Enhance documentation for cipher suites

[yckaolalala]

What type of PR is this?

/kind documentation

What this PR does / why we need it:

• Correct the POLY1305 cipher suites by adding the suffix _SHA256.

# echo ok | openssl s_client -connect 127.0.0.1:6443 -tls1_2 -ciphersuites TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305

Error with command: "-ciphersuites TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305

Reference: https://pkg.go.dev/crypto/tls#pkg-constants

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Correct the POLY1305 cipher suites by adding the suffix _SHA256

[k8s-ci-robot]

Hi @yckaolalala. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[yankay]

/ok-to-test

[MrFreezeex]

When I tried to add a TLS 1.3 cipher suite, such as TLS_AES_128_GCM_SHA256, I noticed that it is not listed in the comment.

Last time I checked you can't configure cipher suite when you force tls 1.3 it is ignored later on 🤔

[yankay]

@yckaolalala Thanks :-)

[yckaolalala]

@MrFreezeex you are correct. I've adjusted the PR message to update the documentation with references .

I use testssl.sh to scan ciphers and do some tests.
When I set the tls_min_version to VersionTLS12

tls_cipher_suites:
  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 # TLS 1.2
  #- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_AES_128_GCM_SHA256 # TLS 1.3
  #- TLS_AES_256_GCM_SHA384
  - TLS_CHACHA20_POLY1305_SHA256

etcd_tls_cipher_suites:
  - TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 # TLS 1.2
  #- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  - TLS_AES_128_GCM_SHA256 # TLS 1.3
  #- TLS_AES_256_GCM_SHA384
  - TLS_CHACHA20_POLY1305_SHA256

I observed the following:

For TLS 1.2 cipher settings, both etcd and kube-api can scan TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, but there is no scanning for TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 as indicated in the comment.

In TLS 1.3, all three cipher suites (TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256) are scanned in kube-api.
However, for etcd, none of these cipher suites are scanned.

I also attempted to set the tls_min_version to empty. The results are the same.

[yckaolalala]

Should I just close this PR? It appears that TLS 1.3 cipher suite is not functioning as expected in the tls_cipher_suites settings.

[yankay]

Should I just close this PR? It appears that TLS 1.3 cipher suite is not functioning as expected in the tls_cipher_suites settings.

Thanks @yckaolalala

I'm not sure whether it should be closed :-)
There is s a good example of docs about how to config the tls of kube-apiserver,kubelet and etcd : https://access.redhat.com/documentation/en-us/openshift_container_platform/4.13/html-single/security_and_compliance/index#tls-profiles-ingress-configuring_tls-security-profile :-)

Because I have not test the config yet , so I can just give some weak suggestion :
Changing the TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 to TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 is a good idea, and we can only modify it in this PR. And it can be improved later :-)

[yckaolalala]

Thanks @yankay
I've updated the PR to replace POLY1305 cipher suites.

[yankay]

Thanks @yckaolalala
/approve

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: yankay, yckaolalala

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [yankay]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[VannTen]

/lgtm
(If this does not get merged, try to repush. It loooks like the CI is not reporting the almalinux job status correctly)

[floryut]

/lgtm (If this does not get merged, try to repush. It loooks like the CI is not reporting the almalinux job status correctly)

I've resynced the job, all good now 👍