Pass through default tls-cipher-suites

[brandond]

Proposed Changes

Pass through default tls-cipher-suites to kube-apiserver

Types of Changes

feature request

Verification

Check reported flags passed to kube-apiserver

Testing

Linked Issues

• Pass through default ciphers as kube-apiserver-arg #6724

User-Facing Change

The K3s default cipher suites are now explicitly passed in to kube-apiserver, ensuring that all listeners use these values.

Further Comments

[codecov-commenter]

Codecov Report

Base: 9.67% // Head: 9.66% // Decreases project coverage by -0.00% ⚠️

Coverage data is based on head (facbc52) compared to base (a298bfd).
Patch coverage: 0.00% of modified lines in pull request are covered.

Additional details and impacted files

@@            Coverage Diff            @@
##           master   #6725      +/-   ##
=========================================
- Coverage    9.67%   9.66%   -0.01%     
=========================================
  Files         139     139              
  Lines       10227   10228       +1     
=========================================
  Hits          989     989              
- Misses       9034    9035       +1     
  Partials      204     204              

Flag	Coverage Δ
unittests	9.66% <0.00%> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
pkg/cli/server/server.go	0.00% <0.00%> (ø)

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[dereknola]

Can you open a Docs PR that adds the new arguments to https://docs.k3s.io/security/hardening-guide#control-plane-execution-and-arguments please?

[brandond]

@dereknola do you have a suggestion on how to cover this in the docs? We already ship with hardened defaults so this isn't a big change on K3s. This fix is mostly for RKE2 where the apiserver wasn't using these because we weren't passing the defaults through - only the supervisor ports was using the hardened cipher list.

[cwayne18]

My understanding is that this is largely for a pull-through to RKE2 yeah? looks sane to me

[dereknola]

@dereknola do you have a suggestion on how to cover this in the docs? We already ship with hardened defaults so this isn't a big change on K3s. This fix is mostly for RKE2 where the apiserver wasn't using these because we weren't passing the defaults through - only the supervisor ports was using the hardened cipher list.

In the docs for hardening, as part of explaining the underlying code, we break out the kubeapiserver arguments K3s automatically passes. We need to at to that with the tls-cipher-suites argument.

[brandond]

@dereknola

• Add default tls-cipher-suites values docs#72