Remove outdated information

[AustinLeaming]

Should these lines be reworked to provide a more clear picture in regards to the latest version of the agent 7.38? The parameter min_tls_version is not an option for configuration in version 7.38 whereas force_tls_12 is an option for configuration.

datadog-agent/pkg/config/config_template.yaml

Lines 66 to 82 in c459e08

	## @param min_tls_version - string - optional - default: "tlsv1.0"
	## @env DD_MIN_TLS_VERSION - string - optional - default: "tlsv1.0"
	## This option defines the minimum TLS version that will be used when
	## submitting data to the Datadog intake specified in "site" or "dd_url".
	## This parameter defaults to "tlsv1.0" (but see `force_tls_12`, below).
	## Possible values are: tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3; values are case-
	## insensitive.
	#
	# min_tls_version: "tlsv1.0"
	## @param force_tls_12 - boolean - optional - default: false
	## @env DD_FORCE_TLS_12 - boolean - optional - default: false
	## Setting this option to "true" is equivalent to setting the default for
	## `min_tls_version` to `tlsv1.2`. This parameter is deprecated in favor of
	## `min_tls_version`.
	#
	# force_tls_12: false

[djmitche]

Those docs are for the agent code on the main branch, which will be in 7.40. If you look in

https://github.com/DataDog/datadog-agent/blob/7.38.2/pkg/config/config_template.yaml#L66-L82 (for 7.38.2) it doesn't mention min_tls_version

https://github.com/DataDog/datadog-agent/blob/7.39.0-rc.8/pkg/config/config_template.yaml#L66-L82 (for 7.39.0-rc.8) mentions the min_tls_version, which is available in 7.39.

[AustinLeaming]

Howdy! Do you mind clarifying a bit? I'm not sure I fully understand so I might be making some wrong assumptions here:

The agent code I linked is on the main branch which is reflective of version 7.40, is that correct? If so, I'm confused on why min_tls_version is included since Datadog no longer supports TLS versions < 1.2 - https://docs.datadoghq.com/data_security/guide/tls_deprecation_1_2/

My thoughts would be that since we do not support sending data to our intake of TLS versions < 1.2, why include that in our template?

Again, I may be making some assumptions so I might be wrong in my thought process here!

[djmitche]

You're correct that the main branch represents what will be 7.40. Your question talked about 7.38, which is a different story entirely.

The Agent does still support older TLS versions. Customers might need this if, for example, they are using a proxy that doesn't support newer versions.

We can't remove old config parameters, since they will continue to appear in customer configs. When we landed this config change, we had some discussion of how much to "hide" the old config option (force_tls_12), and settled on continuing to document it, but describe it as "deprecated".