Verify User Who Owns The OpenShift Controller Manager Kubeconfig File
An XCCDF Rule
Description
To properly set the owner of /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig, run the command:
$ sudo chown root /etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/configmaps/controller-manager-kubeconfig/kubeconfig
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Kubernetes Controller Manager service.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
The Controller Manager's kubeconfig contains information about how the component will access the API server. You should set its file ownership to maintain the integrity of the file.
- ID
- xccdf_org.ssgproject.content_rule_file_owner_controller_manager_kubeconfig
- Severity
- Medium
- References
- Updated