Skip to content
ATO Pathways
  Log In

CIS Red Hat OpenShift Container Platform 4 Benchmark

Rules and Groups employed by this XCCDF Profile

  • Configure the Service Account Certificate Authority Key for the Controller Manager

    To ensure the API Server utilizes its own key pair, set the <code>masterCA</code> parameter to the public key file for service accounts in the <cod...
    Rule Medium Severity
    Show

  • Configure the Service Account Private Key for the Controller Manager

    To ensure the API Server utilizes its own key pair, set the <code>privateKeyFile</code> parameter to the public key file for service accounts in th...
    Rule Medium Severity
    Show

  • Ensure that use-service-account-credentials is enabled

    To ensure individual service account credentials are used, set the <code>use-service-account-credentials</code> option to <code>true</code> in the ...
    Rule Medium Severity
    Show

  • OpenShift etcd Settings

    Contains rules that check correct OpenShift etcd settings.
    Group
    Show

  • Disable etcd Self-Signed Certificates

    To ensure the <code>etcd</code> service is not using self-signed certificates, run the following command: <pre>$ oc get cm/etcd-pod -n openshift-et...
    Rule Medium Severity
    Show

  • Ensure That The etcd Client Certificate Is Correctly Set

    To ensure the etcd service is serving TLS to clients, make sure the <code>etcd-pod*</code> ConfigMaps in the <code>openshift-etcd</code> namespace ...
    Rule Medium Severity
    Show

  • Enable The Client Certificate Authentication

    To ensure the <code>etcd</code> service is serving TLS to clients, make sure the <code>etcd-pod*</code> <code>ConfigMaps</code> in the <code>opensh...
    Rule Medium Severity
    Show

  • Ensure That The etcd Key File Is Correctly Set

    To ensure the etcd service is serving TLS to clients, make sure the <code>etcd-pod*</code> ConfigMaps in the <code>openshift-etcd</code> namespace ...
    Rule Medium Severity
    Show

  • Disable etcd Peer Self-Signed Certificates

    To ensure the <code>etcd</code> service is not using self-signed certificates, run the following command: <pre>$ oc get cm/etcd-pod -n openshift-et...
    Rule Medium Severity
    Show

  • Ensure That The etcd Peer Client Certificate Is Correctly Set

    To ensure the etcd service is serving TLS to peers, make sure the <code>etcd-pod*</code> ConfigMaps in the <code>openshift-etcd</code> namespace co...
    Rule Medium Severity
    Show

  • Enable The Peer Client Certificate Authentication

    To ensure the <code>etcd</code> service is serving TLS to clients, make sure the <code>etcd-pod*</code> <code>ConfigMaps</code> in the <code>opensh...
    Rule Medium Severity
    Show

  • Ensure That The etcd Peer Key File Is Correctly Set

    To ensure the etcd service is serving TLS to peers, make sure the <code>etcd-pod*</code> ConfigMaps in the <code>openshift-etcd</code> namespace co...
    Rule Medium Severity
    Show

  • Kubernetes - General Security Practices

    Contains evaluations for general security practices for operating a Kubernetes environment.
    Group
    Show

  • Apply Security Context to Your Pods and Containers

    Apply Security Context to your Pods and Containers
    Rule Medium Severity
    Show

  • The default namespace should not be used

    Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes ap...
    Rule Medium Severity
    Show

  • Ensure Seccomp Profile Pod Definitions

    Enable default seccomp profiles in your pod definitions.
    Rule Medium Severity
    Show

  • Create administrative boundaries between resources using namespaces

    Use namespaces to isolate your Kubernetes objects.
    Rule Medium Severity
    Show

  • Ensure that the kubeadmin secret has been removed

    The kubeadmin user is meant to be a temporary user used for bootstrapping purposes. It is preferable to assign system administrators whose users ar...
    Rule Medium Severity
    Show

  • This is a helper rule to fetch the required api resource for detecting HyperShift OCP version

    no description
    Rule Medium Severity
    Show

  • This is a helper rule to fetch the required api resource for detecting OCP version

    no description
    Rule Medium Severity
    Show

  • Kubernetes Kubelet Settings

    The Kubernetes Kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod. The kubelet takes a ...
    Group
    Show

  • Ensure That The kubelet Client Certificate Is Correctly Set

    To ensure the kubelet TLS client certificate is configured, edit the kubelet configuration file <code>/etc/kubernetes/kubelet.conf</code> and confi...
    Rule Medium Severity
    Show

  • Ensure That The kubelet Server Key Is Correctly Set

    To ensure the kubelet TLS private server key certificate is configured, edit the kubelet configuration file <code>/etc/kubernetes/kubelet.conf</cod...
    Rule Medium Severity
    Show

  • kubelet - Disable the Read-Only Port

    To disable the read-only port, edit the kubelet configuration Edit the <code>openshift-kube-apiserver</code> configmap and set the <code>kubelet-re...
    Rule Medium Severity
    Show

  • OpenShift - Logging Settings

    Contains evaluations for the cluster's logging configuration settings.
    Group
    Show

  • Ensure that the cluster's audit profile is properly set

    <p> OpenShift can audit the details of requests made to the API server through the standard Kubernetes audit capabilities. </p> ...
    Rule Medium Severity
    Show

  • Kubernetes - Network Configuration and Firewalls

    Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses th...
    Group
    Show

  • Ensure that the CNI in use supports Network Policies

    There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectiv...
    Rule High Severity
    Show

  • Ensure that HyperShift Hosted Namespaces have Network Policies defined.

    Use network policies to isolate traffic in your cluster network.
    Rule High Severity
    Show

  • Ensure that application Namespaces have Network Policies defined.

    Use network policies to isolate traffic in your cluster network.
    Rule High Severity
    Show

  • OpenShift API Server

    This section contains recommendations for openshift-apiserver configuration.
    Group
    Show

  • Configure the OpenShift API Server Maximum Retained Audit Logs

    To configure how many rotations of audit logs are retained, edit the <code>openshift-apiserver</code> configmap and set the <code>audit-log-maxback...
    Rule Low Severity
    Show

  • Configure OpenShift API Server Maximum Audit Log Size

    To rotate audit logs upon reaching a maximum size, edit the <code>openshift-apiserver</code> configmap and set the <code>audit-log-maxsize</code> p...
    Rule Medium Severity
    Show

  • Configure the Audit Log Path

    To enable auditing on the OpenShift API Server, the audit log path must be set. Edit the <code>openshift-apiserver</code> configmap and set the <co...
    Rule High Severity
    Show

  • Role-based Access Control

    Role-based access control (RBAC) objects determine whether a user is allowed to perform a given action within a project. Cluster administrators ca...
    Group
    Show

  • Profiling is protected by RBAC

    Ensure that the cluster-debugger cluster role includes the /debug/pprof resource URL. This demonstrates that profiling is protected by RBAC, with a...
    Rule Medium Severity
    Show

  • Ensure that the RBAC setup follows the principle of least privilege

    Role-based access control (RBAC) objects determine whether a user is allowed to perform a given action within a project. If users or groups exist ...
    Rule High Severity
    Show

  • Ensure that the cluster-admin role is only used where required

    The RBAC role cluster-admin provides wide-ranging powers over the environment and should be used only where and when needed.
    Rule Medium Severity
    Show

  • Limit Access to Kubernetes Secrets

    The Kubernetes API stores secrets, which may be service account tokens for the Kubernetes API or credentials used by workloads in the cluster. Acce...
    Rule Medium Severity
    Show

  • Minimize Access to Pod Creation

    The ability to create pods in a namespace can provide a number of opportunities for privilege escalation. Where applicable, remove <code>create</co...
    Rule Medium Severity
    Show

  • Minimize Wildcard Usage in Cluster and Local Roles

    Kubernetes Cluster and Local Roles provide access to resources based on sets of objects and actions that can be taken on those objects. It is possi...
    Rule Medium Severity
    Show

  • Kubernetes - Registry Security Practices

    Contains evaluations for Kubernetes registry security practices, and cluster-wide registry configuration.
    Group
    Show

  • Allowed registries are configured

    The configuration <code>registrySources.allowedRegistries</code> determines the permitted registries that the OpenShift container runtime can acces...
    Rule Medium Severity
    Show

  • Allowed registries for import are configured

    The configuration <code>allowedRegistriesForImport</code> limits the container image registries from which normal users may import images. This is ...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules