feat(epp): add --tls-min-version and --tls-cipher-suites flags (#2230)

Add CLI flags to configure TLS minimum version and cipher suites on
the ext_proc gRPC server. Values are parsed from Go crypto/tls constant
names (e.g., VersionTLS12, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) and
applied to both cert-reload and static-cert TLS config paths.

Signed-off-by: Andres Llausas <allausas@redhat.com>
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: andresllh

cmd/epp/runner/runner.go

@@ -461,6 +461,8 @@ func (r *Runner) setup(ctx context.Context, cfg *rest.Config, opts *runserver.Op
 		HealthChecking:                   opts.HealthChecking,
 		CertPath:                         opts.CertPath,
 		EnableCertReload:                 opts.EnableCertReload,
+		TLSMinVersion:                    opts.TLSMinVersionValue(),
+		TLSCipherSuites:                  opts.TLSCipherSuiteValues(),
 		RefreshPrometheusMetricsInterval: opts.RefreshPrometheusMetricsInterval,
 		MetricsStalenessThreshold:        opts.MetricsStalenessThreshold,
 		Director:                         director,
@@ -983,6 +985,8 @@ func (r *Runner) runWithFileDiscovery(ctx context.Context, opts *runserver.Optio
 		HealthChecking:                   opts.HealthChecking,
 		CertPath:                         opts.CertPath,
 		EnableCertReload:                 opts.EnableCertReload,
+		TLSMinVersion:                    opts.TLSMinVersionValue(),
+		TLSCipherSuites:                  opts.TLSCipherSuiteValues(),
 		RefreshPrometheusMetricsInterval: opts.RefreshPrometheusMetricsInterval,
 		MetricsStalenessThreshold:        opts.MetricsStalenessThreshold,
 		Director:                         director,

pkg/epp/server/options.go

@@ -97,19 +97,23 @@ type Options struct {
 	//
 	// Diagnostics.
 	//
-	logging.LoggingOptions         // Logging configuration.
-	Tracing                 bool   // Enables emitting traces.
-	HealthChecking          bool   // Enables health checking.
-	MetricsPort             int    // The metrics port exposed by EPP. (TODO: uint16)
-	GRPCHealthPort          int    // The port used for gRPC liveness and readiness probes. (TODO: uint16)
-	EnablePprof             bool   // Enables pprof handlers.
-	CertPath                string // The path to the certificate for secure serving.
-	EnableCertReload        bool   // Enables certificate reloading of the certificates specified in --cert-path.
-	SecureServing           bool   // Enables secure serving.
-	MetricsEndpointAuth     bool   // Enables authentication and authorization of the metrics endpoint.
-	MetricsClientCAFile     string // PEM CA that requires a verified client cert on the metrics endpoint.
-	MetricsCertDir          string // Directory with the metrics server certificates that enables metrics TLS.
-	EnableGRPCStreamMetrics bool   // Enables ext_proc gRPC stream metrics (in-flight gauge, hold duration, completions counter by code).
+	logging.LoggingOptions           // Logging configuration.
+	Tracing                 bool     // Enables emitting traces.
+	HealthChecking          bool     // Enables health checking.
+	MetricsPort             int      // The metrics port exposed by EPP. (TODO: uint16)
+	GRPCHealthPort          int      // The port used for gRPC liveness and readiness probes. (TODO: uint16)
+	EnablePprof             bool     // Enables pprof handlers.
+	CertPath                string   // The path to the certificate for secure serving.
+	EnableCertReload        bool     // Enables certificate reloading of the certificates specified in --cert-path.
+	SecureServing           bool     // Enables secure serving.
+	TLSMinVersion           string   // Minimum TLS version for secure serving (e.g., VersionTLS12, VersionTLS13).
+	TLSCipherSuites         []string // TLS cipher suites (Go crypto/tls names). Only effective for TLS 1.2 and below.
+	tlsMinVersionValue      uint16   // Parsed TLS min version value.
+	tlsCipherSuiteValues    []uint16 // Parsed TLS cipher suite values.
+	MetricsEndpointAuth     bool     // Enables authentication and authorization of the metrics endpoint.
+	MetricsClientCAFile     string   // PEM CA that requires a verified client cert on the metrics endpoint.
+	MetricsCertDir          string   // Directory with the metrics server certificates that enables metrics TLS.
+	EnableGRPCStreamMetrics bool     // Enables ext_proc gRPC stream metrics (in-flight gauge, hold duration, completions counter by code).
 	//
 	// Configuration.
 	//
@@ -213,6 +217,10 @@ func (opts *Options) AddFlags(fs *pflag.FlagSet) {
 	fs.BoolVar(&opts.EnableGRPCStreamMetrics, "enable-grpc-stream-metrics", opts.EnableGRPCStreamMetrics,
 		"Enables ext_proc gRPC stream metrics (in-flight gauge, hold-duration histogram, completions counter by code).")
 	fs.BoolVar(&opts.SecureServing, "secure-serving", opts.SecureServing, "Enables secure serving.")
+	fs.StringVar(&opts.TLSMinVersion, "tls-min-version", opts.TLSMinVersion,
+		"Minimum TLS version for secure serving (e.g., VersionTLS12, VersionTLS13).")
+	fs.StringSliceVar(&opts.TLSCipherSuites, "tls-cipher-suites", opts.TLSCipherSuites,
+		"Comma-separated list of TLS cipher suites for secure serving (Go crypto/tls names, e.g., TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256). Only effective for TLS 1.2 and below; TLS 1.3 cipher suites are not configurable.")
 	fs.BoolVar(&opts.MetricsEndpointAuth, "metrics-endpoint-auth", opts.MetricsEndpointAuth,
 		"Enables authentication and authorization of the metrics endpoint.")
 	fs.StringVar(&opts.MetricsClientCAFile, "metrics-client-ca-file", opts.MetricsClientCAFile,
@@ -285,6 +293,21 @@ func (opts *Options) Complete() error {
 		}
 	}
 
+	if opts.TLSMinVersion != "" {
+		v, err := parseTLSVersion(opts.TLSMinVersion)
+		if err != nil {
+			return fmt.Errorf("invalid tls-min-version %q: %w", opts.TLSMinVersion, err)
+		}
+		opts.tlsMinVersionValue = v
+	}
+	if len(opts.TLSCipherSuites) > 0 {
+		suites, err := parseCipherSuites(opts.TLSCipherSuites)
+		if err != nil {
+			return fmt.Errorf("invalid tls-cipher-suites: %w", err)
+		}
+		opts.tlsCipherSuiteValues = suites
+	}
+
 	// Complete logging options.
 	return opts.LoggingOptions.Complete()
 }
@@ -391,3 +414,50 @@ func removeDuplicatePorts(ports []int) []int {
 	}
 	return unique
 }
+
+// TLSMinVersionValue returns the parsed uint16 TLS min version.
+func (opts *Options) TLSMinVersionValue() uint16 {
+	return opts.tlsMinVersionValue
+}
+
+// TLSCipherSuiteValues returns the parsed uint16 TLS cipher suite IDs.
+func (opts *Options) TLSCipherSuiteValues() []uint16 {
+	return opts.tlsCipherSuiteValues
+}
+
+var tlsVersions = map[string]uint16{
+	"VersionTLS10": tls.VersionTLS10,
+	"VersionTLS11": tls.VersionTLS11,
+	"VersionTLS12": tls.VersionTLS12,
+	"VersionTLS13": tls.VersionTLS13,
+}
+
+func parseTLSVersion(s string) (uint16, error) {
+	if v, ok := tlsVersions[s]; ok {
+		return v, nil
+	}
+	return 0, fmt.Errorf("unknown TLS version %q; supported values: VersionTLS10, VersionTLS11, VersionTLS12, VersionTLS13", s)
+}
+
+func parseCipherSuites(names []string) ([]uint16, error) {
+	byName := make(map[string]uint16)
+	for _, cs := range tls.CipherSuites() {
+		byName[cs.Name] = cs.ID
+	}
+	for _, cs := range tls.InsecureCipherSuites() {
+		byName[cs.Name] = cs.ID
+	}
+	ids := make([]uint16, 0, len(names))
+	for _, name := range names {
+		name = strings.TrimSpace(name)
+		if name == "" {
+			continue
+		}
+		id, ok := byName[name]
+		if !ok {
+			return nil, fmt.Errorf("unknown cipher suite %q", name)
+		}
+		ids = append(ids, id)
+	}
+	return ids, nil
+}

pkg/epp/server/options_test.go

@@ -17,6 +17,7 @@ limitations under the License.
 package server
 
 import (
+	"crypto/tls"
 	"os"
 	"path/filepath"
 	"strings"
@@ -364,3 +365,129 @@ func TestCompleteMetricsCertFiles(t *testing.T) {
 	present.MetricsCertDir = dir
 	require.NoError(t, present.Complete())
 }
+
+func TestTLSMinVersionFlag(t *testing.T) {
+	tests := []struct {
+		name        string
+		args        []string
+		wantVersion uint16
+		wantErr     bool
+	}{
+		{
+			name:        "VersionTLS12",
+			args:        []string{"--tls-min-version", "VersionTLS12"},
+			wantVersion: tls.VersionTLS12,
+		},
+		{
+			name:        "VersionTLS13",
+			args:        []string{"--tls-min-version", "VersionTLS13"},
+			wantVersion: tls.VersionTLS13,
+		},
+		{
+			name:        "not set",
+			args:        []string{},
+			wantVersion: 0,
+		},
+		{
+			name:    "invalid version",
+			args:    []string{"--tls-min-version", "TLS1.2"},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs := pflag.NewFlagSet(tt.name, pflag.ContinueOnError)
+			opts := NewOptions()
+			opts.AddFlags(fs)
+
+			argv := append([]string{"--pool-name", testPoolName, "--config-file", testConfigFile}, tt.args...)
+			require.NoError(t, fs.Parse(argv))
+
+			err := opts.Complete()
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tt.wantVersion, opts.TLSMinVersionValue())
+		})
+	}
+}
+
+func TestTLSCipherSuitesFlag(t *testing.T) {
+	tests := []struct {
+		name       string
+		args       []string
+		wantSuites []uint16
+		wantErr    bool
+	}{
+		{
+			name: "single cipher",
+			args: []string{"--tls-cipher-suites", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"},
+			wantSuites: []uint16{
+				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+			},
+		},
+		{
+			name: "multiple ciphers",
+			args: []string{"--tls-cipher-suites", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"},
+			wantSuites: []uint16{
+				tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+				tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
+			},
+		},
+		{
+			name:       "not set",
+			args:       []string{},
+			wantSuites: nil,
+		},
+		{
+			name:    "unknown cipher",
+			args:    []string{"--tls-cipher-suites", "FAKE_CIPHER_SUITE"},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			fs := pflag.NewFlagSet(tt.name, pflag.ContinueOnError)
+			opts := NewOptions()
+			opts.AddFlags(fs)
+
+			argv := append([]string{"--pool-name", testPoolName, "--config-file", testConfigFile}, tt.args...)
+			require.NoError(t, fs.Parse(argv))
+
+			err := opts.Complete()
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+			require.NoError(t, err)
+			require.Equal(t, tt.wantSuites, opts.TLSCipherSuiteValues())
+		})
+	}
+}
+
+func TestParseTLSVersion(t *testing.T) {
+	for name, want := range tlsVersions {
+		got, err := parseTLSVersion(name)
+		require.NoError(t, err, name)
+		require.Equal(t, want, got, name)
+	}
+	_, err := parseTLSVersion("invalid")
+	require.Error(t, err)
+}
+
+func TestParseCipherSuites(t *testing.T) {
+	ids, err := parseCipherSuites([]string{
+		"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
+		"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
+	})
+	require.NoError(t, err)
+	require.Equal(t, []uint16{
+		tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
+		tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
+	}, ids)
+
+	_, err = parseCipherSuites([]string{"BOGUS"})
+	require.Error(t, err)
+}

pkg/epp/server/runserver.go

@@ -63,6 +63,8 @@ type ExtProcServerRunner struct {
 	HealthChecking                   bool
 	CertPath                         string
 	EnableCertReload                 bool
+	TLSMinVersion                    uint16
+	TLSCipherSuites                  []uint16
 	RefreshPrometheusMetricsInterval time.Duration
 	MetricsStalenessThreshold        time.Duration
 	Director                         *requestcontrol.Director
@@ -183,17 +185,21 @@ func (r *ExtProcServerRunner) AsRunnable(logger logr.Logger) manager.Runnable {
 				if err != nil {
 					return fmt.Errorf("failed to create cert reloader: %w", err)
 				}
-				creds = credentials.NewTLS(&tls.Config{
+				tlsCfg := &tls.Config{
 					GetCertificate: func(_ *tls.ClientHelloInfo) (*tls.Certificate, error) {
 						return reloader.Get(), nil
 					},
 					NextProtos: []string{"h2"},
-				})
+				}
+				r.applyTLSOverrides(tlsCfg)
+				creds = credentials.NewTLS(tlsCfg)
 			} else {
-				creds = credentials.NewTLS(&tls.Config{
+				tlsCfg := &tls.Config{
 					Certificates: []tls.Certificate{cert},
 					NextProtos:   []string{"h2"},
-				})
+				}
+				r.applyTLSOverrides(tlsCfg)
+				creds = credentials.NewTLS(tlsCfg)
 			}
 		}
 
@@ -239,3 +245,13 @@ func (r *ExtProcServerRunner) AsRunnable(logger logr.Logger) manager.Runnable {
 		return runnable.GRPCServer("ext-proc", srv, r.GrpcPort).Start(ctx)
 	}))
 }
+
+// applyTLSOverrides sets MinVersion and CipherSuites on cfg when configured.
+func (r *ExtProcServerRunner) applyTLSOverrides(cfg *tls.Config) {
+	if r.TLSMinVersion != 0 {
+		cfg.MinVersion = r.TLSMinVersion
+	}
+	if len(r.TLSCipherSuites) > 0 {
+		cfg.CipherSuites = r.TLSCipherSuites
+	}
+}