SRG-APP-000516-CTR-001325

Container platform components must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.

2 rules found Severity: Medium

4 rules found Severity: Medium

2 rules found Severity: Medium

3 rules found Severity: Medium

2 rules found Severity: Medium

3 rules found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

4 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

2 rules found Severity: High

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Medium

2 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: High

1 rule found Severity: Low

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

3 rules found Severity: Medium

1 rule found Severity: Medium

3 rules found Severity: Medium

1 rule found Severity: Medium

1 rule found Severity: Low

1 rule found Severity: Medium

SRG-APP-000516-CTR-001325

Disable Anonymous Authentication to the Kubelet

Ensure authorization is set to Webhook

kubelet - Configure the Client CA Certificate

kubelet - Enable Certificate Rotation

kubelet - Enable Client Certificate Rotation

kubelet - Allow Automatic Firewall Configuration

kubelet - Enable Protect Kernel Defaults

kubelet - Enable Server Certificate Rotation

kubelet - Do Not Disable Streaming Timeouts

Verify Group Who Owns The Kubelet Configuration File

Verify Group Who Owns The Worker Kubeconfig File

Verify User Who Owns The Kubelet Configuration File

Verify User Who Owns The Worker Kubeconfig File

Verify Permissions on The Kubelet Configuration File

Verify Permissions on the Worker Kubeconfig File

Ensure that File Integrity Operator is scanning the cluster

Restrict Automounting of Service Account Tokens

Ensure Usage of Unique Service Accounts

Disable the AlwaysAdmit Admission Control Plugin

Ensure that the Admission Control Plugin AlwaysPullImages is not set

Enable the NamespaceLifecycle Admission Control Plugin

Enable the NodeRestriction Admission Control Plugin

Enable the SecurityContextConstraint Admission Control Plugin

Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used

Enable the ServiceAccount Admission Control Plugin

Ensure that anonymous requests to the API Server are authorized

Ensure catch-all FlowSchema object for API Priority and Fairness Exists

Ensure catch-all FlowSchema object for API Priority and Fairness Exists (v1alpha1)

Configure the Kubernetes API Server Maximum Retained Audit Logs

Configure Kubernetes API Server Maximum Audit Log Size

Configure the Audit Log Path

The authorization-mode cannot be AlwaysAllow

Ensure authorization-mode Node is configured

Ensure authorization-mode RBAC is configured

Disable basic-auth-file for the API Server

Ensure that the bindAddress is set to a relevant secure port

Configure the etcd Certificate for the API Server

Configure the etcd Certificate Key for the API Server

Ensure that the --kubelet-https argument is set to true

Disable Use of the Insecure Bind Address

Configure the kubelet Certificate Authority for the API Server

Configure the kubelet Certificate File for the API Server

Configure the kubelet Certificate Key for the API Server

Ensure all admission control plugins are enabled

Ensure the openshift-oauth-apiserver service uses TLS

Profiling is protected by RBAC

Configure the API Server Minimum Request Timeout

Ensure that the service-account-lookup argument is set to true

Configure the Service Account Public Key for the API Server

Use Strong Cryptographic Ciphers on the API Server

Disable Token-based Authentication

Ensure Controller insecure port argument is unset

Ensure that the RotateKubeletServerCertificate argument is set

Ensure Controller secure-port argument is set

Configure the Service Account Certificate Authority Key for the Controller Manager

Configure the Service Account Private Key for the Controller Manager

Ensure that use-service-account-credentials is enabled

Disable etcd Self-Signed Certificates

Ensure That The etcd Client Certificate Is Correctly Set

Enable The Client Certificate Authentication

Ensure That The etcd Key File Is Correctly Set

Disable etcd Peer Self-Signed Certificates

Enable The Peer Client Certificate Authentication

Configure A Unique CA Certificate for etcd

Apply Security Context to Your Pods and Containers

Manage Image Provenance Using ImagePolicyWebhook

The default namespace should not be used

Ensure Seccomp Profile Pod Definitions

Create administrative boundaries between resources using namespaces

Kubelet - Ensure Event Creation Is Configured

Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers

kubelet - Disable the Read-Only Port

kubelet - Set Up Sysctl to Enable Protect Kernel Defaults

Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.available

Ensure Eviction threshold Settings Are Set - evictionHard: imagefs.inodesFree

Ensure Eviction threshold Settings Are Set - evictionHard: memory.available

Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.available

Ensure Eviction threshold Settings Are Set - evictionHard: nodefs.inodesFree

Ensure Eviction threshold Settings Are Set - evictionSoft: imagefs.available