Skip to content
ATO Pathways
  Log In

Ensure that the OpenShift API Server Operator only makes use of Strong Cryptographic Ciphers

An XCCDF Rule

Description

Ensure that the OpenShift API Server Operator is configured to only use strong cryptographic ciphers.

warning alert: Warning

This rule's check operates on the cluster configuration dump. Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/operator.openshift.io/v1/openshiftapiservers/cluster API endpoint to the local /apis/operator.openshift.io/v1/openshiftapiservers/cluster file.

Rationale

TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.

ID
xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cipher_suites_openshiftapiserver_operator
Severity
Medium
References
Updated



Remediation - Kubernetes Patch

---
apiVersion: operator.openshift.io/v1kind: OpenShiftAPIServer
metadata:
  name: cluster
spec:
  unsupportedConfigOverrides: