Skip to content
Log In

Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • Ensure that LUKS is configured on worker nodes

    OpenShift has an installation-time flag that can enable LUKS (TPM2 or TANG) full disk encryption at installation. The object <pre>luks</pre> must be present at install time in the <pre>machineconfi...
    Rule High Severity
    Show

  • Ensure that full disk encryption is configured on cluster nodes

    When full disk encryption is chosen as a way to protect card data at rest, OpenShift can provide several solutions depending on the hosting environment. While LUKS (with TPM2 or Tang) can be used ...
    Rule High Severity
    Show

  • Ensure that EBS volumes declared in storageclasses are encrypted

    OpenShift StorageClasses can be configured to enable EBS encryption on EBS volumes that are used later as persistent volumes. By using EBS encryption, disk contents are encrypted using an AWS KMS key.
    Rule High Severity
    Show

  • Kubernetes - Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which that account has access. The same idea applies to...
    Group
    Show

  • Restrict Automounting of Service Account Tokens

    Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API server. To ensure pods do not automatically mount tok...
    Rule Medium Severity
    Show

  • OpenShift Kube API Server

    This section contains recommendations for kube-apiserver configuration.
    Group
    Show

  • API Server Request Timeout

    Enter API Server Request Timeout
    Value
    Show

  • Bind Address of secure API endpoint

    Bind Address of secure API endpoint
    Value
    Show

  • OpenShift Kube APIServer client CA

    OpenShift Kube APIServer client CA
    Value
    Show

  • OpenShift Kube APIServer etcd CA

    OpenShift Kube APIServer etcd CA
    Value
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules