helm: Lower default hubble.tls.auto.certValidityDuration to 365 days #35630
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
gandro
approved these changes
Oct 30, 2024
qmonnet
approved these changes
Oct 30, 2024
|
It seems the spell-checker does not recognise “expirations” 🤦 |
Hubble CLI will fail to validate certificates with an expiration that's too large on recent MacOS versions with the following error: ``` rpc error: code = Unavailable desc = connection error: desc = "transport: authentication handshake failed: tls: failed to verify certificate: x509: “*.hubble-relay.cilium.io” certificate is not standards compliant" ``` This is due to https://support.apple.com/en-us/103769 which specifies: > All TLS server certificates must comply with these new security requirements in iOS 13 and macOS 10.15: > ... > Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines: > ... > TLS server certificates must have a validity period of 825 days or fewer (as expressed in the NotBefore and NotAfter fields of the certificate). Since we have many users using MacOS and are likely using the default values with Hubble when starting with TLS, we should adjust the default value to work with recent MacOS versions. Users who wish to preserve the existing expiration validity can set `hubble.tls.auto.certValidityDuration` to the previous default value. Signed-off-by: Chance Zibolski <chance.zibolski@gmail.com>
dfab7aa to
c29cfc7
Compare
|
/test |
|
I just realized too: we should probably backport to 1.16 at least? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hubble CLI will fail to validate certificates with an expiration that's too large on recent MacOS versions with the following error:
This is due to https://support.apple.com/en-us/103769 which specifies:
Since we have many users using MacOS and are likely using the default values with Hubble when starting with TLS, we should adjust the default value to work with recent MacOS versions. Users who wish to preserve the existing expiration validity can set
hubble.tls.auto.certValidityDurationto the previous default value.