Red Hat build of MicroShift

Configure TLS for MicroShift

You can choose to use either the TLS 1.2 or TLS 1.3 security profiles with MicroShift for system hardening.

Prerequisites

You have access to the node as a root user.
MicroShift has either not started for the first time, or is stopped.
The OpenShift CLI (oc) is installed.
The certificate authority has issued the custom certificates (CAs).

Procedure

Make a copy of the provided config.yaml.default file in the /etc/microshift/ directory, renaming it config.yaml.
Keep the new MicroShift config.yaml in the /etc/microshift/ directory. Your config.yaml file is read every time the MicroShift service starts.

After you create it, the config.yaml file takes precedence over built-in settings.
Optional: Use a configuration snippet if you are using an existing MicroShift YAML. See "Using configuration snippets" in the Additional resources section for more information.

Replace the default values in the tls section of the MicroShift YAML with your valid values.

Example TLS 1.2 configuration

apiServer:
# ...
  tls:
    cipherSuites:
    - <cipher_suite_1>
    - ...
    minVersion: VersionTLS12
# ...

where:

apiServer.tls.cipherSuites

Defaults to the suites of the configured minVersion. If minVersion is not configured, the default value is TLS 1.2. You can specify the cipher suites you want to use from the list of supported cipher suites. All clients connecting to the API server must support the configured cipher suites or the connections fail during the TLS handshake phase. Be sure to add the CA certificate bundle to the list of CA certificates that the TLS client or server trusts.

apiServer.tls.minVersion

Specify VersionTLS12 or VersionTLS13.

When you choose TLS 1.3 as the minimum TLS version, only the default MicroShift cipher suites can be used. Additional cipher suites are not configurable. If other cipher suites to use with TLS 1.3 are configured, those suites are ignored and overwritten by the MicroShift defaults.

Complete any other additional configurations that you require, then restart MicroShift by running the following command:
```
$ sudo systemctl restart microshift
```