Project: KICS (Provisioning / Security & Compliance)
File: 510d5810-9a30-443a-817d-5c1fa527b110.md

title: Weak TLS Cipher Suites hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 510d5810-9a30-443a-817d-5c1fa527b110 Query name: Weak TLS Cipher Suites Platform: Kubernetes Severity: <span style="color:#ff7213">Medium</span> Category: Encryption URL: TLS Connection should use strong Cipher Suites<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--tls-cipher-suites=TLSECDHEECDSAWITHAES128CBCSHA256,TLSECDHEECDSAWITHAES128GCMSHA256"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--tls-cipher-suites=TLSRSAWITHRC4128_SHA"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="9" apiVersion: kubelet.config.k8s.io/v1beta1 kind: KubeletConfiguration address: "192.168.0.8" port: 20250 protectKernelDefaults: false serializeImagePulls: false tlsCertFile: "someFile.txt" tlsPrivateKeyFile: "someFile.txt" tlsCipherSuites: ["TLSECDHEECDSAWITHAES128GCMSHA256","TLSECDHEECDSAWITHAES128CBCSHA256"] evictionHard: memory.available: "200Mi" ``` <details><summary>Positive test num. 4 - json file</summary> ```json hl_lines="2" { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "port": 10250, "readOnlyPort": 10255, "cgroupDriver": "cgroupfs", "hairpinMode": "promiscuous-bridge", "serializeImagePulls": false, "featureGates": { "RotateKubeletClientCertificate": true, "RotateKubeletServerCertificate": true } } ``` </details> ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--tls-cipher-suites=TLSECDHEECDSAWITHAES128GCMSHA256,TLSECDHERSAWITHAES128GCMSHA256"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: ["--tls-cipher-suites=TLSECDHEECDSAWITHAES128GCMSHA256,TLSECDHEECDSAWITHAES128GCMSHA256"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 3 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: foo/bar command: ["kubelet"] args: [] restartPolicy: OnFailure ``` <details><summary>Negative test num. 4 - json file</summary> ```json { "kind": "KubeletConfiguration", "apiVersion": "kubelet.config.k8s.io/v1beta1", "port": 10250, "readOnlyPort": 10255, "cgroupDriver": "cgroupfs", "hairpinMode": "promiscuous-bridge", "serializeImagePulls": false, "tlsCipherSuites": ["TLSECDHEECDSAWITHAES128GCMSHA256","TLSECDHERSAWITHAES128GCMSHA256"], "featureGates": { "RotateKubeletClientCertificate": true, "RotateKubeletServerCertificate": true } } ``` </details>