How to Enforce Minimum TLS Version for Webhooks?

[sshiba]

I have a mandate to enforce minimum TLS version to 1.2 and looking into how I can achieve this with KubeBuilder.
I appreciate your help.

[sshiba]

Nevermind, I got the answer from #kubebuilder Slack community.

[camilamacedo86]

Can you please post the answer here and close this one?
So that you can help others?

[camilamacedo86]

Hi @sshiba

I think what you are looking in what we scaffold by default in the main.go. Example:

kubebuilder/testdata/project-v3/main.go

Lines 73 to 87 in 2b25ade

	// if the enable-http2 flag is false (the default), http/2 should be disabled
	// due to its vulnerabilities. More specifically, disabling http/2 will
	// prevent from being vulnerable to the HTTP/2 Stream Cancellation and
	// Rapid Reset CVEs. For more information see:
	// - https://github.com/advisories/GHSA-qppj-fm5r-hxr3
	// - https://github.com/advisories/GHSA-4374-p667-p6c8
	disableHTTP2 := func(c *tls.Config) {
	setupLog.Info("disabling http/2")
	c.NextProtos = []string{"http/1.1"}
	}
	tlsOpts := []func(*tls.Config){}
	if !enableHTTP2 {
	tlsOpts = append(tlsOpts, disableHTTP2)
	}

I hope that answer your question and help you out.
Due it be open for a while without interaction and the answer above might sort out this one, I am closing it and I hope that you do not mind. However, please feel free to re-open if you see that fits.