Browse Source

Disable weak tls ciphers for kube-apiserver

Set `--tls-cipher-suites` to golang defaults minus 3DES
Implementation of change made in
https://review.openstack.org/#/c/634815/

Change-Id: Icbeded84d5973b042a779ba20569654d2d91b563
tags/v1.0
Jared Miller 3 months ago
parent
commit
95a1a9f431
1 changed files with 5 additions and 0 deletions
  1. 5
    0
      global/software/charts/kubernetes/core/apiserver.yaml

+ 5
- 0
global/software/charts/kubernetes/core/apiserver.yaml View File

@@ -123,6 +123,11 @@ data:
123 123
     apiserver:
124 124
       etcd:
125 125
         endpoints: https://127.0.0.1:2378
126
+      tls:
127
+        tls-cipher-suites: "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA"
128
+        # https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
129
+        # Possible values: VersionTLS10, VersionTLS11, VersionTLS12
130
+        tls-min-version: 'VersionTLS12'
126 131
     command_prefix:
127 132
       - /apiserver
128 133
       - --service-cluster-ip-range=SERVICE_CIDR

Loading…
Cancel
Save