Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used
An XCCDF Rule
Description
Instead of using a customized SecurityContext for pods, a Pod Security
Policy (PSP) or a SecurityContextConstraint should be used. These are
cluster-level resources that control the actions that a pod can perform
and what resource the pod may access. The SecurityContextDeny
disallows folks from setting a pod's securityContext fields.
Ensure that the list of admission controllers does not include
SecurityContextDeny:
$ oc -n openshift-kube-apiserver get configmap config -o json | jq -r '.data."config.yaml"' | jq '.apiServerArguments."enable-admission-plugins"'
warning alert: Warning
-
{{if ne .hypershift_cluster "None"}}/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config{{else}}/api/v1/namespaces/openshift-kube-apiserver/configmaps/config{{end}}API endpoint, filter with with thejqutility using the following filter{{if ne .hypershift_cluster "None"}}[.data."config.json" | fromjson]{{else}}[.data."config.yaml" | fromjson]{{end}}and persist it to the local
Rationale
The SecurityContextDeny admission control plugin disallows
setting any security options for your pods. SecurityContextConstraints
allow you to enforce RBAC rules on who can set these options on the pods, and
what they're allowed to set. Thus, using the SecurityContextDeny
will deter you from enforcing granular permissions on your pods.
- ID
- xccdf_org.ssgproject.content_rule_api_server_admission_control_plugin_securitycontextdeny
- Severity
- Medium
- References
- Updated