webhook tls min version to tls_v1.2

[kangsheng89]

Currently the webhook on controller-manager is operate on port 9443. The webhook server of the https://github.com/kubernetes-sigs/controller-runtime/blob/master/pkg/webhook/server.go#L77 is configurable

Is there any plan to support setting to use min tls v1.2 as open telemetry collector of v0.59.0? and
TLS 1.0 and 1.1 are deprecated due to known vulnerabilities and should be avoided.

[kangsheng89]

Before add this, the controller-runtime has to be updated to v0.13.1
kubernetes-sigs/controller-runtime@v0.13.0...v0.13.1

depends on #1221

[pavolloffay]

Now we rely on the manager to create the default webhook server. The #1221 has been merged. Do you know if the default server will set TLS to 1.2?

opentelemetry-operator/main.go

Line 154 in 7ce297d

mgrOptions := ctrl.Options{

	// WebhookServer is an externally configured webhook.Server. By default,
	// a Manager will create a default server using Port, Host, and CertDir;
	// if this is set, the Manager will use this server instead.
	WebhookServer *webhook.Server

[kangsheng89]

i think we can update TLS config through this https://github.com/kubernetes-sigs/controller-runtime/blob/master/pkg/manager/manager.go#L253

first using crypto/tls lib

    import (
         "crypto/tls"
    ...
    )

       #set const of minTLS
        const defaultMinTLSVersion = tls.VersionTLS12

        ...
        # array of function for config setting
	optionsTlSOptsFuncs := []func(*tls.Config){
		func(config *tls.Config) { minTlsDefault(config) },
	}
	mgrOptions := ctrl.Options{
		Scheme:                 scheme,
		MetricsBindAddress:     metricsAddr,
		Port:                   webhookPort,
		TLSOpts:                optionsTlSOptsFuncs,
        ....}

# function to set minTls Default
func minTlsDefault(cfg *tls.Config) {
	cfg.MinVersion = tls.VersionTLS12
}

This is my initial idea, need to be test and verify. And i need some help to understand the build and debug of opentelemetry-operator on local.