pkg/crypto: OpenSSL-to-IANA ciphers mapping: Remove go's unsupported cipher, add missing ones

[damdo]

A modified revert of #2118, to partially reintroduce #2080 and add comments on the reasoning regarding missing cipher mappings and explaining how to maintain the mappings list.

We want to have a mapping for all OpenSSL ciphers defined in https://github.com/openshift/api/blob/master/config/v1/types_tlssecurityprofile.go
so then we can translate them to IANA ciphers, which is what go's crypto/tls understands.

We want to make sure both the openshift/api and these mappings are also compatible with go's crypto/tls ciphers: https://github.com/golang/go/blob/d4febb45179fa99ee1d5783bcb693ed7ba14115c/src/crypto/tls/cipher_suites.go#L682-L724

More details here: #2080 (comment)
And here: https://redhat-internal.slack.com/archives/C098FU5MRAB/p1770309657097269

--

openshift/api PR counterpart: openshift/api#2697

[openshift-ci]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[damdo]

/retitle pkg/crypto: OpenSSL-to-IANA ciphers mapping: Remove go's unsupported cipher, add missing ones

[damdo]

/assign @p0lyn0mial @joelanford @richardsonnick

[bertinatto]

@sanchezl could you help review these changes?

@damdo could you create a proof PR where you bump library-go in an operator (example, KASO) to use your changes? Thanks!

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: damdo
Once this PR has been reviewed and has the lgtm label, please ask for approval from p0lyn0mial. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[damdo]

@bertinatto here it is: openshift/cluster-kube-apiserver-operator#2034

[damdo]

/hold

Until openshift/api#2697 merges

[damdo]

@bertinatto @p0lyn0mial @ardaguclu CI has finished on openshift/cluster-kube-apiserver-operator#2034 are we happy with the results?

[damdo]

/test unit

[openshift-ci]

@damdo: all tests passed!

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.