Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Remove AppChannelAllowInsecureTls flag #7292

Merged
merged 7 commits into from
Dec 20, 2023
Merged

Remove AppChannelAllowInsecureTls flag #7292

Show file tree
Hide file tree
Changes from 5 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
c979ba9
Remove AppChannelAllowInsecureTls flag
DeepanshuA Dec 12, 2023
00aacda
Merge branch 'master' into allowInsecureTlsRemoval
mukundansundar Dec 13, 2023
310e955
Merge branch 'master' into allowInsecureTlsRemoval
dapr-bot Dec 13, 2023
fbdf3c0
Merge branch 'master' into allowInsecureTlsRemoval
dapr-bot Dec 16, 2023
06d2046
Merge branch 'master' into allowInsecureTlsRemoval
ItalyPaleAle Dec 19, 2023
ee9d4af
Update pkg/config/configuration.go
ItalyPaleAle Dec 19, 2023
8657a19
Merge branch 'master' into allowInsecureTlsRemoval
dapr-bot Dec 20, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 0 additions & 4 deletions pkg/config/configuration.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,10 +41,6 @@ import (
type Feature string

const (
// Disables enforcing minimum TLS version 1.2 in AppChannel, which is insecure.
// TODO: Remove this feature flag in Dapr 1.13.
AppChannelAllowInsecureTLS Feature = "AppChannelAllowInsecureTLS"
// Enables support for setting TTL on Actor state keys.
ActorStateTTL Feature = "ActorStateTTL"
ItalyPaleAle marked this conversation as resolved.
Show resolved Hide resolved
)

Expand Down
9 changes: 3 additions & 6 deletions pkg/grpc/manager/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,6 @@ type AppChannelConfig struct {
EnableTLS bool
MaxRequestBodySizeMB int
ReadBufferSizeKB int
AllowInsecureTLS bool
BaseAddress string
}

Expand Down Expand Up @@ -128,14 +127,14 @@ func (g *Manager) SetAppClientConn(conn grpc.ClientConnInterface) {
}

func (g *Manager) defaultLocalConnCreateFn() (grpc.ClientConnInterface, error) {
conn, err := g.createLocalConnection(context.Background(), g.channelConfig.Port, g.channelConfig.EnableTLS, g.channelConfig.AllowInsecureTLS)
conn, err := g.createLocalConnection(context.Background(), g.channelConfig.Port, g.channelConfig.EnableTLS)
if err != nil {
return nil, fmt.Errorf("error establishing a grpc connection to app on port %v: %w", g.channelConfig.Port, err)
}
return conn, nil
}

func (g *Manager) createLocalConnection(parentCtx context.Context, port int, enableTLS bool, allowInsecureTLS bool) (conn *grpc.ClientConn, err error) {
func (g *Manager) createLocalConnection(parentCtx context.Context, port int, enableTLS bool) (conn *grpc.ClientConn, err error) {
opts := make([]grpc.DialOption, 0, 2)

if diag.DefaultGRPCMonitoring.IsEnabled() {
Expand All @@ -147,9 +146,7 @@ func (g *Manager) createLocalConnection(parentCtx context.Context, port int, ena
if enableTLS {
//nolint:gosec
tlsConfig := &tls.Config{InsecureSkipVerify: true}
if !allowInsecureTLS {
tlsConfig.MinVersion = channel.AppChannelMinTLSVersion
}
tlsConfig.MinVersion = channel.AppChannelMinTLSVersion
opts = append(opts, grpc.WithTransportCredentials(credentials.NewTLS(tlsConfig)))
} else {
opts = append(opts, grpc.WithTransportCredentials(insecure.NewCredentials()))
Expand Down
7 changes: 1 addition & 6 deletions pkg/runtime/channels/channels.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,12 +369,7 @@ func appHTTPClient(connConfig config.AppConnectionConfig, globalConfig *config.C
if connConfig.Protocol == protocol.HTTPSProtocol {
tlsConfig = &tls.Config{
InsecureSkipVerify: true, //nolint:gosec
// For 1.11
MinVersion: channel.AppChannelMinTLSVersion,
}
// TODO: Remove when the feature is finalized
if globalConfig.IsFeatureEnabled(config.AppChannelAllowInsecureTLS) {
tlsConfig.MinVersion = 0
MinVersion: channel.AppChannelMinTLSVersion,
}
}

Expand Down
1 change: 0 additions & 1 deletion pkg/runtime/runtime.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1160,7 +1160,6 @@ func createGRPCManager(sec security.Handler, runtimeConfig *internalConfig, glob
grpcAppChannelConfig := &manager.AppChannelConfig{}
if globalConfig != nil {
grpcAppChannelConfig.TracingSpec = globalConfig.GetTracingSpec()
grpcAppChannelConfig.AllowInsecureTLS = globalConfig.IsFeatureEnabled(config.AppChannelAllowInsecureTLS)
}
if runtimeConfig != nil {
grpcAppChannelConfig.Port = runtimeConfig.appConnectionConfig.Port
Expand Down