Add support for configurable SSL curves in HAProxy configuration

[richardsonnick]

To support new PQC key exchanges add option to set default ssl curves.

Adds a new environment variable ROUTER_CURVES.

This is a colon delimited set of curves to use for ECDHE.
Uses HAProxy's ssl-default-bind-curves to configure openssl's supported groups (https://docs.haproxy.org/3.1/configuration.html#ssl-default-bind-curves).

Tested via local cluster:

haproxy/conf should reflect curves in $ROUTER_POD

With default (no ROUTER_CURVES set)

nr@redd:~/forks/router$ oc exec -n router-test $ROUTER_POD -- grep "ssl-default-bind-curves" /var/lib/haproxy/conf/haproxy.config
  ssl-default-bind-curves X25519:P-256:P-384:P-521

Test with ROUTER_CURVES == X25519MLKEM768

nr@redd: oc set env deployment/custom-router-test -n router-test ROUTER_CURVES='X25519MLKEM768'
nr@redd: ~/forks/router$ oc exec -n router-test $ROUTER_POD -- grep "ssl-default-bind-curves" /var/lib/haproxy/conf/haproxy.config
  ssl-default-bind-curves X25519MLKEM768

Test with ROUTER_CURVES == X25519MLKEM768:P-256

nr@redd:~/forks/router$ oc set env deployment/custom-router-test -n router-test ROUTER_CURVES='X25519MLKEM768:P-256'
nr@redd:~/forks/router$ oc exec -n router-test $ROUTER_POD -- grep "ssl-default-bind-curves" /var/lib/haproxy/conf/haproxy.config
  ssl-default-bind-curves X25519MLKEM768:P-256

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign rfredette for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[richardsonnick]

/test all

[richardsonnick]

/test all

[richardsonnick]

/retest-required

[richardsonnick]

/retest-required

[openshift-ci]

@richardsonnick: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-metal-ipi-ovn-dualstack	f033f21	link	false	/test e2e-metal-ipi-ovn-dualstack
ci/prow/e2e-aws-serial	f033f21	link	true	/test e2e-aws-serial
ci/prow/okd-scos-e2e-aws-ovn	f033f21	link	false	/test okd-scos-e2e-aws-ovn
ci/prow/e2e-metal-ipi-ovn-router	f033f21	link	false	/test e2e-metal-ipi-ovn-router

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[Miciah]

/assign

[candita]

/assign @rfredette @davidesalerno

[candita]

@richardsonnick can you please add a jira or RFE number to this PR?

[zetamorph]

@richardsonnick can you please add a jira or RFE number to this PR?

Hi, I'm not the PR creator, but this PR is also relevant for RFE-5389.