refactor(tls): drop cipherMap, use Go's cipher suite lists directly

Replace the hand-maintained cipherMap allowlist with direct lookups
against tls.CipherSuites() and tls.InsecureCipherSuites():

- Secure ciphers are accepted silently
- Insecure ciphers are accepted but logged via klog.Warningf
- Unrecognized names are still rejected (existing behavior)

This removes the maintenance burden of keeping cipherMap in sync with
Go's cipher suite lists, and automatically picks up new secure ciphers
added in future Go releases. Previously excluded insecure ciphers
(RC4-based, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA) are now accepted with
a warning instead of being silently rejected.

Signed-off-by: zhujian <jiazhu@redhat.com>

Author: zhujian7

pkg/tls/cipher.go

@@ -4,6 +4,8 @@ import (
 	"crypto/tls"
 	"fmt"
 	"strings"
+
+	"k8s.io/klog/v2"
 )
 
 const (
@@ -45,12 +47,17 @@ func parseTLSVersion(version string) (uint16, error) {
 }
 
 // parseCipherSuites converts IANA cipher suite names to Go crypto/tls constants.
-// Returns a list of cipher suite IDs and a list of unsupported cipher names.
+// Secure ciphers (tls.CipherSuites) are accepted silently. Insecure ciphers
+// (tls.InsecureCipherSuites) are accepted but logged as a warning.
+// Returns a list of cipher suite IDs and a list of unrecognized cipher names.
 func parseCipherSuites(cipherString string) ([]uint16, []string) {
 	if strings.TrimSpace(cipherString) == "" {
 		return nil, nil
 	}
 
+	secureSuites := tls.CipherSuites()
+	insecureSuites := tls.InsecureCipherSuites()
+
 	cipherNames := strings.Split(cipherString, ",")
 	cipherSuites := make([]uint16, 0, len(cipherNames))
 	unsupported := make([]string, 0)
@@ -61,16 +68,31 @@ func parseCipherSuites(cipherString string) ([]uint16, []string) {
 			continue
 		}
 
-		if suite, ok := cipherMap[name]; ok {
-			cipherSuites = append(cipherSuites, suite)
-		} else {
-			unsupported = append(unsupported, name)
+		if id, ok := findCipherID(name, secureSuites); ok {
+			cipherSuites = append(cipherSuites, id)
+			continue
+		}
+		if id, ok := findCipherID(name, insecureSuites); ok {
+			klog.Warningf("Cipher suite %s is insecure and should not be used in production", name)
+			cipherSuites = append(cipherSuites, id)
+			continue
 		}
+		unsupported = append(unsupported, name)
 	}
 
 	return cipherSuites, unsupported
 }
 
+// findCipherID looks up a cipher suite by IANA name in the given list.
+func findCipherID(name string, suites []*tls.CipherSuite) (uint16, bool) {
+	for _, s := range suites {
+		if s.Name == name {
+			return s.ID, true
+		}
+	}
+	return 0, false
+}
+
 // GetDefaultTLSConfig returns a TLS config with safe defaults (TLS 1.2)
 func GetDefaultTLSConfig() *TLSConfig {
 	return &TLSConfig{

pkg/tls/config.go

@@ -918,6 +918,16 @@ func TestParseCipherSuites(t *testing.T) {
 			cipherString:  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
 			expectedCount: 2,
 		},
+		{
+			name:          "insecure cipher accepted with warning",
+			cipherString:  "TLS_RSA_WITH_AES_128_GCM_SHA256",
+			expectedCount: 1,
+		},
+		{
+			name:          "mix of secure and insecure ciphers",
+			cipherString:  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_128_GCM_SHA256",
+			expectedCount: 2,
+		},
 	}
 
 	for _, tc := range cases {