| name | cis-ocp-v160-4.2.12 |
| description | Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) |
| category | cis-openshift |
| version | 1.6.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","worker-nodes","kubelet"] |
| cis_id | 4.2.12 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 |
| tech_stack | ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 4.2.12
Profile Applicability
Description
Ensure that the Kubelet is configured to only use strong cryptographic ciphers.
Rationale
TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.
Impact
Kubelet clients that cannot support modern cryptographic ciphers will not be able to make connections to the Kubelet API.
Audit Procedure
The set of cryptographic ciphers currently considered secure is the following:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_GCM_SHA256
Ciphers for the API servers, authentication and the ingress controller can be configured using the tlsSecurityProfile parameter as of OpenShift 4.3. The ingress controller provides external access to the API server. There are four TLS security profile types:
- Old
- Intermediate
- Modern
- Custom
Only the Old, Intermediate and Custom profiles are supported at this time for the Ingress controller. Custom provides the ability to specify individual TLS security profile parameters. Follow the steps in the documentation to configure the cipher suite for Ingress, API server and Authentication.
Run the following commands to verify the cipher suite and minTLSversion for the ingress operator, authentication operator, cliconfig, OpenShift APIserver and Kube APIserver.
Use the following command to verify the available ciphers:
oc get --namespace=openshift-ingress-operator ingresscontroller/default -ojson | jq .status.tlsProfile.ciphers
Verify the ciphers used by the Kubernetes API server:
oc get kubeapiservers.operator.openshift.io cluster -ojson | jq .spec.observedConfig.servingInfo.cipherSuites
Verify the ciphers used by the OpenShift API server:
oc get openshiftapiservers.operator.openshift.io cluster -ojson | jq .spec.observedConfig.servingInfo.cipherSuites
Verify the ciphers used by OpenShift authentication:
