Check ID: kubelet_strong_ciphers_only
Provider: Kubernetes
Service: kubelet
Severity: MEDIUM
Categories: encryption, cluster-security
Resource type: ConfigMap

​
What this check verifies

Kubernetes Kubelet HTTPS configuration is assessed for use of strong TLS cipher suites. The presence of tlsCipherSuites is checked and its values are validated against an approved, modern allowlist (e.g., ECDHE with GCM/CHACHA20).

​
Risk

Weak or unspecified ciphers enable downgrade and cryptographic attacks on kubelet traffic. Adversaries could read logs/exec streams, hijack sessions, or tamper with requests, undermining confidentiality and integrity and facilitating lateral movement across nodes.

​
Recommendation

Restrict tlsCipherSuites to a minimal set of modern suites (ECDHE with GCM or CHACHA20) and prefer TLS1.2+/TLS1.3. Remove deprecated CBC/RC4/3DES suites. Apply defense in depth: limit network access to the kubelet, rotate certificates, and review cipher policy regularly for deprecations.

​
Remediation

Dashboard steps
  1. Identify the kubelet config ConfigMap name:
    • Run: kubectl -n kube-system get configmap | grep kubelet-config
  2. Edit that ConfigMap:
    • Run: kubectl -n kube-system edit configmap <kubelet-config-<version>>
    • In the data.kubelet YAML (KubeletConfiguration), add the following and save: tlsCipherSuites:
      • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
      • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
      • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
      • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
      • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
      • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      • TLS_RSA_WITH_AES_256_GCM_SHA384
      • TLS_RSA_WITH_AES_128_GCM_SHA256
  3. Apply on each node (required for kubelets using local config):
    • SSH to the node, edit /var/lib/kubelet/config.yaml to include the same tlsCipherSuites list
    • Restart kubelet: sudo systemctl restart kubelet

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = kubelet_strong_ciphers_only. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks