Disable the AlwaysAdmit Admission Control Plugin
An XCCDF Rule
Description
To ensure OpenShift only responses to requests explicitly allowed by the
admission control plugin. Check that the config ConfigMap object does not
contain the AlwaysAdmit plugin.
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
{{if ne .hypershift_cluster "None"}}/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config{{else}}/api/v1/namespaces/openshift-kube-apiserver/configmaps/config{{end}}API endpoint, filter with with thejqutility using the following filter{{if ne .hypershift_cluster "None"}}[.data."config.json" | fromjson]{{else}}[.data."config.yaml" | fromjson]{{end}}and persist it to the local
Rationale
Enabling the admission control plugin AlwaysAdmit allows all
requests and does not provide any filtering.
- ID
- xccdf_org.ssgproject.content_rule_api_server_admission_control_plugin_alwaysadmit
- Severity
- Medium
- References
- Updated