Setting TLS 1.3 only ciphers causes API server to fail on startup #11706#11812
Open
KameHameHa21110 wants to merge 4 commits intoprojectcalico:masterfrom
Open
Setting TLS 1.3 only ciphers causes API server to fail on startup #11706#11812KameHameHa21110 wants to merge 4 commits intoprojectcalico:masterfrom
KameHameHa21110 wants to merge 4 commits intoprojectcalico:masterfrom
Conversation
…p failure This change introduces a TLS_MIN_VERSION environment variable that allows users to configure the minimum TLS version for the API server and other components. This resolves the issue where setting TLS 1.3-only ciphers would cause startup failures due to Go's HTTP/2 cipher validation. Changes: - Add ParseTLSVersion() function to crypto/pkg/tls package - Update NewTLSConfig() to use TLS_MIN_VERSION environment variable - Update API server to parse and apply TLS_MIN_VERSION - Add comprehensive tests for TLS version parsing - Add TLS_CONFIGURATION.md documentation Supported values for TLS_MIN_VERSION: - "" or "1.2" (default): TLS 1.2 minimum - "1.3": TLS 1.3 minimum (allows TLS 1.3-only cipher configurations) Fixes projectcalico#11706
marvin-tigera
added
release-note-required
…bles - Add ASCII diagram showing TLS version and cipher relationships - Add configuration validation matrix with visual indicators - Add cipher compatibility diagram for quick reference - Consolidate sections for better readability - Reduce from 237 to 159 lines while keeping all essential info - Add quick reference table at the top - Improve troubleshooting section with clear comparison table
caseydavenport
requested changes
Feb 10, 2026
- Refactor NewTLSConfig to use local variable for minVersion - Remove duplicate test from apiserver (already tested in crypto package) - Remove TLS_CONFIGURATION.md documentation file Changes per reviewer feedback from caseydavenport
caseydavenport
approved these changes
Feb 10, 2026
Member
|
/sem-approve |
Align struct fields consistently to pass CI formatting checks
Author
|
Fixed struct field alignment issue that was causing the CI check to fail. |
Member
|
/sem-approve |
Author
|
The CI failures appear to be infrastructure issues (missing Docker image 'calico/go-build:1.25.7-llvm18.1.8-k8s1.34.3') unrelated to the TLS configuration changes. Can these tests be restarted or would you like me to rebase? 
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a bug where the Calico API server fails to start when only TLS 1.3 cipher suites are configured via the Installation resource.
Type of fix: Bug fix
Why this should be merged:
Components affected:
crypto/pkg/tls: AddedParseTLSVersion()function and updatedNewTLSConfig()apiserver/cmd/apiserver/server: Updated to useTLS_MIN_VERSIONenvironment variableTesting performed:
ParseTLSVersion()covering valid versions (1.2, 1.3), invalid versions, and default behaviorcrypto/pkg/tlsandapiserver/cmd/apiserver/server)How it works:
The API server now reads the
TLS_MIN_VERSIONenvironment variable (values: "1.2" or "1.3"). When set to "1.3" with TLS 1.3-only ciphers, Go's HTTP/2 stack skips TLS 1.2 cipher validation, allowing the server to start successfully. Defaults to TLS 1.2 when not set (backward compatible).Documentation:
Added comprehensive documentation at
apiserver/TLS_CONFIGURATION.mdwith diagrams, tables, and usage scenarios.Related issues/PRs
fixes #11706
Todos
Release Note