Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure that the --kubelet-https argument is set to true

    The kube-apiserver ensures https to the kubelet by default. The apiserver flag "--kubelet-https" is deprecated and should be either set to "true" o...
    Rule Medium Severity
    Show

  • Disable Use of the Insecure Bind Address

    OpenShift should not bind to non-loopback insecure addresses. Edit the <code>openshift-kube-apiserver</code> configmap and remove the <code>insecur...
    Rule Medium Severity
    Show

  • Profiling is protected by RBAC

    Ensure that the cluster-debugger cluster role includes the /metrics resource URL. This demonstrates that profiling is protected by RBAC, with a spe...
    Rule Medium Severity
    Show

  • Prevent Insecure Port Access

    By default, traffic for the OpenShift API server is served over HTTPS with authentication and authorization, and the secure API endpoint is bound t...
    Rule Medium Severity
    Show

  • Configure the kubelet Certificate Authority for the API Server

    To ensure OpenShift verifies kubelet certificates before establishing connections, follow the OpenShift documentation and setup the TLS connection ...
    Rule High Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules