Verify Group Who Owns The OpenShift PKI Private Key Files
An XCCDF Rule
Description
To properly set the group owner of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command:
$ sudo chgrp root /etc/kubernetes/static-pod-resources/*/*/*/*.key
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Kubernetes Control Plane.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
OpenShift makes use of a number of certificates as part of its operation. You should verify the ownership of the directory containing the PKI information and all files in that directory to maintain their integrity. The directory and files should be owned by root:root.
- ID
- xccdf_org.ssgproject.content_rule_file_groupowner_openshift_pki_key_files
- Severity
- Medium
- References
- Updated