mirrors/talos
1
0
Fork 0
mirror of https://github.com/siderolabs/talos.git synced 2026-05-12 16:26:11 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat: update TLS cipher suites for API server

Browse Source 
These are the recommended values from CIS 0.12 guidelines

Signed-off-by: Lennard Klein <lennard.klein@eu.equinix.com>
(cherry picked from commit 9ed488d09648c09a9a5c1ed6a5cd245b84cd415d)
This commit is contained in:
Lennard Klein 2025-11-19 11:37:03 +01:00 committed by Mateusz Urbanek
parent 139cce3b45
commit fdf6fe8e62
No known key found for this signature in database
GPG Key ID: F16F84591E26D77F
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
internal/app/machined/pkg/controllers/k8s/control_plane_static_pod.go
View File

@ -371,7 +371,7 @@ func (ctrl *ControlPlaneStaticPodController) manageAPIServer(ctx context.Context
"enable-bootstrap-token-auth": "true",
// NB: using TLS 1.2 instead of 1.3 here for interoperability, since this is an externally-facing service.
"tls-min-version": "VersionTLS12",
"tls-cipher-suites": "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256", //nolint:lll
"tls-cipher-suites": "TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256", //nolint:lll
"encryption-provider-config": filepath.Join(constants.KubernetesAPIServerSecretsDir, "encryptionconfig.yaml"),
"audit-policy-file": filepath.Join(constants.KubernetesAPIServerConfigDir, "auditpolicy.yaml"),
"audit-log-path": filepath.Join(constants.KubernetesAuditLogDir, "kube-apiserver.log"),