CIS Red Hat OpenShift Container Platform 4 Benchmark
Rules and Groups employed by this XCCDF Profile
-
Ensure that the --kubelet-https argument is set to true
The kube-apiserver ensures https to the kubelet by default. The apiserver flag "--kubelet-https" is deprecated and should be either set to "true" o...Rule Medium Severity -
Disable Use of the Insecure Bind Address
OpenShift should not bind to non-loopback insecure addresses. Edit the <code>openshift-kube-apiserver</code> configmap and remove the <code>insecur...Rule Medium Severity -
Prevent Insecure Port Access
By default, traffic for the OpenShift API server is served over HTTPS with authentication and authorization, and the secure API endpoint is bound t...Rule Medium Severity -
Configure the kubelet Certificate Authority for the API Server
To ensure OpenShift verifies kubelet certificates before establishing connections, follow the OpenShift documentation and setup the TLS connection ...Rule High Severity -
Configure the kubelet Certificate File for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Capacity
Modules