1

I am running Kubernetes on AWS, and exposing services using a Service with type: LoadBalancer, which provisions an ELB. Is there any way to control the ELB cipher configuration with annotations on this service? I need to disable TLS 1.0 and 1.1.

I am aware that I can do this by hand, but I would like for Kubernetes to do this for me, otherwise I'll have to remember to do it again the next time a new ELB is provisioned (Kubernetes upgrade, config change, etc).

Christian Johansen
  • 1,861
  • 1
  • 16
  • 22

3 Answers3

4

If I understood you right, you would like to adjust security policies directly from Service.yml file.

From what I see, here you can find a list of all the annotations that are supported at the moment.

There is one called "aws-load-balancer-ssl-negotiation-policy". For me it looks exactly as the one you are looking for.

// ServiceAnnotationLoadBalancerSSLNegotiationPolicy is the annotation used on
// the service to specify a SSL negotiation settings for the HTTPS/SSL listeners
// of your load balancer. Defaults to AWS's default

const ServiceAnnotationLoadBalancerSSLNegotiationPolicy = "service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy"

The link to that file is listed under official documentation on K8s.

Additionally, there is a predefined policy ELBSecurityPolicy-TLS-1-2-2017-01 that uses only TLS v1.2 ( with 1.0 and 1.1 disabled).

Hope that helps.

Nick
  • 1,882
  • 11
  • 16
  • Use like this in your service annotations: annotations: service.beta.kubernetes.io/aws-load-balancer-ssl-negotiation-policy: "ELBSecurityPolicy-TLS-1-2-2017-01" – Sownak Roy Aug 07 '20 at 14:45
1

you can use for example annotations like:

alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS-1-1-2017-01

ALB Ingress Controller SSL Policy Annotations

Bijay Jung Karki
  • 11
  • 1
0

Edit the Security policy on the HTTPS listener on the Load Balancer.

JoBu
  • 176
  • 1
  • 5