implement configurable ciphers for ingresscontroller

sig-bsi-grundschutz · Oct 15, 2024 · 87a6df7 · 87a6df7
1 parent 47219b2
commit 87a6df7
Show file tree

Hide file tree

Showing 3 changed files with 36 additions and 3 deletions.
diff --git a/...ications/openshift/kubelet/kubelet_configure_tls_cipher_suites_ingresscontroller/rule.yml b/...ications/openshift/kubelet/kubelet_configure_tls_cipher_suites_ingresscontroller/rule.yml
@@ -50,6 +50,5 @@ template:
     ocp_data: "true"
     filepath: '/apis/operator.openshift.io/v1/namespaces/openshift-ingress-operator/ingresscontrollers/default'
     yamlpath: ".status.tlsProfile.ciphers[:]"
-    values:
-    - value: '^(ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-ECDSA-CHACHA20-POLY1305|ECDHE-RSA-AES256-GCM-SHA384|ECDHE-RSA-CHACHA20-POLY1305|ECDHE-ECDSA-AES256-GCM-SHA384|TLS_AES_128_GCM_SHA256|TLS_AES_256_GCM_SHA384|TLS_CHACHA20_POLY1305_SHA256)$'
-      operation: 'pattern match'
+    xccdf_variable: var_ingresscontroller_tls_cipher_suites_regex
+    regex_data: true
diff --git a/applications/openshift/kubelet/var_ingresscontroller_tls_cipher_suites.var b/applications/openshift/kubelet/var_ingresscontroller_tls_cipher_suites.var
@@ -0,0 +1,17 @@
+documentation_complete: true
+
+title: 'Configure Ingresscontroller use of the Strong Cryptographic Ciphers'
+
+description: 'Cryptographic Ciphers Available for Ingresscontroller"," separated by comma'
+
+type: string
+
+operator: equals
+
+interactive: false
+
+options:
+    default: '"ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-RSA-AES128-GCM-SHA256","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-CHACHA20-POLY1305","ECDHE-ECDSA-CHACHA20-POLY1305","TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","TLS_CHACHA20_POLY1305_SHA256","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384"'
+
+    # the BSI does not recommend CHACHA cipher in the 2024-01 Version of BSI-TR-02102-2
+    2024-01-BSI-TR-02102-2: '"ECDHE-RSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES256-GCM-SHA384","ECDHE-ECDSA-AES128-GCM-SHA256","ECDHE-RSA-AES128-GCM-SHA256","TLS_AES_128_GCM_SHA256","TLS_AES_256_GCM_SHA384","DHE-RSA-AES128-GCM-SHA256","DHE-RSA-AES256-GCM-SHA384"'
diff --git a/applications/openshift/kubelet/var_ingresscontroller_tls_cipher_suites_regex.var b/applications/openshift/kubelet/var_ingresscontroller_tls_cipher_suites_regex.var
@@ -0,0 +1,17 @@
+documentation_complete: true
+
+title: 'Configure Ingresscontroller use of the Strong Cryptographic Ciphers'
+
+description: 'Cryptographic Ciphers Available for Ingresscontroller'
+
+type: string
+
+operator: equals
+
+interactive: false
+
+options:
+  default: "^(ECDHE-RSA-AES256-GCM-SHA384|ECDHE-ECDSA-AES256-GCM-SHA384|ECDHE-RSA-AES128-GCM-SHA256|ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-RSA-CHACHA20-POLY1305|ECDHE-ECDSA-CHACHA20-POLY1305|TLS_AES_128_GCM_SHA256|TLS_AES_256_GCM_SHA384|TLS_CHACHA20_POLY1305_SHA256|DHE-RSA-AES128-GCM-SHA256|DHE-RSA-AES256-GCM-SHA384)$"
+
+  # the BSI does not recommend CHACHA cipher in the 2024-01 Version of BSI-TR-02102-2
+  2024-01-BSI-TR-02102-2: "^(ECDHE-RSA-AES256-GCM-SHA384|ECDHE-ECDSA-AES256-GCM-SHA384|ECDHE-ECDSA-AES128-GCM-SHA256|ECDHE-RSA-AES128-GCM-SHA256|TLS_AES_128_GCM_SHA256|TLS_AES_256_GCM_SHA384|DHE-RSA-AES128-GCM-SHA256|DHE-RSA-AES256-GCM-SHA384)$"