Verify Group Who Owns The Kubernetes Scheduler Pod Specification File
An XCCDF Rule
Description
To properly set the group owner of /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml, run the command:
$ sudo chgrp root /etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/kube-scheduler-pod.yaml
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Kubernetes Scheduler service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
The Kubernetes Specification file contains information about the configuration of the Kubernetes scheduler that is configured on the system. Protection of this file is critical for OpenShift security.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_kube_scheduler
- Severity
- Medium
- References
- Updated