Bug 2139234
| Summary: | virt pods not in Ready state after setting tlsSecurityProfile `Modern` in HCO | ||
|---|---|---|---|
| Product: | Container Native Virtualization (CNV) | Reporter: | Denys Shchedrivyi <dshchedr> |
| Component: | Virtualization | Assignee: | sgott |
| Status: | NEW --- | QA Contact: | Kedar Bidarkar <kbidarka> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 4.12.0 | ||
| Target Milestone: | --- | ||
| Target Release: | 4.15.0 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | Bug | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
Denys Shchedrivyi
2022-11-01 22:30:29 UTC
Denys, Can you clarify which ciphers are mandated by the "modern" profile? Is that the entire log message? It sounds like the problem might be that we simply don't have any ciphers available. I think this bug may be related to bz 2139222, for some reason on FIPS enabled cluster only TLS v1.2 works. All other versions are blocked. Here the output for FIPS Enabled cluster with default TLS configuration (Intermediate profile) $ oc get kubevirt kubevirt-kubevirt-hyperconverged -n openshift-cnv -o json | jq .spec.configuration.tlsConfiguration { "ciphers": [ "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256", "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" ], "minTLSVersion": "VersionTLS12" } $ nmap --script ssl-enum-ciphers -p 1443 127.0.0.1 > PORT STATE SERVICE > 1443/tcp open ies-lm > | ssl-enum-ciphers: > | TLSv1.2: > | ciphers: > | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A > | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A > | compressors: > | NULL > | cipher preference: server > |_ least strength: A And here FIPS Disabled cluster with the default TLS profile: > $ nmap --script ssl-enum-ciphers -p 1443 127.0.0.1 > PORT STATE SERVICE > 1443/tcp open ies-lm > | ssl-enum-ciphers: > | TLSv1.2: > | ciphers: > | TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A > | TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A > | TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A > | compressors: > | NULL > | cipher preference: client > | TLSv1.3: > | ciphers: > | TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A > | TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A > | TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A > | cipher preference: server > |_ least strength: A You can see the difference - cluster with FIPS mode enabled allows TLSv1.2 only, so when I set Modern profile (or minTLSVersion 1.3) - virt pods shows tls handshake errors Moving this bug to 4.14 based on priority and capacity. Moving this bug to 4.15 based on priority and capacity. |