9.2. Configuring TLS security profiles

Procedure

1. Make a copy of the provided config.yaml.default file in the /etc/microshift/ directory, renaming it config.yaml.

2. Keep the new MicroShift config.yaml in the /etc/microshift/ directory. Your config.yaml file is read every time the MicroShift service starts.

   注記

   After you create it, the config.yaml file takes precedence over built-in settings.

3. Optional: Use a configuration snippet if you are using an existing MicroShift YAML. See "Using configuration snippets" in the Additional resources section for more information.

4. Replace the default values in the tls section of the MicroShift YAML with your valid values.

   Example TLS 1.2 configuration

   apiServer:
   # ...
     tls:
       cipherSuites: 

   1

   
       - <cipher_suite_1> 

   2

   
       - ...
       minVersion: VersionTLS12 

   3

   
   # ...

   1

   Defaults to the suites of the configured minVersion. If minVersion is not configured, the default value is TLS 1.2.

   2

   Specify the cipher suites you want to use from the list of supported cipher suites. If you do not configure this list, all of the supported cipher suites are used. All clients connecting to the API server must support the configured cipher suites or the connections fail during the TLS handshake phase. Be sure to add the CA certificate bundle to the list of CA certificates that the TLS client or server trusts.

   3

   Specify VersionTLS12 or VersionTLS13.

   重要

   When you choose TLS 1.3 as the minimum TLS version, only the default MicroShift cipher suites can be used. Additional cipher suites are not configurable. If other cipher suites to use with TLS 1.3 are configured, those suites are ignored and overwritten by the MicroShift defaults.

5. Complete any other additional configurations that you require, then restart MicroShift by running the following command:

   $ sudo systemctl restart microshift