Correction in remediation for compliance rule "ocp4-api-server-encryption-provider-cipher"
Issue
- As per the remediation for compliance rule "ocp4-api-server-encryption-provider-cipher" is suggesting to use "aescbc, but Kubernetes document suggested this cipher is not strong enough due to CBC's vulnerability.
description: |-
To ensure the correct cipher, set the encryption type aescbc in the apiserver object which configures the API server itself.
rationale: aescbc is currently the strongest encryption provider, it should be preferred
over other providers.
Environment
- Red Hat OpenShift Container Platform 4.x
- OpenShift Compliance Operator
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.