API Server only makes use of Strong Cryptographic Ciphers








Set up the kubernetes integration.


Ensure that the API server is configured to only use strong cryptographic ciphers.


TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.


Run the following command on the master node:

ps -ef | grep kube-apiserver

Verify that the --tls-cipher-suites argument is set as outlined in the remediation procedure below.


Edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and set the --tls-cipher-suites parameter as follows, or to a subset of these values:



API server clients that cannot support modern cryptographic ciphers will not be able to make connections to the API server. Set the same subset in rule 4.2.13

Default value

By default the Kubernetes API server supports a wide range of TLS ciphers


  1. https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices#23-use-secure-cipher-suites

Notes: The list chosen above should be fine for modern clients. It’s essentially the list from the Mozilla “Modern cipher” option with the ciphersuites supporting CBC mode removed, as CBC has traditionally had a lot of issues

CIS controls

Version 6 3.4 Use Only Secure Channels For Remote System Administration - Perform all remote administration of servers, workstation, network devices, and similar equipment over secure channels. Protocols such as telnet, VNC, RDP, or others that do not actively support strong encryption should only be used if they are performed over a secondary encryption channel, such as SSL, TLS or IPSEC.

Version 7 4.5 Use Multifactor Authentication For All Administrative Access - Use multi-factor authentication and encrypted channels for all administrative account access.