<p>I am running Kubernetes on AWS, and exposing services using a <code>Service</code> with <code>type: LoadBalancer</code>, which provisions an ELB. Is there any way to control the ELB cipher configuration with annotations on this service? I need to disable TLS 1.0 and 1.1.</p>

<p>I am aware that I can do this by hand, but I would like for Kubernetes to do this for me, otherwise I'll have to remember to do it again the next time a new ELB is provisioned (Kubernetes upgrade, config change, etc).</p>

Christian Johansen
<p>If I understood you right, you would like to adjust security policies directly from Service.yml file.</p>

<p>From what I see, <a href="https://github.com/kubernetes/legacy-cloud-providers/blob/master/aws/aws.go" rel="nofollow noreferrer">here</a> you can find a list of all the annotations that are supported at the moment. </p>

<p>There is one called "aws-load-balancer-ssl-negotiation-policy". For me it looks exactly as the one you are looking for.</p>

<pre><code>// ServiceAnnotationLoadBalancerSSLNegotiationPolicy is the annotation used on
// the service to specify a SSL negotiation settings for the HTTPS/SSL listeners
// of your load balancer. Defaults to AWS's default

const ServiceAnnotationLoadBalancerSSLNegotiationPolicy = "service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy"
</code></pre>

<p>The link to that file is listed under <a href="https://kubernetes.io/docs/concepts/cluster-administration/cloud-providers/#aws" rel="nofollow noreferrer">official documentation on K8s</a>.</p>

<p>Additionally, there  is a predefined policy <a href="https://docs.aws.amazon.com/elasticloadbalancing/latest/classic/elb-security-policy-table.html" rel="nofollow noreferrer">ELBSecurityPolicy-TLS-1-2-2017-01</a> that uses only TLS v1.2 ( with 1.0 and 1.1 disabled). </p>

<p>Hope that helps. </p>
