How to enable TLSv1.3?

[Torkolis]

I just found that it is not enabled by default, when I create a ingress with tls and pass it a secret containing the certificate the URL does not support TLSv1.3. the nginx.conf inside the rke2-ingress-nginx-controller pod just contains
ssl_protocols TLSv1.2;

[brandond]

Ingress-nginx configuration is documented upstream at https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#configuration-options

The Helm chart allows you to set these options as controller.config:
https://github.com/kubernetes/ingress-nginx/blob/main/charts/ingress-nginx/values.yaml#L45-L46

[brandond]

I don't believe that's something we've customized. It's possible that the upstream docs are incorrect or out of date?

[Torkolis]

no, I dont think they are. You can actually see it in their sourcecode:
https://github.com/kubernetes/ingress-nginx/blob/main/internal/ingress/controller/config/config.go#L71-L73

[brandond]

Hmm, apparently this is something that we do in order to meet FIPS 140-2 criteria, which (at the time we developed our patch set) require use of TLS 1.2.

rancher/ingress-nginx@321fc31#diff-9d5b1b69cf78e84e6d53c19a176fa404dd4bb4fe7cfaabdc491ef725bcc8daedR73

[brandond]

@galal-hussein might know more about this

[Torkolis]

hmm no answer, tls1.3 is still not enabled by default :(