Application-gateway-kubernetes-ingress: Allow to configure a predefined sslPolicy

[jmapro]

Is your feature request related to a problem? Please describe.
I need to disallow TLSv1_0 and TLSv1_1 by using the predefined policy AppGwSslPolicy20170401S. But each time I push this configuration on the application gateway, it's overwrited by the Ingress Controller.

Describe the solution you'd like
Ssl policy is global to the application gateway, so having an annotation like appgw.ingress.kubernetes.io/ssl-policy: "AppGwSSlPolicy20170401S" would be great.

[akshaysngupta]

@jmapro AGIC should not overwrite SSL policy. I tried on my test setup and the policy is retained on updates. Can you check if there is no other component/CI/CD reverting the gateway ?

[jmapro]

Hello @akshaysngupta , Thanks for your answer. I've done more tests and my issue seems coming from Terraform and not AGIC.

But having a solution to configure such parameter from Kubernetes would be great :)

[joelharkes]

I'm using only AGIC but also my SSL Policy i setup is gone, (how) is that possible?

don't use anything else than basic AGIC setup + Cert manager.

[joelharkes]

I tried disabling tls1.1 and 1.2:

$gw = Get-AzApplicationGateway -Name ag-name -ResourceGroup rg-name
Get-AzApplicationGatewaySslPolicy -ApplicationGateway $gw
# response from get
Set-AzApplicationGatewaySslPolicy -ApplicationGateway $gw -PolicyType Predefined -PolicyName AppGwSslPolicy20170401S  -MinProtocolVersion TLSv1_2 -DisabledSslProtocols TLSv1_0,TLSv1_1
Get-AzApplicationGatewaySslPolicy -ApplicationGateway $gw

response:

DisabledSslProtocols     : {TLSv1_0, TLSv1_1}
PolicyType               : Predefined
PolicyName               : AppGwSslPolicy20170401S
CipherSuites             : 
MinProtocolVersion       : TLSv1_2
DisabledSslProtocolsText : [
                             "TLSv1_0",
                             "TLSv1_1"
                           ]
CipherSuitesText         : null

and a day later:

$gw = Get-AzApplicationGateway -Name ag-name -ResourceGroup rg-name
Get-AzApplicationGatewaySslPolicy -ApplicationGateway $gw
#setting is gone

ssl Policy seems gone.

DisabledSslProtocols is absolutely a must for security perspective

[martwana]

I'm also seeing this behaviour. Why is this not supported out the box?

We've just had a bunch of TLSv1.0 warnings in our Pen Test, but because AGIC provisions and manages the load balancer, we cannot control this value.

Can I get an ETA on this feature being available?

[martwana]

@akshaysngupta

[joelharkes]

Actually my comment was wrong, i do think i was able to fix it with the script i just had an issue in the script

[akshaysngupta]

AGIC doesn't modify the SSL policy attached to the gateway. As @joelharkes mentioned, please check if you have script that is modify the policy.