Verify Permissions on the OpenShift PKI Private Key Files
An XCCDF Rule
Description
To properly set the permissions of /etc/kubernetes/static-pod-resources/*/*/*/*.key, run the command:
$ sudo chmod 0600 /etc/kubernetes/static-pod-resources/*/*/*/*.key
warning alert: Dependency Warning
This rule is only applicable for nodes that run the Kubernetes Control Plane.
The aforementioned service is only running on the nodes labeled
"master" by default.
Rationale
OpenShift makes use of a number of key files as part of the operation of its components. The permissions on these files should be set to
600to protect their integrity and confidentiality.
- ID
- xccdf_org.ssgproject.content_rule_file_permissions_openshift_pki_key_files
- Severity
- Medium
- References
- Updated