Information
Ensure that the Kubelet is configured to only use strong cryptographic ciphers.
Rationale:
TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.
Impact:
Kubelet clients that cannot support modern cryptographic ciphers will not be able to make connections to the Kubelet API.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Follow the directions above and in the OpenShift documentation to configure the tlsSecurityProfile. Configuring Ingress
Default Value:
By default the Kubernetes API server supports a wide range of TLS ciphers