From 0ff173efea2cd5c940bbe34b53a5b950021b2cbd Mon Sep 17 00:00:00 2001
From: fpetkovski <filip.petkovsky@gmail.com>
Date: Tue, 22 Jun 2021 10:40:34 +0200
Subject: [PATCH] jsonnet: disable insecure cypher suites for
prometheus-adapter
Running sslscan against the prometheus adapter secure port reports two
insecure SSL ciphers, ECDHE-RSA-DES-CBC3-SHA and DES-CBC3-SHA.
This commit removes those ciphers from the list.
Signed-off-by: fpetkovski <filip.petkovsky@gmail.com>
---
.../components/prometheus-adapter.libsonnet | 18 ++++++++++++++++++
manifests/prometheus-adapter-deployment.yaml | 1 +
2 files changed, 19 insertions(+)
diff --git a/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet b/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
index 8312183c..9a3144b0 100644
--- a/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
+++ b/jsonnet/kube-prometheus/components/prometheus-adapter.libsonnet
@@ -53,6 +53,23 @@ local defaults = {
window: '5m',
},
},
+ tlsCipherSuites: [
+ 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305',
+ 'TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305',
+ 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256',
+ 'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384',
+ 'TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256',
+ 'TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384',
+ 'TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA',
+ 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256',
+ 'TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA',
+ 'TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA',
+ 'TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA',
+ 'TLS_RSA_WITH_AES_128_GCM_SHA256',
+ 'TLS_RSA_WITH_AES_256_GCM_SHA384',
+ 'TLS_RSA_WITH_AES_128_CBC_SHA',
+ 'TLS_RSA_WITH_AES_256_CBC_SHA',
+ ],
};
function(params) {
@@ -145,6 +162,7 @@ function(params) {
'--metrics-relist-interval=1m',
'--prometheus-url=' + pa._config.prometheusURL,
'--secure-port=6443',
+ '--tls-cipher-suites=' + std.join(',', pa._config.tlsCipherSuites),
],
ports: [{ containerPort: 6443 }],
volumeMounts: [
diff --git a/manifests/prometheus-adapter-deployment.yaml b/manifests/prometheus-adapter-deployment.yaml
index 787e18fb..475eaf53 100644
--- a/manifests/prometheus-adapter-deployment.yaml
+++ b/manifests/prometheus-adapter-deployment.yaml
@@ -35,6 +35,7 @@ spec:
- --metrics-relist-interval=1m
- --prometheus-url=http://prometheus-k8s.monitoring.svc.cluster.local:9090/
- --secure-port=6443
+ - --tls-cipher-suites=TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA
image: directxman12/k8s-prometheus-adapter:v0.8.4
name: prometheus-adapter
ports:
--
GitLab