Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure roles are defined in the cluster

    <p> RBAC is a critical feature in terms of security for Kubernetes and OpenShift. It enables administrators to segment the privilege...
    Rule Medium Severity
    Show

  • Minimize Wildcard Usage in Cluster and Local Roles

    Kubernetes Cluster and Local Roles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possi...
    Rule Medium Severity
    Show

  • Kubernetes - Registry Security Practices

    Contains evaluations for Kubernetes registry security practices, and cluster-wide registry configuration.
    Group
    Show

  • Limit Access to the Host IPC Namespace

    Containers should not be allowed access to the host's Interprocess Communication (IPC) namespace. To prevent containers from getting access to a ho...
    Rule Medium Severity
    Show

  • Configure ImagePruner so that images that are no longer needed are automatically removed

    <p> Images from the internal registry that are no longer required by the system due to age, status, or exceed limits are automatical...
    Rule Medium Severity
    Show

  • All configured ImageStreams are configured to periodically check for updates

    <p> The configuration <code>imagestream.spec.tags.importPolicy.scheduled</code> determines whether the imagestream is configured to ...
    Rule Medium Severity
    Show

  • Allowed registries are configured

    The configuration <code>registrySources.allowedRegistries</code> determines the permitted registries that the OpenShift container runtime can acces...
    Rule Medium Severity
    Show

  • Allowed registries for import are configured

    The configuration <code>allowedRegistriesForImport</code> limits the container image registries from which normal users may import images. This is ...
    Rule Medium Severity
    Show

  • Check configured allowed registries for import uses secure protocol

    The configuration <code>allowedRegistriesForImport</code> limits the container image registries from which normal users may import images. This is ...
    Rule Medium Severity
    Show

  • Check if any insecure registry sources is configured

    The configuration <code>registrySources.insecureRegistries</code> determines the insecure registries that the OpenShift container runtime can acces...
    Rule Medium Severity
    Show

  • OpenShift - Risk Assessment Settings

    Contains evaluations for the cluster's risk assessment configuration settings.
    Group
    Show

  • Verify User Who Owns the Worker Certificate Authority File

    To properly set the owner of <code>/etc/kubernetes/kubelet-ca.crt</code>, run the command: <pre>$ sudo chown root /etc/kubernetes/kubelet-ca.crt <...
    Rule Medium Severity
    Show

  • Make sure the Container Security Operator is installed

    <p> Using the Red Hat Quay Container Security Operator, you can access vulnerability scan results from the OpenShift Container Platf...
    Rule Medium Severity
    Show

  • Ensure that Compliance Operator is scanning the cluster

    <a href="https://docs.openshift.com/container-platform/latest/security/compliance_operator/compliance-operator-understanding.html#compliance-operat...
    Rule Medium Severity
    Show

  • Ensure that Compliance Operator scans are running periodically

    <a href="https://docs.openshift.com/container-platform/latest/security/compliance_operator/compliance-operator-understanding.html#compliance-operat...
    Rule Medium Severity
    Show

  • Security Context Constraints (SCC)

    Similar to the way that RBAC resources control user access, administrators can use Security Context Constraints (SCCs) to control permissions for p...
    Group
    Show

  • Permitted SCCs with allowedCapabilities

    A regular expression that lists all SCCs that are permitted to set the allowedCapabilities attribute
    Value
    Show

  • Drop Container Capabilities

    Containers should not enable more capabilities than needed as this opens the door for malicious use. To disable the capabilities, the appropriate S...
    Rule Medium Severity
    Show

  • Limit Container Capabilities

    <p> Containers should not enable more capabilites than needed as this opens the door for malicious use. To enable only the required ...
    Rule Medium Severity
    Show

  • Limit Containers Ability to use the HostDir volume plugin

    Containers should be allowed to use the <code>hostPath</code> volume type unless necessary. To prevent containers from using the host filesystem th...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules