More Info:
Ensure that the Kubelet is configured to only use strong cryptographic ciphers.Risk Level
MediumAddress
SecurityCompliance Standards
- CIS Kubernetes
Triage and Remediation
- Remediation
Remediation
Using Console
Using Console
The set of cryptographic ciphers currently considered secure is the following:•TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256•TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256•TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305•TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384•TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305•TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384•TLS_RSA_WITH_AES_256_GCM_SHA384•TLS_RSA_WITH_AES_128_GCM_SHA256Run the following command on each node:Page 211ps -ef | grep kubelet If the —tls-cipher-suites argument is present, ensure it only contains values includedin this set. If it is not present check that there is a Kubelet config file specified by —config, andthat file sets TLSCipherSuites: to only include values from this set.