Check ID: apiserver_strong_ciphers_only
Provider: Kubernetes
Service: apiserver
Severity: MEDIUM
Categories: encryption, cluster-security
Resource type: Pod

​
What this check verifies

Kubernetes API server restricts TLS to strong cipher suites by configuring --tls-cipher-suites to only modern values such as TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, and TLS_CHACHA20_POLY1305_SHA256

​
Risk

Permitting weak or mixed cipher suites enables TLS downgrades and cryptanalytic attacks, undermining confidentiality and integrity of API traffic. Attackers could intercept or alter requests, steal tokens, and pivot to compromise the control plane.

​
Recommendation

Limit ciphers to modern AEAD suites and remove legacy entries in --tls-cipher-suites.
  • Enforce a high --tls-min-version (prefer VersionTLS13).
  • Periodically review crypto policy and rotate keys.
  • Apply defense in depth: restrict API exposure and require strong client auth.

​
Remediation

# Minimal kube-apiserver manifest snippet enforcing only strong TLS ciphers
apiVersion: v1
kind: Pod
metadata:
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - name: kube-apiserver
    command:
    - kube-apiserver
    - --tls-cipher-suites=TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256  # FIX: restricts ciphers to strong TLS 1.3 suites only

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_strong_ciphers_only. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks