Skip to content
ATO Pathways
  Log In

Guide to the Secure Configuration of Red Hat OpenShift Container Platform 4

Rules, Groups, and Values defined within the XCCDF Benchmark

  • OpenShift - Risk Assessment Settings

    Contains evaluations for the cluster's risk assessment configuration settings.
    Group
    Show

  • Verify User Who Owns the Worker Certificate Authority File

    To properly set the owner of <code>/etc/kubernetes/kubelet-ca.crt</code>, run the command: <pre>$ sudo chown root /etc/kubernetes/kubelet-ca.crt <...
    Rule Medium Severity
    Show

  • Make sure the Container Security Operator is installed

    <p> Using the Red Hat Quay Container Security Operator, you can access vulnerability scan results from the OpenShift Container Platf...
    Rule Medium Severity
    Show

  • Ensure that Compliance Operator is scanning the cluster

    <a href="https://docs.openshift.com/container-platform/latest/security/compliance_operator/compliance-operator-understanding.html#compliance-operat...
    Rule Medium Severity
    Show

  • Ensure that Compliance Operator scans are running periodically

    <a href="https://docs.openshift.com/container-platform/latest/security/compliance_operator/compliance-operator-understanding.html#compliance-operat...
    Rule Medium Severity
    Show

  • Security Context Constraints (SCC)

    Similar to the way that RBAC resources control user access, administrators can use Security Context Constraints (SCCs) to control permissions for p...
    Group
    Show

  • Permitted SCCs with allowedCapabilities

    A regular expression that lists all SCCs that are permitted to set the allowedCapabilities attribute
    Value
    Show

  • Drop Container Capabilities

    Containers should not enable more capabilities than needed as this opens the door for malicious use. To disable the capabilities, the appropriate S...
    Rule Medium Severity
    Show

  • Limit Container Capabilities

    <p> Containers should not enable more capabilites than needed as this opens the door for malicious use. To enable only the required ...
    Rule Medium Severity
    Show

  • Limit Containers Ability to use the HostDir volume plugin

    Containers should be allowed to use the <code>hostPath</code> volume type unless necessary. To prevent containers from using the host filesystem th...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules