Skip to content
Log In

Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Verify Permissions on the pod log files

    All logs must be owned by root user and group and have permissions 755. By default, the path for the Kubernetes pod logs is 
    /var/log/pods/
    .
    Rule Medium Severity
    Show

  • Apply Security Context to Your Pods and Containers

    Apply Security Context to your Pods and Containers
    Rule Medium Severity
    Show

  • The default namespace should not be used

    Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.
    Rule Medium Severity
    Show

  • Ensure Seccomp Profile Pod Definitions

    Enable default seccomp profiles in your pod definitions.
    Rule Medium Severity
    Show

  • Create administrative boundaries between resources using namespaces

    Use namespaces to isolate your Kubernetes objects.
    Rule Medium Severity
    Show

  • Ensure that GitOps Operator is deployed

    Red Hat OpenShift GitOps is a declarative continuous delivery platform based on Argo CD. It enables teams to adopt GitOps principles for managing cluster configurations and automating secure and re...
    Rule Medium Severity
    Show

  • Ensure that the kubeadmin secret has been removed

    The kubeadmin user is meant to be a temporary user used for bootstrapping purposes. It is preferable to assign system administrators whose users are backed by an Identity Provider. <br> Make sure ...
    Rule Medium Severity
    Show

  • Ensure that the OpenShift OAuth login template is set

    A legal notice can be configured via a customized login template. <br> This is achievable via the OAuth object by creating a custom login page, storing it in a Kubernetes Secret and referencing it...
    Rule Medium Severity
    Show

  • Ensure that the OpenShift OAuth provider selection is set

    Custom login pages can be helpful to show users a branded page that they trust and expect before being redirected to the authentication provider. <br> This is achievable via the OAuth object by cr...
    Rule Medium Severity
    Show

  • Ensure That The kubelet Client Certificate Is Correctly Set

    To ensure the kubelet TLS client certificate is configured, edit the kubelet configuration file <code>/etc/kubernetes/kubelet.conf</code> and configure the kubelet certificate file. <pre>tlsCertFil...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules