A customer is configuring custom TLS profiles on Ingress Controller, control plane and kubelet (doc),  However, the use of the unwanted ECDHE-RSA-CHACHA20-POLY1305 cipher is reported.  

$ oc get apiserver/cluster -o json | jq  .spec.tlsSecurityProfile
{
  "custom": {
    "ciphers": [
      "ECDHE-RSA-AES128-GCM-SHA256",
      "ECDHE-RSA-AES256-GCM-SHA384",
      "ECDHE-ECDSA-AES128-GCM-SHA256",
      "ECDHE-ECDSA-AES256-GCM-SHA384"
    ],
    "minTLSVersion": "VersionTLS12"
  },
  "type": "Custom"
}  

OCP 4.14.10      

Configure the custom profiles according to the documentation:
https://docs.openshift.com/container-platform/4.14/security/tls-security-profiles.html     

 1. Details of the custom TLS profiles configured: $ oc get ingresscontrollers/default -n openshift-ingress-operator -o json  | jq  .spec.tlsSecurityProfile
{
  "custom": {
    "ciphers": [
      "ECDHE-RSA-AES128-GCM-SHA256",
      "ECDHE-RSA-AES256-GCM-SHA384",
      "ECDHE-ECDSA-AES128-GCM-SHA256",
      "ECDHE-ECDSA-AES256-GCM-SHA384"
    ],
    "minTLSVersion": "VersionTLS12"
  },
  "type": "Custom"
}$ oc get apiserver/cluster -o json | jq  .spec.tlsSecurityProfile
{
  "custom": {
    "ciphers": [
      "ECDHE-RSA-AES128-GCM-SHA256",
      "ECDHE-RSA-AES256-GCM-SHA384",
      "ECDHE-ECDSA-AES128-GCM-SHA256",
      "ECDHE-ECDSA-AES256-GCM-SHA384"
    ],
    "minTLSVersion": "VersionTLS12"
  },
  "type": "Custom"
}$ oc get kubeletconfig/mycustomkubelet -o json | jq  .spec.tlsSecurityProfile
{
  "custom": {
    "ciphers": [
      "ECDHE-RSA-AES128-GCM-SHA256",
      "ECDHE-RSA-AES256-GCM-SHA384",
      "ECDHE-ECDSA-AES128-GCM-SHA256",
      "ECDHE-ECDSA-AES256-GCM-SHA384"
    ],
    "minTLSVersion": "VersionTLS12"
  },
  "type": "Custom"
}

2. Bash test:

$ for port in 17697 10357 9100 9001 10259 22623 6443 2379 10250 9978 10257 2380 9099 9192 9104 1936 443 ; do for node in `cat /tmp/hostlist`; do for v in ssl2 ssl3 tls1 tls1_1 tls1_2; do for c in $(openssl ciphers 'ALL:eNULL' | tr ':' ' '); do timeout 4 openssl s_client -connect $node:$port -cipher $c -$v < /dev/null > /dev/null 2>&1 ; [[ $? -eq 0 ]] && echo -e "$node:$port $v: $c"; done; done; done; done              

master:17697 tls1_2: ECDHE-RSA-CHACHA20-POLY1305