Skip to content

K
k3s
Commit 19c34bd1 authored by Chuck Schweizer's avatar Chuck Schweizer
Browse files
Options

Update to set default CipherSuites

The default CipherSuites need to be set to disable the insecure TLS 1.2 TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 Cipher
parent 689c2726
Hide whitespace changes
Inline Side-by-side
Showing with 15 additions and 4 deletions
pkg/cli/server/server.go
View file @ 19c34bd1
...@@ -190,13 +190,24 @@ func run(app *cli.Context, cfg *cmds.Server) error { ...@@ -190,13 +190,24 @@ func run(app *cli.Context, cfg *cmds.Server) error {
return errors.Wrapf(err, "Invalid TLS Version %s: %v", TLSMinVersion, err) return errors.Wrapf(err, "Invalid TLS Version %s: %v", TLSMinVersion, err)
} }
// TLS config based on mozilla ssl-config generator
// https://ssl-config.mozilla.org/#server=golang&version=1.13.6&config=intermediate&guideline=5.4
// Need to disable the TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 Cipher for TLS1.2
TLSCipherSuites := []string{getArgValueFromList("tls-cipher-suites", cfg.ExtraAPIArgs)} TLSCipherSuites := []string{getArgValueFromList("tls-cipher-suites", cfg.ExtraAPIArgs)}
if len(TLSCipherSuites) != 0 && TLSCipherSuites[0] != "" { if len(TLSCipherSuites) == 0 || TLSCipherSuites[0] == "" {
serverConfig.ControlConfig.TLSCipherSuites, err = kubeapiserverflag.TLSCipherSuites(TLSCipherSuites) TLSCipherSuites = []string{
if err != nil { "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
return errors.Wrapf(err, "Invalid TLS Cipher Suites %s: %v", TLSCipherSuites, err) "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305",
} }
} }
serverConfig.ControlConfig.TLSCipherSuites, err = kubeapiserverflag.TLSCipherSuites(TLSCipherSuites)
if err != nil {
return errors.Wrapf(err, "Invalid TLS Cipher Suites %s: %v", TLSCipherSuites, err)
}
logrus.Info("Starting k3s ", app.App.Version) logrus.Info("Starting k3s ", app.App.Version)
notifySocket := os.Getenv("NOTIFY_SOCKET") notifySocket := os.Getenv("NOTIFY_SOCKET")
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment