• A Rancher-provisioned or standalone RKE2 or K3s cluster
  Rancher 配置或独立的 RKE2 或 K3s 集群

It is possible to customise the TLS 1.0 - 1.2 cipher suites that are used by the kube-apiserver, kube-controller-manager, kube-scheduler and kubelet, via the tls-cipher-suites argument. The list of possible ciphers suites can  be found in the Go documentation at https://pkg.go.dev/crypto/tls#pkg-constants Please note that it is not possible to manually configure TLS 1.3 cipher suites, which is a restriction by design in Go.
可以通过 tls-cipher-suites 参数，对 kube-apiserver、kube-controller-manager、kube-scheduler 和 kubelet 使用的 TLS 1.0 - 1.2 密码套件进行定制。可能的密码套件列表可在 Go 文档中找到 https://pkg.go.dev/crypto/tls#pkg-constants 请注意，无法手动配置 TLS 1.3 密码套件，这是 Go 设计上的限制 。

Standalone RKE2 or K3s clusters
独立的 RKE2 或 K3s 集群

1. Add the tls-cipher-suites argument, with the list of desired cipher suites, to components via the RKE2 Or K3s configuration file on the cluster nodes. In the example below, the argument is set on the kube-controller-manager and the kube-scheduler:
   通过集群节点上的 RKE2 或 K3s 配置文件，将 tls-cipher-suites 参数及所需密码套件列表添加到组件中。在下面的示例中，参数设置在 kube-controller-manager 和 kube 调度器上：

   kube-controller-manager-arg:
   - tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
   kube-scheduler-arg:
   - tls-cipher-suites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
   

2. Apply the change, by restarting the RKE2 or K3s service on the nodes:
   通过在节点上重启 RKE2 或 K3s 服务来应用变更：
   • systemctl restart rke2-server on RKE2 server nodes
   • systemctl restart rke2-agent on RKE2 worker nodes
   • systemctl restart k3s on K3s server nodes
     systemCTL 在 K3s 服务器节点上重启 K3s
   • systemctl restart k3s-agent on K3s worker nodes
3. Check that the TLS-ciphers have been correctly applied:
   检查 TLS 密码是否正确应用：

   nmap --script ssl-enum-ciphers -p 
   

Rancher-provisioned RKE2 or K3s clusters
牧场配置 RKE2 或 K3s 集群

1. Navigate to Cluster Management within the Rancher UI and click Edit Config for the desired cluster
   在 Rancher UI 中进入集群管理 ，点击编辑配置以获取所需集群
2. Under Cluster Configuration click Advanced
   在集群配置中点击  高级
3. Click Add a new row under the Additional Args section for the desired components, and enter the tls-cipher-suites, per the following example:
   点击“ 新增行 ”，在“附加 Args 部分”查找所需组件，并按照以下示例输入 tls-cipher-suites：

   tls-cipher-suites: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

4. Click on Save to apply the changes
   点击 “保存 ”以应用更改
5. Check that the TLS-ciphers have been correctly applied:
   检查 TLS 密码是否正确应用：

   nmap --script ssl-enum-ciphers -p 

访问Rancher-K8S解决方案博主 ：
https://blog.csdn.net/lidw2009