I - Mission Critical Public
Rules and Groups employed by this XCCDF Profile
-
SRG-APP-000026-CTR-000070
Group -
Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.
Within Kubernetes, audit data for all components is generated by the API server. This audit data is important when there are issues, to include security incidents that must be investigated. To make...Rule Medium Severity -
SRG-APP-000133-CTR-000290
Group -
Kubernetes Kubelet must deny hostname override.
Kubernetes allows for the overriding of hostnames. Allowing this feature to be implemented within the kubelets may break the TLS setup between the kubelet service and the API server. This setting a...Rule Medium Severity -
SRG-APP-000133-CTR-000295
Group -
The Kubernetes manifests must be owned by root.
The manifest files contain the runtime configuration of the API server, proxy, scheduler, controller, and etcd. If an attacker can gain access to these files, changes can be made to open vulnerabil...Rule Medium Severity -
SRG-APP-000133-CTR-000300
Group -
The Kubernetes KubeletConfiguration file must be owned by root.
The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be made to open vulnerabilities and bypass user au...Rule Medium Severity -
SRG-APP-000133-CTR-000305
Group -
The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive.
The kubelet configuration file contains the runtime configuration of the kubelet service. If an attacker can gain access to this file, changes can be made to open vulnerabilities and bypass user au...Rule Medium Severity -
SRG-APP-000133-CTR-000310
Group -
The Kubernetes manifest files must have least privileges.
The manifest files contain the runtime configuration of the API server, scheduler, controller, and etcd. If an attacker can gain access to these files, changes can be made to open vulnerabilities a...Rule Medium Severity -
SRG-APP-000141-CTR-000315
Group -
Kubernetes Controller Manager must disable profiling.
Kubernetes profiling provides the ability to analyze and troubleshoot Controller Manager events over a web interface on a host port. Enabling this service can expose details about the Kubernetes ar...Rule Medium Severity -
SRG-APP-000142-CTR-000325
Group -
The Kubernetes API Server must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
Kubernetes API Server PPSs must be controlled and conform to the PPSM CAL. Those PPS that fall outside the PPSM CAL must be blocked. Instructions on the PPSM can be found in DoD Instruction 8551.01...Rule Medium Severity -
SRG-APP-000142-CTR-000325
Group -
The Kubernetes Scheduler must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
Kubernetes Scheduler PPS must be controlled and conform to the PPSM CAL. Those ports, protocols, and services that fall outside the PPSM CAL must be blocked. Instructions on the PPSM can be found i...Rule Medium Severity -
SRG-APP-000142-CTR-000330
Group -
The Kubernetes Controllers must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
Kubernetes Controller ports, protocols, and services must be controlled and conform to the PPSM CAL. Those PPS that fall outside the PPSM CAL must be blocked. Instructions on the PPSM can be found ...Rule Medium Severity -
SRG-APP-000142-CTR-000325
Group -
The Kubernetes etcd must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).
Kubernetes etcd PPS must be controlled and conform to the PPSM CAL. Those PPS that fall outside the PPSM CAL must be blocked. Instructions on the PPSM can be found in DoD Instruction 8551.01 Policy.Rule Medium Severity -
SRG-APP-000142-CTR-000330
Group -
The Kubernetes cluster must use non-privileged host ports for user pods.
Privileged ports are those ports below 1024 and that require system privileges for their use. If containers can use these ports, the container must be run as a privileged user. Kubernetes must stop...Rule Medium Severity -
SRG-APP-000171-CTR-000435
Group -
Secrets in Kubernetes must not be stored as environment variables.
Secrets, such as passwords, keys, tokens, and certificates should not be stored as environment variables. These environment variables are accessible inside Kubernetes by the "Get Pod" API call, and...Rule High Severity -
SRG-APP-000211-CTR-000530
Group -
Kubernetes must separate user functionality.
Separating user functionality from management functionality is a requirement for all the components within the Kubernetes Control Plane. Without the separation, users may have access to management ...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
The Kubernetes API server must use approved cipher suites.
The Kubernetes API server communicates to the kubelet service on the nodes to deploy, update, and delete resources. If an attacker were able to get between this communication and modify the request...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes API Server must have the SSL Certificate Authority set.
Kubernetes control plane and external communication are managed by API Server. The main implementation of the API Server is to manage hardware resources for pods and containers using horizontal or ...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes Kubelet must have the SSL Certificate Authority set.
Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and perform health checks for containers and pods. Any...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes Controller Manager must have the SSL Certificate Authority set.
The Kubernetes Controller Manager is responsible for creating service accounts and tokens for the API Server, maintaining the correct number of pods for every replication controller and provides no...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes API Server must have a certificate for communication.
Kubernetes control plane and external communication is managed by API Server. The main implementation of the API Server is to manage hardware resources for pods and container using horizontal or ve...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes etcd must enable client authentication to secure service.
Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and perform health checks for containers and pods. Any...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes Kubelet must enable tlsPrivateKeyFile for client authentication to secure service.
Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and perform health checks for containers and pods. Any...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes Kubelet must enable tlsCertFile for client authentication to secure service.
Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and perform health checks for containers and pods. Any...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes etcd must enable client authentication to secure service.
Kubernetes container and pod configuration are maintained by Kubelet. Kubelet agents register nodes with the API Server, mount volume storage, and perform health checks for containers and pods. Any...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes etcd must have a key file for secure communication.
Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively control the Kubernetes cluster. Even just reading th...Rule Medium Severity -
SRG-APP-000219-CTR-000550
Group -
Kubernetes etcd must have a certificate for communication.
Kubernetes stores configuration and state information in a distributed key-value store called etcd. Anyone who can write to etcd can effectively control a Kubernetes cluster. Even just reading the ...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.