Only offer secure ciphers in kubelet server (#883)

* Only offer TLS 1.3 in kubelet server * Add specific cipher list
sapcc · Mar 12, 2024 · fab2229 · fab2229
1 parent fed77f6
commit fab2229
Show file tree

Hide file tree

Showing 3 changed files with 24 additions and 0 deletions.
diff --git a/charts/seed/templates/kubeadm.yaml b/charts/seed/templates/kubeadm.yaml
@@ -258,6 +258,14 @@ data:
     streamingConnectionIdleTimeout: 0s
     syncFrequency: 0s
     volumeStatsAggPeriod: 0s
+    tlsCipherSuites:
+    - TLS_CHACHA20_POLY1305_SHA256
+    - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+    - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+    - TLS_AES_128_GCM_SHA256
+    - TLS_AES_256_GCM_SHA384
+    - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+    - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 kind: ConfigMap
 metadata:
   name: kubelet-config

diff --git a/pkg/api/handlers/get_cluster_bootstrap.go b/pkg/api/handlers/get_cluster_bootstrap.go
@@ -46,6 +46,14 @@ authentication:
     enabled: true
 rotateCertificates: true
 nodeLeaseDurationSeconds: 20
+tlsCipherSuites:
+- TLS_CHACHA20_POLY1305_SHA256
+- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+- TLS_AES_128_GCM_SHA256
+- TLS_AES_256_GCM_SHA384
+- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 featureGates:
 `))
 

diff --git a/pkg/templates/node_1.27.go b/pkg/templates/node_1.27.go
@@ -297,6 +297,14 @@ storage:
           rotateCertificates: true
           nodeLeaseDurationSeconds: 20
           cgroupDriver: systemd
+          tlsCipherSuites:
+          - TLS_CHACHA20_POLY1305_SHA256
+          - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
+          - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
+          - TLS_AES_128_GCM_SHA256
+          - TLS_AES_256_GCM_SHA384
+          - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
+          - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
     - path: /etc/flatcar/update.conf
       filesystem: root
       mode: 0644