BSI IT-Grundschutz (Basic Protection) Building Block SYS.1.6 and APP.4.4
Rules and Groups employed by this XCCDF Profile
-
Limit Access to the Host Process ID Namespace
Containers should not be allowed access to the host's process ID namespace. To prevent containers from getting access to a host's process ID namesp...Rule Medium Severity -
Limit Container Running As Root User
Containers should run as a random non-privileged user. To prevent containers from running as root user, the appropriate Security Context Constraint...Rule Medium Severity -
Kubernetes Secrets Management
Secrets let you store and manage sensitive information, such as passwords, OAuth tokens, and ssh keys. Such information might otherwise be put in a...Group -
Consider external secret storage
Consider the use of an external secrets storage and management system, instead of using Kubernetes Secrets directly, if you have more complex secre...Rule Medium Severity -
Do Not Use Environment Variables with Secrets
Secrets should be mounted as data volumes instead of environment variables.Rule Medium Severity -
Ensure no ClusterRoleBindings set for default Service Account
Using the <code>default</code> service account prevents accurate application rights review and audit tracing. Instead of <code>default</code>, crea...Rule Medium Severity -
Ensure no RoleBindings set for default Service Account
Using the <code>default</code> service account prevents accurate application rights review and audit tracing. Instead of <code>default</code>, crea...Rule Medium Severity -
OpenShift - Confinement
Contains evaluations to configure and assess the confinement of the cluster's applications and workloads.Group -
Make sure the Security Profiles Operator is installed
Security Profiles Operator provides a way to define secure computing (seccomp) profiles and SELinux profiles as custom resources that are syncrhoni...Rule Medium Severity -
Configure Recurring Backups For etcd
<p> Back up your clusters etcd data regularly and store in a secure location ideally outside the OpenShift Container Platform enviro...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Capacity
Modules