Red Hat build of MicroShift

Configure the TLS security profile for the ingress controller

To configure the TLS security profile for the ingress controller in MicroShift, you can add the spec.tlsSecurityProfile field to the configuration YAML and set a value for the appropriate profile. To apply the changes, restart the service.

Prerequisites

You have root access to the MicroShift node.

Procedure

Add the spec.tlsSecurityProfile field to the MicroShift YAML configuration file.
```
 ...
spec:
  tlsSecurityProfile:
    type: Custom
    custom:
      ciphers:
      - ECDHE-ECDSA-CHACHA20-POLY1305
      - ECDHE-RSA-CHACHA20-POLY1305
      - ECDHE-RSA-AES128-GCM-SHA256
      - ECDHE-ECDSA-AES128-GCM-SHA256
      minTLSVersion: VersionTLS11
 ...
```
where:
spec.tlsSecurityProfile.type

Specifies the TLS security profile type (Old, Intermediate, or Custom). The default is Intermediate.

spec.tlsSecurityProfile.custom
Specifies the appropriate field for the selected type:
old: {}

intermediate: {}

custom:
spec.tlsSecurityProfile.custom.ciphers

Specifies a list of TLS ciphers and minimum accepted TLS version.

If you choose a custom TLS configuration, use extreme caution. Using self-signed TLS certificates can introduce security risks.
Save the file to apply the changes.
Restart MicroShift by running the following command:
```
$ sudo systemctl restart microshift
```