Profiling is protected by RBAC
An XCCDF Rule
Description
Ensure that the cluster-debugger cluster role includes the /metrics resource URL. This demonstrates that profiling is protected by RBAC, with a specific cluster role to allow access.
warning alert: Warning
This rule's check operates on the cluster configuration dump.
Therefore, you need to use a tool that can query the OCP API, retrieve the
/apis/rbac.authorization.k8s.io/v1/clusterroles/cluster-debugger API endpoint to the local Rationale
Profiling allows for the identification of specific performance bottlenecks. It generates a significant amount of program data that could potentially be exploited to uncover system and program details. To ensure the collected data is not exploited, profiling endpoints are secured via RBAC (see cluster-debugger role). By default, the profiling endpoints are accessible only by users bound to cluster-admin or cluster-debugger role. Profiling can not be disabled.
- ID
- xccdf_org.ssgproject.content_rule_api_server_profiling_protected_by_rbac
- Severity
- Medium
- References
- Updated