Enable the SecurityContextConstraint Admission Control Plugin
An XCCDF Rule
Description
To ensure pod permissions are managed, make sure that the
SecurityContextConstraint admission control plugin is used.
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the following:
-
{{if ne .hypershift_cluster "None"}}/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config{{else}}/api/v1/namespaces/openshift-kube-apiserver/configmaps/config{{end}}API endpoint, filter with with thejqutility using the following filter{{if ne .hypershift_cluster "None"}}.data."config.json" | fromjson{{else}}.data."config.yaml" | fromjson{{end}}and persist it to the local
Rationale
A Security Context Constraint is a cluster-level resource that controls the actions
which a pod can perform and what the pod may access. The
SecurityContextConstraint objects define a set of conditions that a pod
must run with in order to be accepted into the system. Security Context Constraints
are comprised of settings and strategies that control the security features
a pod has access to and hence this must be used to control pod access
permissions.
- ID
- xccdf_org.ssgproject.content_rule_api_server_admission_control_plugin_scc
- Severity
- Medium
- References
- Updated