<p>I have been poring over links related to kubeadm to try and change the cipher on my Kubernetes cluster certificate. The problem is that I need to disable DES/3DES so that this command will fail:</p>
<pre><code>openssl s_client -connect IP:2379 -cipher &quot;DES:3DES&quot; -tls1_2
</code></pre>
<p>Some of the links I've looked through so far (if I list them all, this post will get too long):</p>
<ul>
<li><a href="https://github.com/rancher/rancher/issues/10354" rel="nofollow noreferrer">SSL Vulnerability Sweet32</a> (how this all started)</li>
<li><a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/" rel="nofollow noreferrer">kube-apiserver configuration</a></li>
<li><a href="https://www.stackrox.com/post/2019/09/12-kubernetes-configuration-best-practices/" rel="nofollow noreferrer">12 Kubernetes configuration best practices</a></li>
<li><a href="https://kubernetes.io/docs/reference/setup-tools/kubeadm/kubeadm-alpha/#cmd-certs-renew" rel="nofollow noreferrer">kubeadm alpha certs renew all</a></li>
</ul>
<p>I was hoping that changing the <code>kube-apiserver</code> configuration to use these flags (in the <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> file) would help, but it did not (pardon typos, I cannot copy/paste out of the client I have to use):</p>
<pre><code>...
spec:
  containers:
  - command:
    - kube-apiserver
    - ...
    - --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
    - --tls-min-version=VersionTLS12
    image: k8s.gcr.io/kube-apiserver:v1.18.6
...
</code></pre>
<p>I could manually regenerate all the certificates in <code>/etc/kubernetes/pki</code> following <a href="https://kubernetes.io/docs/setup/best-practices/certificates/" rel="nofollow noreferrer">these guidelines</a>, but I am hoping to stick with the <code>kubeadm</code> or other Kubernetes-provided tools to auto-handle it. I can't find any documentation on manually generating each file on my own that is set up for people completely new to the administration.</p>
<p>Help, links, suggestions, etc. are appreciated! I'm not allowed to use the cluster or even demonstrate functionality to people until this is done, unfortunately.</p>

<p>In our vanilla kubernetes 1.18.3 installation on Ubuntu 16.04 setup with kubeadm we solved this the following:</p>
<p>kubelets (port 10250):
in File <code>/var/lib/kubelet/config.yaml</code> add this:</p>
<pre><code>tlsCipherSuites: [TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA]
</code></pre>
<p>restart the kubelet.service via <code>systemctl restart kubelet.service</code></p>
<p>kube-api-server (port 6443):
in File <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> add a additional array entry in <code>spec.containers.command</code></p>
<pre><code>- --tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
</code></pre>
<p>Delete the pod kube-apiserver in namespace kube-system if necessary.</p>
<p>edit: don't created a e.g. backupfile from <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code> in the same directory. kube-api-server will apply this backupfile as well.</p>
