diff --git a/pkg/apis/kops/componentconfig.go b/pkg/apis/kops/componentconfig.go index 1df4967470..510eb0b530 100644 --- a/pkg/apis/kops/componentconfig.go +++ b/pkg/apis/kops/componentconfig.go @@ -34,6 +34,10 @@ type KubeletConfigSpec struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // KubeconfigPath is the path of kubeconfig for the kubelet KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"` // RequireKubeconfig indicates a kubeconfig is required @@ -281,6 +285,10 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers @@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct { ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` } // CloudControllerManagerConfig is the configuration of the cloud controller diff --git a/pkg/apis/kops/v1alpha1/componentconfig.go b/pkg/apis/kops/v1alpha1/componentconfig.go index 04f0976fe2..d7f92f2104 100644 --- a/pkg/apis/kops/v1alpha1/componentconfig.go +++ b/pkg/apis/kops/v1alpha1/componentconfig.go @@ -34,6 +34,10 @@ type KubeletConfigSpec struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // KubeconfigPath is the path of kubeconfig for the kubelet KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"` // RequireKubeconfig indicates a kubeconfig is required @@ -281,6 +285,10 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers @@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct { ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` } // CloudControllerManagerConfig is the configuration of the cloud controller diff --git a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go index 905d2067a6..8cdbf15bd1 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.conversion.go @@ -2932,6 +2932,8 @@ func autoConvert_v1alpha1_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3017,6 +3019,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha1_KubeAPIServerConfig(in *ko out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3112,6 +3116,8 @@ func autoConvert_v1alpha1_KubeControllerManagerConfig_To_kops_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3156,6 +3162,8 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha1_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3312,6 +3320,8 @@ func autoConvert_v1alpha1_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel @@ -3391,6 +3401,8 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha1_KubeletConfigSpec(in *kops.K out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel diff --git a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go index 8d7ac9163a..a2c94af5ab 100644 --- a/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha1/zz_generated.deepcopy.go @@ -1607,6 +1607,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged *out = new(bool) @@ -1929,6 +1934,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } return } @@ -2082,6 +2092,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.RequireKubeconfig != nil { in, out := &in.RequireKubeconfig, &out.RequireKubeconfig *out = new(bool) diff --git a/pkg/apis/kops/v1alpha2/componentconfig.go b/pkg/apis/kops/v1alpha2/componentconfig.go index 5f00d72420..0550e45773 100644 --- a/pkg/apis/kops/v1alpha2/componentconfig.go +++ b/pkg/apis/kops/v1alpha2/componentconfig.go @@ -34,6 +34,10 @@ type KubeletConfigSpec struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // KubeconfigPath is the path of kubeconfig for the kubelet KubeconfigPath string `json:"kubeconfigPath,omitempty" flag:"kubeconfig"` // RequireKubeconfig indicates a kubeconfig is required @@ -281,6 +285,10 @@ type KubeAPIServerConfig struct { TLSCertFile string `json:"tlsCertFile,omitempty" flag:"tls-cert-file"` // TODO: Remove unused TLSPrivateKeyFile TLSPrivateKeyFile string `json:"tlsPrivateKeyFile,omitempty" flag:"tls-private-key-file"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` // TODO: Remove unused TokenAuthFile TokenAuthFile string `json:"tokenAuthFile,omitempty" flag:"token-auth-file"` // AllowPrivileged indicates if we can run privileged containers @@ -475,6 +483,10 @@ type KubeControllerManagerConfig struct { ExperimentalClusterSigningDuration *metav1.Duration `json:"experimentalClusterSigningDuration,omitempty" flag:"experimental-cluster-signing-duration"` // FeatureGates is set of key=value pairs that describe feature gates for alpha/experimental features. FeatureGates map[string]string `json:"featureGates,omitempty" flag:"feature-gates"` + // TLSCipherSuites indicates the allowed TLS cipher suite + TLSCipherSuites []string `json:"tlsCipherSuites,omitempty" flag:"tls-cipher-suites"` + // TLSMinVersion indicates the minimum TLS version allowed + TLSMinVersion string `json:"tlsMinVersion,omitempty" flag:"tls-min-version"` } // CloudControllerManagerConfig is the configuration of the cloud controller diff --git a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go index 37f2321d86..ed1e68213a 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.conversion.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.conversion.go @@ -3202,6 +3202,8 @@ func autoConvert_v1alpha2_KubeAPIServerConfig_To_kops_KubeAPIServerConfig(in *Ku out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3287,6 +3289,8 @@ func autoConvert_kops_KubeAPIServerConfig_To_v1alpha2_KubeAPIServerConfig(in *ko out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.TokenAuthFile = in.TokenAuthFile out.AllowPrivileged = in.AllowPrivileged out.APIServerCount = in.APIServerCount @@ -3382,6 +3386,8 @@ func autoConvert_v1alpha2_KubeControllerManagerConfig_To_kops_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3426,6 +3432,8 @@ func autoConvert_kops_KubeControllerManagerConfig_To_v1alpha2_KubeControllerMana out.HorizontalPodAutoscalerUseRestClients = in.HorizontalPodAutoscalerUseRestClients out.ExperimentalClusterSigningDuration = in.ExperimentalClusterSigningDuration out.FeatureGates = in.FeatureGates + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion return nil } @@ -3582,6 +3590,8 @@ func autoConvert_v1alpha2_KubeletConfigSpec_To_kops_KubeletConfigSpec(in *Kubele out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel @@ -3661,6 +3671,8 @@ func autoConvert_kops_KubeletConfigSpec_To_v1alpha2_KubeletConfigSpec(in *kops.K out.ClientCAFile = in.ClientCAFile out.TLSCertFile = in.TLSCertFile out.TLSPrivateKeyFile = in.TLSPrivateKeyFile + out.TLSCipherSuites = in.TLSCipherSuites + out.TLSMinVersion = in.TLSMinVersion out.KubeconfigPath = in.KubeconfigPath out.RequireKubeconfig = in.RequireKubeconfig out.LogLevel = in.LogLevel diff --git a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go index 1812585319..fb1988d45e 100644 --- a/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go +++ b/pkg/apis/kops/v1alpha2/zz_generated.deepcopy.go @@ -1678,6 +1678,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged *out = new(bool) @@ -2000,6 +2005,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } return } @@ -2153,6 +2163,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.RequireKubeconfig != nil { in, out := &in.RequireKubeconfig, &out.RequireKubeconfig *out = new(bool) diff --git a/pkg/apis/kops/zz_generated.deepcopy.go b/pkg/apis/kops/zz_generated.deepcopy.go index 9ebc9a0abc..ffe701d06e 100644 --- a/pkg/apis/kops/zz_generated.deepcopy.go +++ b/pkg/apis/kops/zz_generated.deepcopy.go @@ -1860,6 +1860,11 @@ func (in *KubeAPIServerConfig) DeepCopyInto(out *KubeAPIServerConfig) { *out = make([]string, len(*in)) copy(*out, *in) } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.AllowPrivileged != nil { in, out := &in.AllowPrivileged, &out.AllowPrivileged *out = new(bool) @@ -2182,6 +2187,11 @@ func (in *KubeControllerManagerConfig) DeepCopyInto(out *KubeControllerManagerCo (*out)[key] = val } } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } return } @@ -2335,6 +2345,11 @@ func (in *KubeletConfigSpec) DeepCopyInto(out *KubeletConfigSpec) { *out = new(bool) **out = **in } + if in.TLSCipherSuites != nil { + in, out := &in.TLSCipherSuites, &out.TLSCipherSuites + *out = make([]string, len(*in)) + copy(*out, *in) + } if in.RequireKubeconfig != nil { in, out := &in.RequireKubeconfig, &out.RequireKubeconfig *out = new(bool)