Envoyproxy fails if tlsMaxProtocolVersion is set to TLSv1_2

[piizei]

Bug description:

Envoyproxy fails if tlsMaxProtocolVersion is set to TLSv1_2.

Affected area (please mark with X where applicable):

• Install [ ]
• SMI Traffic Access Policy [ ]
• SMI Traffic Specs Policy [ ]
• SMI Traffic Split Policy [ ]
• Permissive Traffic Policy [ ]
• Ingress [ ]
• Egress [ ]
• Envoy Control Plane [ X]
• CLI Tool [ ]
• Metrics [ ]
• Certificate Management [ ]
• Sidecar Injection [ ]
• Logging [ ]
• Debugging [ ]
• Tests [ ]
• Demo [X ]
• CI System [ ]

Expected behavior:

It should work normally

Steps to reproduce the bug (as precisely as possible):

Install test application (bookstore).
kubectl patch meshconfig osm-mesh-config -n kube-system -p '{"spec":{"sidecar":{"tlsMaxProtocolVersion":"TLSv1_2"}}}' --ty
pe=merge

The pods start failing with 503 trying to connect to each other.

How was OSM installed?:

AKS add-on

Anything else we need to know?:

Bug report archive:

Environment:

• OSM version (use osm version): v1.2.3
• Kubernetes version (use kubectl version): 1.24.7
• Size of cluster (number of worker nodes in the cluster): 3 user + 3 system
• Others: Fresh aks install.

[keithmattix]

Are your HTTP clients configured with appropriate MaxTLS settings? The intersection of the client and server TLS version lists has to be at least one to prevent 503s

[piizei]

It's a service mesh, so the client would be also the same envoy?
So you are saying the envoy must be configured with tls_minimum_protocol_version of 1.1 to work?
Does not seem make a lot of sense if you want to use 1.2?

[keithmattix]

I didn't know if it was ingress or not, so I wanted to eliminate that simple case first.

So you are saying the envoy must be configured with tls_minimum_protocol_version of 1.1 to work?

No, what I'm saying is that, in general, the tls supported versions (generated by minTLS version and maxTLS version) have to have at least one element in common. If minTLS version is 1.2 and maxTLS version is 1.2, then that should work.

For your specific situation, I'd need logs, config dumps, and manifests to know more. Let's continue via Azure support for security purposes

[piizei]

Thanks for clarifying, this is really just fresh installation of the example app with the modification of TLS max version.
Sidecar:
Config Resync Interval: 0s
Enable Privileged Init Container: false
Local Proxy Mode: Localhost
Log Level: error
Resources:
Tls Max Protocol Version: TLSv1_2
Tls Min Protocol Version: TLSv1_2
Traffic:
Enable Egress: true
Enable Permissive Traffic Policy Mode: true
Inbound External Authorization:
Enable: false
Failure Mode Allow: false
Stat Prefix: inboundExtAuthz
Timeout: 1s

[github-actions]

This issue will be closed due to a long period of inactivity. If you would like this issue to remain open then please comment or update.