Ambassador: Allow TLS cipher configuration

[peterthomassen]

Please describe your use case / problem.
Currently, TLS ciphers used by Ambassador cannot be configured. Even with the envoy_override directive, it looks like only routing configuration can be override, while TLS ciphers belong to Envoy's listener configuration.

Describe the solution you'd like
Configuration alongside the TLS certificate configuration

Describe alternatives you've considered
Another Envoy override

Additional context
While the currently used cipher suite still gives a green rating with the Qualys SSL Labs test, some of the ciphers are marked weak already. Furthermore, it is always possible that a cipher may be broken so that the cipher suite needs to be reconfigured quickly.

[mehstg]

it'd also be nice to be able to set TlsParameters as part of this too. For example, to disable TLS1.0.

[peterthomassen]

The initial report suggests envoy_override-like mechanism to achieve TLS cipher configurability. The overrides have been removed with Ambassador 0.50.0, so I'm retracting this proposal. It looks like a solution would require a new approach.

[mehstg]

The initial request states that it does not work with envoy_override, so my understanding is that it wasn't a proposal, but a request.

The ability to remove weak cipher suites and older protocols is something we really need

[richarddli]

We'd be happy to take a PR on this. If anyone wants to help, please join the #ambassador-dev channel on Slack. I think the work would proceed in several parts:

1. Determining what syntax would make sense to expose to Ambassador users.
2. Figuring out the appropriate Envoy configuration parameters, and mapping the Ambassador syntax to Envoy.
3. Actually updating the Ambassador code generation to do the right thing.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[peterthomassen]

The situation has improved a bit (TLS version can be specified since version 0.61.0, also providing an indirect lever for set of cipher suites), but cipher suites themselves are still not configurable. I continue to think this is an important issue.

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[MaxWinterstein]

Still important IMHO.

[cypherfox]

This is important especially if regulatory requirements force you to use or not use certain cipher suites, regardless of what the SSL lib dev consider best practices.

[richarddli]

@cypherfox @MaxWinterstein @peterthomassen we'd welcome a PR!

[psalaberria002]

This is already available in 0.78 right?

[kflynn]

Yes it is! Thanks for the catch. 🙂