• Type: Bug
• Resolution: Unresolved
• Priority: Undefined
• Fix Version/s: None
• Affects Version/s: 4.18
• Component/s: Compliance Operator
• Labels:

  None

[OCPBUGS-54212] Rule kubelet-configure-tls-cipher-suites fails with new ciphers from RFC 8446

Collapse comment: Lance Bragstad added a comment - 2025/03/25 4:43 PM

Lance Bragstad added a comment - 2025/03/25 4:43 PM

These are the ciphers configured by default on an 4.18 cluster:

 

$ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1" | .tlsCipherSuites'; done
[
  "TLS_AES_128_GCM_SHA256",
  "TLS_AES_256_GCM_SHA384",
  "TLS_CHACHA20_POLY1305_SHA256",
  "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256",
  "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
  "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
  "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256",
  "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256"
]
 

Expand comment: Lance Bragstad added a comment - 2025/03/25 4:43 PM

Lance Bragstad added a comment - 2025/03/25 4:43 PM These are the ciphers configured by default on an 4.18 cluster:   $ for NODE_NAME in $(oc get nodes -ojsonpath= '{.items[*].metadata.name}' ); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind= "KubeletConfiguration" |.apiVersion= "kubelet.config.k8s.io/v1beta1" | .tlsCipherSuites' ; done [   "TLS_AES_128_GCM_SHA256" ,   "TLS_AES_256_GCM_SHA384" ,   "TLS_CHACHA20_POLY1305_SHA256" ,   "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" ,   "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" ,   "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" ,   "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" ,   "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" ,   "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" ]

Collapse comment: Lance Bragstad added a comment - 2025/03/25 1:44 PM

Lance Bragstad added a comment - 2025/03/25 1:44 PM

We needed to make a similar change to the platform profile assertions:

https://github.com/ComplianceAsCode/content/pull/12863/commits/7d9878679c2f909c85efd305f9ddd708ffe4b153

Expand comment: Lance Bragstad added a comment - 2025/03/25 1:44 PM

Lance Bragstad added a comment - 2025/03/25 1:44 PM We needed to make a similar change to the platform profile assertions: https://github.com/ComplianceAsCode/content/pull/12863/commits/7d9878679c2f909c85efd305f9ddd708ffe4b153

Collapse comment: Lance Bragstad added a comment - 2025/03/25 1:43 PM

Lance Bragstad added a comment - 2025/03/25 1:43 PM

This is the rule that's failing - https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/kubelet/kubelet_configure_tls_cipher_suites/rule.yml#L65-L71

 

template:
    name: yamlfile_value
    vars:
        filepath: '/etc/kubernetes/compliance-operator/kubeletconfig/openscap-kubeletconfig'
        yamlpath: ".kubeletconfig.tlsCipherSuites[:]"
        xccdf_variable: var_kubelet_tls_cipher_suites_regex
        regex_data: true 

The variable it's using is:

options:
  default: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" 

https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/kubelet/var_kubelet_tls_cipher_suites.var#L14

 

Expand comment: Lance Bragstad added a comment - 2025/03/25 1:43 PM

Lance Bragstad added a comment - 2025/03/25 1:43 PM This is the rule that's failing - https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/kubelet/kubelet_configure_tls_cipher_suites/rule.yml#L65-L71   template:     name: yamlfile_value     vars:         filepath: '/etc/kubernetes/compliance- operator /kubeletconfig/openscap-kubeletconfig'         yamlpath: ".kubeletconfig.tlsCipherSuites[:]"         xccdf_variable: var_kubelet_tls_cipher_suites_regex         regex_data: true The variable it's using is: options:   default : "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" https://github.com/ComplianceAsCode/content/blob/master/applications/openshift/kubelet/var_kubelet_tls_cipher_suites.var#L14