Description of problem: With etcd 3.2.22 or higher, the administrator can set a custom cipher-suite list with '--cipher-suites "comma-separated-cipher-list"' It would be great to bring this to the OCP installer. Steps to Reproduce: 1. Environment with etcd 3.2.22 or higher 2. Create a new env variable in /etc/etcd/etcd.conf, with a comma-separated cipher list: ~~~ ETCD_CIPHER_SUITES="TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" ~~~ * changes should be in https://github.com/openshift/openshift-ansible/blob/master/roles/etcd/templates/etcd.conf.j2 3. Edit the ExecStart in the systemd unit to use this cipher list: ~~~ ExecStart=/bin/bash -c "GOMAXPROCS=$(nproc) /usr/bin/etcd --name=\"${ETCD_NAME}\" --data-dir=\"${ETCD_DATA_DIR}\" --cipher-suites \"${ETCD_CIPHER_SUITES}\" --listen-client-urls=\"${ETCD_LISTEN_CLIENT_URLS}\"" ~~~ * I think the playbook should create a new systemd unit in /etc/systemd/... to avoid the default unit file to be overriden by the rpm (which by default overrides /usr/lib/systemd/...) Expected results: As an administrator I want to set my etcd cipher-suite list in my ansible host file.
PR to implement custom list of ciphers in openshift-ansible master: https://github.com/openshift/openshift-ansible/pull/9883
Verify this bug with openshift-ansible-3.11.0-0.28.0.git.0.730d4be.el7.noarch.rpm Set etcd_cipher_suites in ansible inventory etcd_cipher_suites=TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 After installation, check etcd conf file. [root@ip-172-18-2-210 ~]# grep ETCD_CIPHER_SUITES /etc/etcd/etcd.conf ETCD_CIPHER_SUITES="TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256"
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:2652