Validation List DRBG Deterministic Random Number Generator DTR Derived Test Requirements ECDSA Elliptic Curve Digital Signature Algorithm EC DH Elliptic Curve Diffie-Hellman FIPS Federal ............................................................................ 16 9.2.5 RSA and ECDSA Keys ............................................................................................ Key values User, CO Write/Execute Signature Generation/ Verification CTR_DRBG, RSA, ECDSA RSA, ECDSA private key User, CO Write/Execute Key Transport RSA RSA private key User, CO Write/Execute

--bind-address=0.0.0.0 --tls- cipher- suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA _WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY130 5,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 --bind-address=0.0.0.0 --tls- cipher- suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA _WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY130 5,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 --bind-address=0.0.0.0 --tls- cipher- suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA _WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY130 5,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

ServerCertificate=true" • --tls-cipher-suites="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 84,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256" R e m e d i at i on • Ad d t h e f ol l ow i n g t o t protect-kernel-defaults: "true" tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

-e '.[0].Args[] | match("--tls-cipher-suites=.*(TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256).*").captures[].string' Returned Value: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 docker inspect kube-apiserver | -e '.[0].Args[] | match("--tls-cipher-suites=.*(TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305).*").captures[].string' Returned Value: TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305 docker inspect kube-apiserver | -e '.[0].Args[] | match("--tls-cipher-suites=.*(TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384).*").captures[].string' Returned Value: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 docker inspect kube-apiserver |

protect-kernel-defaults: "true" tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA 256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH _CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 HA384,TLS_E CDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_G CM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128 _GCM_SHA256" extra_binds: [] extra_env: [] cluster_domain: 1800s tls-cipher-suites: >- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES _128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECD HE_RSA_WITH_AES_256_GCM_SHA384

protect-kernel-defaults: "true" tls-cipher-suites: "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA 256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH _CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 HA384,TLS_E CDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_G CM_SHA384,TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128 _GCM_SHA256" extra_binds: [] extra_env: [] cluster_domain: 1800s tls-cipher-suites: >- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES _128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECD HE_RSA_WITH_AES_256_GCM_SHA384