From c15d4323bd0dc29261a183d920d983a7a85977fc Mon Sep 17 00:00:00 2001 From: Vlad Bologa Date: Wed, 25 Feb 2026 14:49:07 +0100 Subject: [PATCH] ROX-33255: Apply TLS settings to config-controller and central internal server --- central/internal/server.go | 6 ++++++ config-controller/main.go | 6 ++++++ 2 files changed, 12 insertions(+) diff --git a/central/internal/server.go b/central/internal/server.go index 2cfd375897313..6a39e8d772376 100644 --- a/central/internal/server.go +++ b/central/internal/server.go @@ -1,6 +1,7 @@ package internal import ( + "crypto/tls" "log" "net/http" @@ -8,6 +9,7 @@ import ( "github.com/stackrox/rox/pkg/env" "github.com/stackrox/rox/pkg/grpc/metrics" "github.com/stackrox/rox/pkg/mtls" + "github.com/stackrox/rox/pkg/tlsprofile" ) // HTTPServer is a HTTP server to serve functionality available only within the cluster. @@ -45,6 +47,10 @@ func (s *HTTPServer) RunForever() { httpServer := &http.Server{ Addr: s.Address, Handler: s.mux, + TLSConfig: &tls.Config{ + MinVersion: tlsprofile.MinVersion(), + CipherSuites: tlsprofile.CipherSuites(), + }, } go runForever(httpServer) } diff --git a/config-controller/main.go b/config-controller/main.go index 0b1861439417e..c5fb591c53ea3 100644 --- a/config-controller/main.go +++ b/config-controller/main.go @@ -27,6 +27,7 @@ import ( "github.com/stackrox/rox/config-controller/pkg/client" "github.com/stackrox/rox/pkg/env" "github.com/stackrox/rox/pkg/logging" + "github.com/stackrox/rox/pkg/tlsprofile" "k8s.io/apimachinery/pkg/runtime" utilruntime "k8s.io/apimachinery/pkg/util/runtime" clientgoscheme "k8s.io/client-go/kubernetes/scheme" @@ -91,6 +92,11 @@ func main() { c.NextProtos = []string{"http/1.1"} } + tlsOpts = append(tlsOpts, func(c *tls.Config) { + c.MinVersion = tlsprofile.MinVersion() + c.CipherSuites = tlsprofile.CipherSuites() + }) + if !enableHTTP2 { tlsOpts = append(tlsOpts, disableHTTP2) }