Undefined Description of problem:
Not able see kubelet converts TLS 1.0 to 1.1 for old, 1.3 to 1.2 for intermediate and modern to intermediate as per mentioned in the note of the documentation: https://docs.openshift.com/container-platform/4.11/security/tls-security-profiles.html#tls-profiles-kubernetes-configuring_tls-security-profiles Note from the documentation: The kubelet does not support TLS 1.3 and because the Modern profile requires TLS 1.3, it is not supported. The kubelet converts the Modern profile to Intermediate. The kubelet also converts the TLS 1.0 of an Old or Custom profile to 1.1, and TLS 1.3 of a Custom profile to 1.2. Means once we apply TLS security profile using kubeletconfig file as per documentation, we are getting expected result but 1. when we check for the minTLSVersion: it is showing 1.0 for old --> which should convert to 1.1 version as per documentation. 2. and for custom if we set to 1.3 version it should convert it into 1.2 which we are not getting .
Version-Release number of selected component (if applicable):
How reproducible:
We can apply TLS security profile using below mentioned document to mentioned profiles i.e. intermediate and old and modern for kubelet. https://docs.openshift.com/container-platform/4.11/security/tls-security-profiles.html#tls-profiles-kubernetes-configuring_tls-security-profiles
Steps to Reproduce:
1.Create a KubeletConfig CR to configure the TLS security profile:
e.g.
apiVersion: machineconfiguration.openshift.io/v1
kind: KubeletConfig
metadata:
name: set-kubelet-tls-security-profile
spec:
tlsSecurityProfile:
old: {}
type: Old
machineConfigPoolSelector:
matchLabels:
pools.operator.machineconfiguration.openshift.io/worker: ""
2.Create the KubeletConfig object
oc create -f kubeletconfig
For verification:
$ oc debug node/<node_name>
sh-4.4# chroot /host
sh-4.4# cat /etc/kubernetes/kubelet.conf
Actual results:
Result for old profile :
$ cat /etc/kubernetes/kubelet.conf
{
"kind": "KubeletConfiguration",
"apiVersion": "kubelet.config.k8s.io/v1beta1",
"staticPodPath": "/etc/kubernetes/manifests",
"syncFrequency": "0s",
"fileCheckFrequency": "0s",
"httpCheckFrequency": "0s",
"tlsCipherSuites": [
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_AES_128_GCM_SHA256",
"TLS_RSA_WITH_AES_256_GCM_SHA384",
"TLS_RSA_WITH_AES_128_CBC_SHA256",
"TLS_RSA_WITH_AES_128_CBC_SHA",
"TLS_RSA_WITH_AES_256_CBC_SHA",
"TLS_RSA_WITH_3DES_EDE_CBC_SHA"
],
"tlsMinVersion": "VersionTLS10",
"rotateCertificates": true,
"serverTLSBootstrap": true,
"authentication": {
"x509": {
"clientCAFile": "/etc/kubernetes/kubelet-ca.crt"
},
"webhook": {
"cacheTTL": "0s"
},
"anonymous": {
"enabled": false
}
},
"authorization": {
"webhook": {
"cacheAuthorizedTTL": "0s",
"cacheUnauthorizedTTL": "0s"
}
},
"clusterDomain": "cluster.local",
"clusterDNS": [
"172.30.0.10"
],
"streamingConnectionIdleTimeout": "0s",
"nodeStatusUpdateFrequency": "0s",
"nodeStatusReportFrequency": "0s",
"imageMinimumGCAge": "0s",
"volumeStatsAggPeriod": "0s",
"systemCgroups": "/system.slice",
"cgroupRoot": "/",
"cgroupDriver": "systemd",
"cpuManagerReconcilePeriod": "0s",
"runtimeRequestTimeout": "0s",
"maxPods": 250,
"podPidsLimit": 4096,
"kubeAPIQPS": 50,
"kubeAPIBurst": 100,
"serializeImagePulls": false,
"evictionPressureTransitionPeriod": "0s",
"featureGates": {
"APIPriorityAndFairness": true,
"CSIMigrationAWS": false,
"CSIMigrationAzureFile": false,
"CSIMigrationGCE": false,
"CSIMigrationvSphere": false,
"DownwardAPIHugePages": true,
"PodSecurity": true,
"RotateKubeletServerCertificate": true
},
"memorySwap": {},
"containerLogMaxSize": "50Mi",
"systemReserved": {
"ephemeral-storage": "1Gi"
},
"logging": {
"flushFrequency": 0,
"verbosity": 0,
"options": {
"json": {
"infoBufferSize": "0"
}
}
},
"shutdownGracePeriod": "0s",
"shutdownGracePeriodCriticalPods": "0s"
}
Result for Modern (it should convert it into modern to internmediate. not able to see profiles and also version is showing as 1.3 which should be 1.2 which is of internmediate):
sh-4.4# cat /etc/kubernetes/kubelet.conf
{
"kind": "KubeletConfiguration",
"apiVersion": "kubelet.config.k8s.io/v1beta1",
"staticPodPath": "/etc/kubernetes/manifests",
"syncFrequency": "0s",
"fileCheckFrequency": "0s",
"httpCheckFrequency": "0s",
"tlsMinVersion": "VersionTLS13",
"rotateCertificates": true,
"serverTLSBootstrap": true,
"authentication": {
"x509": {
"clientCAFile": "/etc/kubernetes/kubelet-ca.crt"
},
"webhook": {
"cacheTTL": "0s"
},
"anonymous": {
"enabled": false
}
},
"authorization": {
"webhook": {
"cacheAuthorizedTTL": "0s",
"cacheUnauthorizedTTL": "0s"
}
},
"clusterDomain": "cluster.local",
"clusterDNS": [
"172.30.0.10"
],
"streamingConnectionIdleTimeout": "0s",
"nodeStatusUpdateFrequency": "0s",
"nodeStatusReportFrequency": "0s",
"imageMinimumGCAge": "0s",
"volumeStatsAggPeriod": "0s",
"systemCgroups": "/system.slice",
"cgroupRoot": "/",
"cgroupDriver": "systemd",
"cpuManagerReconcilePeriod": "0s",
"runtimeRequestTimeout": "0s",
"maxPods": 250,
"podPidsLimit": 4096,
"kubeAPIQPS": 50,
"kubeAPIBurst": 100,
"serializeImagePulls": false,
"evictionPressureTransitionPeriod": "0s",
"featureGates": {
"APIPriorityAndFairness": true,
"CSIMigrationAWS": false,
"CSIMigrationAzureFile": false,
"CSIMigrationGCE": false,
"CSIMigrationvSphere": false,
"DownwardAPIHugePages": true,
"PodSecurity": true,
"RotateKubeletServerCertificate": true
},
"memorySwap": {},
"containerLogMaxSize": "50Mi",
"systemReserved": {
"ephemeral-storage": "1Gi"
},
"logging": {
"flushFrequency": 0,
"verbosity": 0,
"options": {
"json": {
"infoBufferSize": "0"
}
}
},
"shutdownGracePeriod": "0s",
"shutdownGracePeriodCriticalPods": "0s"
}
Result for custom with TLS 1.0 (it shuld convert to 1.1) :
sh-4.4# cat /etc/kubernetes/kubelet.conf
{
"kind": "KubeletConfiguration",
"apiVersion": "kubelet.config.k8s.io/v1beta1",
"staticPodPath": "/etc/kubernetes/manifests",
"syncFrequency": "0s",
"fileCheckFrequency": "0s",
"httpCheckFrequency": "0s",
"tlsCipherSuites": [
"TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256",
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
],
"tlsMinVersion": "VersionTLS10",
"rotateCertificates": true,
"serverTLSBootstrap": true,
"authentication": {
"x509": {
"clientCAFile": "/etc/kubernetes/kubelet-ca.crt"
},
"webhook": {
"cacheTTL": "0s"
},
"anonymous": {
"enabled": false
}
},
"authorization": {
"webhook": {
"cacheAuthorizedTTL": "0s",
"cacheUnauthorizedTTL": "0s"
}
},
"clusterDomain": "cluster.local",
"clusterDNS": [
"172.30.0.10"
],
"streamingConnectionIdleTimeout": "0s",
"nodeStatusUpdateFrequency": "0s",
"nodeStatusReportFrequency": "0s",
"imageMinimumGCAge": "0s",
"volumeStatsAggPeriod": "0s",
"systemCgroups": "/system.slice",
"cgroupRoot": "/",
"cgroupDriver": "systemd",
"cpuManagerReconcilePeriod": "0s",
"runtimeRequestTimeout": "0s",
"maxPods": 250,
"podPidsLimit": 4096,
"kubeAPIQPS": 50,
"kubeAPIBurst": 100,
"serializeImagePulls": false,
"evictionPressureTransitionPeriod": "0s",
"featureGates": {
"APIPriorityAndFairness": true,
"CSIMigrationAWS": false,
"CSIMigrationAzureFile": false,
"CSIMigrationGCE": false,
"CSIMigrationvSphere": false,
"DownwardAPIHugePages": true,
"PodSecurity": true,
"RotateKubeletServerCertificate": true
},
"memorySwap": {},
"containerLogMaxSize": "50Mi",
"systemReserved": {
"ephemeral-storage": "1Gi"
},
"logging": {
"flushFrequency": 0,
"verbosity": 0,
"options": {
"json": {
"infoBufferSize": "0"
}
}
},
"shutdownGracePeriod": "0s",
"shutdownGracePeriodCriticalPods": "0s"
}
Result for custom with TLS 1.3 (it shuld convert to 1.2) :
Expected results:
old ---> Not able to convert to 1.1 custom ---> for 1.0 ---> not able to convert 1.0 to 1.1 for 1.3 ---> not able to convert 1.3 to 1.2 modern ---> It should convert to internmediate. not able to see profiles and also version is showing as 1.3 which should be 1.2 which is of internmediate.
Additional info:
