHER_SUITES: {% for tls in etcd_tls_cipher_suites %}{{ tls }}{{ "," if not loop.last else "" }}{% endfor %} +{% endif %} + {% for key, value in etcd_extra_vars.items() %} {{ key }}={{ value }} {% endfor %} diff --git a/roles/etcd/templates/etcd.env.j2 b/roles/etcd/templates/etcd.env.j2 index f3114afd0ab..9634477ddc4 100644 --- a/roles/etcd/templates/etcd.env.j2 +++ b/roles/etcd/templates/etcd.env.j2 @@ -40,6 +40,10 @@ ETCD_PEER_CERT_FILE={{ etcd_cert_dir }}/member-{{ inventory_hostname }}.pem ETCD_PEER_KEY_FILE={{ etcd_cert_dir }}/member-{{ inventory_hostname }}-key.pem ETCD_PEER_CLIENT_CERT_AUTH={{ etcd_peer_client_auth }} +{% if etcd_tls_cipher_suites is defined %} +ETCD_CIPHER_SUITES: {% for tls in etcd_tls_cipher_suites %}{{ tls }}{{ "," if not loop.last else "" }}{% endfor %} +{% endif %} + {% for key, value in etcd_extra_vars.items() %} {{ key }}={{ value }} {% endfor %} diff --git a/tests/files/packet_centos7-flannel-containerd-addons-ha.yml b/tests/files/packet_centos7-flannel-containerd-addons-ha.yml index 9dfcf6b0d59..e40ff83bd09 100644 --- a/tests/files/packet_centos7-flannel-containerd-addons-ha.yml +++ b/tests/files/packet_centos7-flannel-containerd-addons-ha.yml @@ -31,3 +31,8 @@ kube_oidc_client_id: kubespray-example tls_min_version: "VersionTLS12" tls_cipher_suites: - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + +# test etcd tls cipher suites +etcd_tls_cipher_suites: + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 From 464ad4e0babbef0995f5a31f70eb18abd86bed68 Mon Sep 17 00:00:00 2001 From: Samuel Liu Date: Mon, 7 Dec 2020 10:38:23 +0800 Subject: [PATCH 2/2] yamllint --- roles/etcd/defaults/main.yml | 50 ++++++++++++++++++------------------ 1 file changed, 25 insertions(+), 25 deletions(-) diff --git a/roles/etcd/defaults/main.yml b/roles/etcd/defaults/main.yml index 5ebb09b4abb..9533f4e7032 100644 --- a/roles/etcd/defaults/main.yml +++ b/roles/etcd/defaults/main.yml @@ -66,29 +66,29 @@ etcd_peer_client_auth: true # Number of loop retries etcd_retries: 4 -# Support tls cipher suites. +## Support tls cipher suites. # etcd_tls_cipher_suites: {} - # - TLS_RSA_WITH_RC4_128_SHA - # - TLS_RSA_WITH_3DES_EDE_CBC_SHA - # - TLS_RSA_WITH_AES_128_CBC_SHA - # - TLS_RSA_WITH_AES_256_CBC_SHA - # - TLS_RSA_WITH_AES_128_CBC_SHA256 - # - TLS_RSA_WITH_AES_128_GCM_SHA256 - # - TLS_RSA_WITH_AES_256_GCM_SHA384 - # - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA - # - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - # - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - # - TLS_ECDHE_RSA_WITH_RC4_128_SHA - # - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - # - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - # - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - # - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 - # - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - # - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - # - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - # - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - # - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 - # - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 - # - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 +# - TLS_RSA_WITH_RC4_128_SHA +# - TLS_RSA_WITH_3DES_EDE_CBC_SHA +# - TLS_RSA_WITH_AES_128_CBC_SHA +# - TLS_RSA_WITH_AES_256_CBC_SHA +# - TLS_RSA_WITH_AES_128_CBC_SHA256 +# - TLS_RSA_WITH_AES_128_GCM_SHA256 +# - TLS_RSA_WITH_AES_256_GCM_SHA384 +# - TLS_ECDHE_ECDSA_WITH_RC4_128_SHA +# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA +# - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA +# - TLS_ECDHE_RSA_WITH_RC4_128_SHA +# - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA +# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA +# - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA +# - TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 +# - TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 +# - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +# - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +# - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 +# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305 +# - TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 +# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 +# - TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256