mirror of
https://github.com/k3s-io/kubernetes.git
synced 2026-07-18 04:54:54 +00:00
53b163298d
Introduce support for specifying allowed TLS key exchange mechanisms (IANA TLS Supported Groups) via a new --tls-curve-preferences flag, following the same pattern as --tls-cipher-suites. Curve preferences are specified as numeric IANA TLS Supported Group IDs (e.g. 23,29,4588) rather than string names. This avoids maintaining a hardcoded name-to-ID map that would become stale with each Go release, and ensures new curves (such as Go 1.26's SecP256r1MLKEM768 and SecP384r1MLKEM1024) work automatically when rebuilding with a newer Go version -- no code changes required. Changes: - Add curves_flag.go in component-base/cli/flag with a simple int-to-tls.CurveID cast function - Add CurvePreferences field ([]int32) to SecureServingOptions, registered via IntSliceVar, and wire it through to tls.Config The order of the list is ignored; Go selects from the set using an internal preference order. If omitted, Go defaults are used. The set of accepted values depends on the Go version used to build the binary; see https://pkg.go.dev/crypto/tls#CurveID for reference.