How do I install the Cis K8S V1120 4.2.12 skill?

Run npx skillmds@latest add cyberstrikeus/cis-k8s-v1120-4-2-12 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis K8S V1120 4.2.12 skill do?

Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual) It is listed under DevOps & Infra on SkillMD.

Is Cis K8S V1120 4.2.12 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis K8S V1120 4.2.12?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis K8S V1120 4.2.12 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis K8S V1120 4.2.12?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis K8S V1120 4.2.12 by cyberstrikeus

Name: Cis K8S V1120 4.2.12
Author: cyberstrikeus

File contents

CIS Kubernetes Benchmark v1.12.0 - Control 4.2.12

Description

Ensure that the Kubelet is configured to only use strong cryptographic ciphers.

Rationale

TLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.

Impact

Kubelet clients that cannot support modern cryptographic ciphers will not be able to make connections to the Kubelet API.

Audit Procedure

Step 1: Identify the approved cipher suites

The set of cryptographic ciphers currently considered secure is the following:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

Step 2: Verify via process arguments

Run the following command on each node:

ps -ef | grep kubelet

If the --tls-cipher-suites argument is present, ensure it only contains values included in this set.

If it is not present check that there is a Kubelet config file specified by --config, and that file sets tlsCipherSuites: to only include values from this set.

Remediation

If using a Kubelet config file, edit the file to set tlsCipherSuites: to TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 or to a subset of these values.

If using executable arguments, edit the kubelet service file /etc/kubernetes/kubelet.conf on each worker node and set the --tls-cipher-suites parameter as follows, or to a subset of these values.

--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256

Based on your system, restart the kubelet service. For example:

systemctl daemon-reload
systemctl restart kubelet.service

Default Value

By default the Kubernetes API server supports a wide range of TLS ciphers.

Additional Information

The list chosen above should be fine for modern clients. It's essentially the list from the Mozilla "Modern cipher" option with the ciphersuites supporting CBC mode removed, as CBC has traditionally had a lot of issues.

References

None specified.

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and SoftwareUninstall or disable unnecessary services on enterprise assets and software.		●	●
v7	5.1 Establish Secure ConfigurationsMaintain documented, standard security configuration standards for all authorized operating systems and software.	●	●	●

Profile Applicability

Level 1 - Worker Node

Assessment Status

Manual

---name: cis-k8s-v1120-4-2-12description: Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Manual)---# CIS Kubernetes Benchmark v1.12.0 - Control 4.2.12## DescriptionEnsure that the Kubelet is configured to only use strong cryptographic ciphers.## RationaleTLS ciphers have had a number of known vulnerabilities and weaknesses, which can reduce the protection provided by them. By default Kubernetes supports a number of TLS ciphersuites including some that have security concerns, weakening the protection provided.## ImpactKubelet clients that cannot support modern cryptographic ciphers will not be able to make connections to the Kubelet API.## Audit Procedure### Step 1: Identify the approved cipher suitesThe set of cryptographic ciphers currently considered secure is the following:- `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`- `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`- `TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305`- `TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`- `TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305`- `TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`### Step 2: Verify via process argumentsRun the following command on each node:```bashps -ef | grep kubelet```If the `--tls-cipher-suites` argument is present, ensure it only contains values included in this set.If it is not present check that there is a Kubelet config file specified by `--config`, and that file sets `tlsCipherSuites:` to only include values from this set.## RemediationIf using a Kubelet config file, edit the file to set `tlsCipherSuites:` to `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384` or to a subset of these values.If using executable arguments, edit the kubelet service file `/etc/kubernetes/kubelet.conf` on each worker node and set the `--tls-cipher-suites` parameter as follows, or to a subset of these values.```--tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256```Based on your system, restart the `kubelet` service. For example:```bashsystemctl daemon-reloadsystemctl restart kubelet.service```## Default ValueBy default the Kubernetes API server supports a wide range of TLS ciphers.## Additional InformationThe list chosen above should be fine for modern clients. It's essentially the list from the Mozilla "Modern cipher" option with the ciphersuites supporting CBC mode removed, as CBC has traditionally had a lot of issues.## ReferencesNone specified.## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---- | ---- | ---- || v8 | 4.8 Uninstall or Disable Unnecessary Services on Enterprise Assets and Software<br>Uninstall or disable unnecessary services on enterprise assets and software. | | ● | ● || v7 | 5.1 Establish Secure Configurations<br>Maintain documented, standard security configuration standards for all authorized operating systems and software. | ● | ● | ● |## Profile Applicability- Level 1 - Worker Node## Assessment StatusManual

Frequently asked questions

Cis K8S V1120 4.2.12