Ensure TLS 1.2+ for all inbound traffic at IBM Cloud Kubernetes Service Ingress

MédiaNível 1Revisão manualibmcloud

Descrição

Ensure that all insecure (HTTP) client requests to applications and services hosted on IBM Cloud Kubernetes Service are redirected to secure TLS connections (HTTPS) and ensure that only TLS versions 1.2+ are supported. You set up Ingress application load balancers (ALBs) in your cluster to secure your domain with the IBM-provided TLS certificate or your custom TLS certificate. Some users might try to access your apps by using an insecure http request to your ALB domain, for example http://www.myingress.com, instead of using https. Hypertext transfer protocol secure (HTTPS) is the secure version of HTTP and uses the Transport Layer Security (TLS) protocol to provide a secure, encrypted connection between the client and the server. This protocol encrypts communication to protect users from attack, for example, man in the middle attacks. IBM Cloud Kubernetes Service provides configuratio...

Como é verificado

Método de auditoria: Revisão manual

Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.

1. Obtain the configuration for the ibm-k8s-controller-config ConfigMap resource. kubectl get cm ibm-k8s-controller-config -n kube-system -o yaml 2. In the data section, ensure that the ssl-protocols key is not present, or if it is present, ensure that it only includes TLSv1.2 and/or TLSv1.3. 3. In the data section, ensure that the ssl-redirect key is present and is set to true. apiVersion: v1 data: ssl-protocols: "TLSv1.2 TLSv1.3" ssl-redirect: “true” kind: ConfigMap metadata: name: ibm-k8s-controller-config namespace: kube-system 4. Obtain the configuration for your Ingress resource by running the following command: kubectl get ingress <my_ingress> -n <my_namespace> -o yaml 5. In the annotations section, ensure that the nginx.ingress.kubernetes.io/ssl-redirect key is present and is set to true. apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myingress annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: tls: - hosts: - myhost secretName: mytlssecret rules: - host: myhost http: paths: - backend: service: name: myservice port: number: 8080 path: /

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

1. Edit the configuration file for the ibm-k8s-controller-config ConfigMap resource by running the following command: kubectl edit cm ibm-k8s-controller-config -n kube-system 2. In the data section, remove the ssl-protocols key, or ensure it is set to ssl- protocols: "TLSv1.2 TLSv1.3". 3. In the data section, add ssl-redirect: "true". apiVersion: v1 data: ssl-protocols: "TLSv1.2 TLSv1.3" ssl-redirect: “true” kind: ConfigMap metadata: name: ibm-k8s-controller-config namespace: kube-system 4. Edit the configuration for your Ingress resource by running the following command: kubectl edit ingress <my_ingress> -n <my_namespace> 5. In the annotations section, add nginx.ingress.kubernetes.io/ssl- redirect: "true". apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: myingress annotations: nginx.ingress.kubernetes.io/ssl-redirect: "true" spec: tls: - hosts: - myhost secretName: mytlssecret rules: - host: myhost http: paths: - backend: service: name: myservice port: number: 8080 path: /

Propriedades

Sistemas operacionais: Qualquer
Tags: cloudibmcloudtls
Referência: CIS IBM Cloud Foundations Benchmark v2.0.0 - 7.1.2 Ensure TLS 1.2+ for all inbound traffic at IBM Cloud Kubernetes Service Ingress