Ensure that all OpenShift Routes prefer TLS
An XCCDF Rule
Description
OpenShift Container Platform provides methods for communicating from
outside the cluster with services running in the cluster. TLS must
be used to protect these communications. OpenShift
Routes provide the ability to configure the needed TLS settings. With
these, one is able to configure that any request coming from the outside
must use TLS. To verify this, ensure that every Route in the system
has a policy of Disable or Redirect to ensure a
secure endpoint is used. The aforementioned policy will be set in
a Routes .spec.tls.insecureEdgeTerminationPolicy setting.
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
/apis/route.openshift.io/v1/routesAPI endpoint, filter with with thejqutility using the following filter[.items[] | select(.spec.tls.insecureEdgeTerminationPolicy != null) | select(.spec.tls.insecureEdgeTerminationPolicy | test("^(^$|None|Redirect)$"; "") | not) | .metadata.name]and persist it to the local
Rationale
Using clear-text in communications coming to or from outside the cluster's network may leak sensitive information.
- ID
- xccdf_org.ssgproject.content_rule_routes_protected_by_tls
- Severity
- Medium
- References
- Updated