Skip to content
ATO Pathways
  Log In

CIS Red Hat OpenShift Container Platform 4 Benchmark

Rules and Groups employed by this XCCDF Profile

  • Kubernetes Settings

    Each section of this configuration guide includes information about the configuration of a Kubernetes cluster and a set of recommendations for hard...
    Group
    Show

  • Kubernetes - Account and Access Control

    In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...
    Group
    Show

  • Restrict Automounting of Service Account Tokens

    Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API ser...
    Rule Medium Severity
    Show

  • Ensure Usage of Unique Service Accounts

    Using the <code>default</code> service account prevents accurate application rights review and audit tracing. Instead of <code>default</code>, crea...
    Rule Medium Severity
    Show

  • OpenShift Kube API Server

    This section contains recommendations for kube-apiserver configuration.
    Group
    Show

  • Disable the AlwaysAdmit Admission Control Plugin

    To ensure OpenShift only responses to requests explicitly allowed by the admission control plugin. Check that the <code>config</code> ConfigMap obj...
    Rule Medium Severity
    Show

  • Ensure that the Admission Control Plugin AlwaysPullImages is not set

    The <code>AlwaysPullImages</code> admission control plugin should be disabled, since it can introduce new failure modes for control plane component...
    Rule High Severity
    Show

  • Enable the NamespaceLifecycle Admission Control Plugin

    OpenShift enables the NamespaceLifecycle plugin by default.
    Rule Medium Severity
    Show

  • Enable the NodeRestriction Admission Control Plugin

    To limit the <code>Node</code> and <code>Pod</code> objects that a kubelet could modify, ensure that the <code>NodeRestriction</code> plugin on kub...
    Rule Medium Severity
    Show

  • Enable the SecurityContextConstraint Admission Control Plugin

    To ensure pod permissions are managed, make sure that the SecurityContextConstraint admission control plugin is used.
    Rule Medium Severity
    Show

  • Enable the ServiceAccount Admission Control Plugin

    To ensure <code>ServiceAccount</code> objects must be created and granted before pod creation is allowed, follow the documentation and create <code...
    Rule Medium Severity
    Show

  • Ensure that anonymous requests to the API Server are authorized

    By default, anonymous access to the OpenShift API is enabled, but at the same time, all requests must be authorized. If no authentication mechanism...
    Rule Medium Severity
    Show

  • Enable the APIPriorityAndFairness feature gate

    To limit the rate at which the API Server accepts requests, make sure that the API Priority and Fairness feature is enabled. Using <code>APIPriorit...
    Rule Medium Severity
    Show

  • Configure the Kubernetes API Server Maximum Retained Audit Logs

    To configure how many rotations of audit logs are retained, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>audit-log-ma...
    Rule Low Severity
    Show

  • Configure Kubernetes API Server Maximum Audit Log Size

    To rotate audit logs upon reaching a maximum size, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>audit-log-maxsize</co...
    Rule Medium Severity
    Show

  • Configure the Audit Log Path

    To enable auditing on the Kubernetes API Server, the audit log path must be set. Edit the <code>openshift-kube-apiserver</code> configmap and set t...
    Rule High Severity
    Show

  • The authorization-mode cannot be AlwaysAllow

    Do not always authorize all requests.
    Rule Medium Severity
    Show

  • Ensure authorization-mode RBAC is configured

    To ensure OpenShift restricts different identities to a defined set of operations they are allowed to perform, check that the API server's <code>au...
    Rule Medium Severity
    Show

  • Disable basic-auth-file for the API Server

    Basic Authentication should not be used for any reason. If needed, edit API Edit the <code>openshift-kube-apiserver</code> configmap and remove the...
    Rule Medium Severity
    Show

  • Ensure that the bindAddress is set to a relevant secure port

    The bindAddress is set by default to 0.0.0.0:6443, and listening with TLS enabled.
    Rule Low Severity
    Show

  • Configure the Client Certificate Authority for the API Server

    Certificates must be provided to fully setup TLS client certificate authentication. To ensure the API Server utilizes its own TLS certificates, the...
    Rule Medium Severity
    Show

  • Configure the Encryption Provider Cipher

    <p> When you enable etcd encryption, the following OpenShift API server and Kubernetes API server resources are encrypted: <ul> <li>...
    Rule Medium Severity
    Show

  • Configure the etcd Certificate Authority for the API Server

    To ensure etcd is configured to make use of TLS encryption for client connections, follow the OpenShift documentation and setup the TLS connection ...
    Rule Medium Severity
    Show

  • Configure the etcd Certificate for the API Server

    To ensure etcd is configured to make use of TLS encryption for client communications, follow the OpenShift documentation and setup the TLS connecti...
    Rule Medium Severity
    Show

  • Configure the etcd Certificate Key for the API Server

    To ensure etcd is configured to make use of TLS encryption for client communications, follow the OpenShift documentation and setup the TLS connecti...
    Rule Medium Severity
    Show

  • Ensure that the --kubelet-https argument is set to true

    The kube-apiserver ensures https to the kubelet by default. The apiserver flag "--kubelet-https" is deprecated and should be either set to "true" o...
    Rule Medium Severity
    Show

  • Disable Use of the Insecure Bind Address

    OpenShift should not bind to non-loopback insecure addresses. Edit the <code>openshift-kube-apiserver</code> configmap and remove the <code>insecur...
    Rule Medium Severity
    Show

  • Prevent Insecure Port Access

    By default, traffic for the OpenShift API server is served over HTTPS with authentication and authorization, and the secure API endpoint is bound t...
    Rule Medium Severity
    Show

  • Configure the kubelet Certificate Authority for the API Server

    To ensure OpenShift verifies kubelet certificates before establishing connections, follow the OpenShift documentation and setup the TLS connection ...
    Rule High Severity
    Show

  • Configure the kubelet Certificate File for the API Server

    To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...
    Rule High Severity
    Show

  • Configure the kubelet Certificate File for the API Server

    To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...
    Rule High Severity
    Show

  • Configure the kubelet Certificate Key for the API Server

    To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...
    Rule High Severity
    Show

  • Configure the kubelet Certificate Key for the API Server

    To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...
    Rule High Severity
    Show

  • Ensure the openshift-oauth-apiserver service uses TLS

    By default, the OpenShift OAuth API Server uses TLS. HTTPS should be used for connections between openshift-oauth-apiserver and kube-apiserver. By ...
    Rule Medium Severity
    Show

  • Ensure the openshift-oauth-apiserver service uses TLS

    By default, the OpenShift API Server uses TLS. HTTPS should be used for connections between openshift-apiserver and kube-apiserver. By default, the...
    Rule Medium Severity
    Show

  • Profiling is protected by RBAC

    Ensure that the cluster-debugger cluster role includes the /metrics resource URL. This demonstrates that profiling is protected by RBAC, with a spe...
    Rule Medium Severity
    Show

  • Configure the API Server Minimum Request Timeout

    The API server minimum request timeout defines the minimum number of seconds a handler must keep a request open before timing it out. To set this, ...
    Rule Medium Severity
    Show

  • Ensure that the service-account-lookup argument is set to true

    Validate service account before validating token.
    Rule Medium Severity
    Show

  • Configure the Service Account Public Key for the API Server

    To ensure the API Server utilizes its own key pair, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>serviceAccountPublic...
    Rule Medium Severity
    Show

  • Configure the Certificate for the API Server

    To ensure the API Server utilizes its own TLS certificates, the <code>tls-cert-file</code> must be configured. Verify that the <code>apiServerArgum...
    Rule Medium Severity
    Show

  • Use Strong Cryptographic Ciphers on the API Server

    To ensure that the API Server is configured to only use strong cryptographic ciphers, verify the <code>openshift-kube-apiserver</code> configmap co...
    Rule Medium Severity
    Show

  • Configure the Certificate Key for the API Server

    To ensure the API Server utilizes its own TLS certificates, the <code>tls-private-key-file</code> must be configured. Verify that the <code>apiServ...
    Rule Medium Severity
    Show

  • Disable Token-based Authentication

    To ensure OpenShift does not accept token-based authentication, follow the OpenShift documentation and configure alternate mechanisms for authentic...
    Rule High Severity
    Show

  • Ensure that Audit Log Forwarding Is Enabled

    OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default and the best practice is to ship a...
    Rule Medium Severity
    Show

  • Ensure that Audit Log Webhook Is Configured

    Audit is on by default and the best practice is to ship audit logs off an cluster for retention. HyperShift is able to do this with the a audit web...
    Rule Medium Severity
    Show

  • Authentication

    In cloud workloads, there are many ways to create and configure to multiple authentication services. Some of these authentication methods by not be...
    Group
    Show

  • Configure An Identity Provider

    <p> For users to interact with OpenShift Container Platform, they must first authenticate to the cluster. The authentication layer i...
    Rule Medium Severity
    Show

  • OpenShift Controller Settings

    This section contains recommendations for the kube-controller-manager configuration
    Group
    Show

  • Ensure Controller insecure port argument is unset

    To ensure the Controller Manager service is bound to secure loopback address and a secure port, set the <code>RotateKubeletServerCertificate</code>...
    Rule Low Severity
    Show

  • Ensure Controller secure-port argument is set

    To ensure the Controller Manager service is bound to secure loopback address using a secure port, set the <code>RotateKubeletServerCertificate</cod...
    Rule Low Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules