BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4
Rules and Groups employed by this XCCDF Profile
-
Ensure That The kubelet Server Key Is Correctly Set
To ensure the kubelet TLS private server key certificate is configured, edit the kubelet configuration file <code>/etc/kubernetes/kubelet.conf</cod...Rule Medium Severity -
Kubernetes - Network Configuration and Firewalls
Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses th...Group -
Ensure that the CNI in use supports Network Policies
There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectiv...Rule High Severity -
Ensure that application Namespaces have Network Policies defined.
Use network policies to isolate traffic in your cluster network.Rule High Severity -
Ensure that project templates autocreate Network Policies
Configure a template for newly created projects to use default network policies and make sure this template is referenced from the default project ...Rule Medium Severity -
Role-based Access Control
Role-based access control (RBAC) objects determine whether a user is allowed to perform a given action within a project. Cluster administrators ca...Group -
Ensure cluster roles are defined in the cluster
<p> RBAC is a critical feature in terms of security for Kubernetes and OpenShift. It enables administrators to segment the privilege...Rule Medium Severity -
Ensure that the RBAC setup follows the principle of least privilege
Role-based access control (RBAC) objects determine whether a user is allowed to perform a given action within a project. If users or groups exist ...Rule High Severity -
Ensure that the cluster-admin role is only used where required
The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed.Rule Medium Severity -
Limit Access to Kubernetes Secrets
The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Acce...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.