diff --git a/charts/seed/templates/kubeadm.yaml b/charts/seed/templates/kubeadm.yaml index 96c7c9c408..a682bac1ba 100644 --- a/charts/seed/templates/kubeadm.yaml +++ b/charts/seed/templates/kubeadm.yaml @@ -258,6 +258,14 @@ data: streamingConnectionIdleTimeout: 0s syncFrequency: 0s volumeStatsAggPeriod: 0s + tlsCipherSuites: + - TLS_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 kind: ConfigMap metadata: name: kubelet-config diff --git a/pkg/api/handlers/get_cluster_bootstrap.go b/pkg/api/handlers/get_cluster_bootstrap.go index 4fa0dbbe11..21279a3865 100644 --- a/pkg/api/handlers/get_cluster_bootstrap.go +++ b/pkg/api/handlers/get_cluster_bootstrap.go @@ -46,6 +46,14 @@ authentication: enabled: true rotateCertificates: true nodeLeaseDurationSeconds: 20 +tlsCipherSuites: +- TLS_CHACHA20_POLY1305_SHA256 +- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 +- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 +- TLS_AES_128_GCM_SHA256 +- TLS_AES_256_GCM_SHA384 +- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 +- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 featureGates: `)) diff --git a/pkg/templates/node_1.27.go b/pkg/templates/node_1.27.go index f309eede12..14c20e498c 100644 --- a/pkg/templates/node_1.27.go +++ b/pkg/templates/node_1.27.go @@ -297,6 +297,14 @@ storage: rotateCertificates: true nodeLeaseDurationSeconds: 20 cgroupDriver: systemd + tlsCipherSuites: + - TLS_CHACHA20_POLY1305_SHA256 + - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 + - TLS_AES_128_GCM_SHA256 + - TLS_AES_256_GCM_SHA384 + - TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 + - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - path: /etc/flatcar/update.conf filesystem: root mode: 0644