Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-48735

etcd required cipher suites when using TLS 1.2

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • 1
    • None
    • None
    • None
    • None
    • uShift Sprint 265
    • 1
    • Done
    • Bug Fix
    • Hide
      Previously, the specific cipher suites required by MicroShift etcd when using TLS 1.2 were not not included in the service's basic configuration file. As a result, MicroShift failed to start. With this release, the required cipher suites are in the configuration file by default and MicroShift can start normally when using TLS 1.2.
      Show
      Previously, the specific cipher suites required by MicroShift etcd when using TLS 1.2 were not not included in the service's basic configuration file. As a result, MicroShift failed to start. With this release, the required cipher suites are in the configuration file by default and MicroShift can start normally when using TLS 1.2.
    • None
    • None
    • None
    • None

      Description of problem:

      MicroShift's etcd requires configuring either of these 2 cipher suites when using TLS 1.2:

Jan 22 11:49:37 microshift-base-3603.local microshift[164996]: {"level":"warn","ts":"2025-01-22T11:49:37.201129Z","caller":"embed/serve.go:214","msg":"stopped secure grpc server due to error","error":"http2: TLSConfig.CipherSuites is missing an HTTP/2-required AES_128_GCM_SHA256 cipher (need at least one of TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 or TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)"}

If these are not present in the configuration file MicroShift will fail to start.

      Version-Release number of selected component (if applicable):

      4.19

      How reproducible:

      100%

      Steps to Reproduce:

          1. Configure custom cipher suites using tls 1.2, excluding the ones in the description.
    2. Start microshift.
    3. Check the error in etcd failing to start.

      Actual results:

      Expected results:

      Additional info:

              pacevedo@redhat.com Pablo Acevedo Montserrat
              pacevedo@redhat.com Pablo Acevedo Montserrat
              None
              None
              Alejandro Gullón Alejandro Gullón
              Shauna Diaz Shauna Diaz
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: