PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
Rules and Groups employed by this XCCDF Profile
-
Kubernetes Settings
Each section of this configuration guide includes information about the configuration of a Kubernetes cluster and a set of recommendations for hard...Group -
System and Software Integrity
System and software integrity can be gained by installing antivirus, increasing system encryption strength with FIPS, verifying installed software,...Group -
Ensure that File Integrity Operator is scanning the cluster
<a href="https://docs.openshift.com/container-platform/4.7/security/file_integrity_operator/file-integrity-operator-understanding.html">The File In...Rule Medium Severity -
System Cryptographic Policies
OpenShift has the capability to centrally configure cryptographic polices.Group -
Ensure that full disk encryption is configured on cluster nodes
When full disk encryption is chosen as a way to protect card data at rest, OpenShift can provide several solutions depending on the hosting environ...Rule High Severity -
Ensure that EBS volumes declared in storageclasses are encrypted
OpenShift StorageClasses can be configured to enable EBS encryption on EBS volumes that are used later as persistent volumes. By using EBS encrypti...Rule High Severity -
Kubernetes - Account and Access Control
In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...Group -
Restrict Automounting of Service Account Tokens
Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API ser...Rule Medium Severity -
Ensure Usage of Unique Service Accounts
Using the <code>default</code> service account prevents accurate application rights review and audit tracing. Instead of <code>default</code>, crea...Rule Medium Severity -
OpenShift Kube API Server
This section contains recommendations for kube-apiserver configuration.Group -
Disable the AlwaysAdmit Admission Control Plugin
To ensure OpenShift only responses to requests explicitly allowed by the admission control plugin. Check that the <code>config</code> ConfigMap obj...Rule Medium Severity -
Ensure that the Admission Control Plugin AlwaysPullImages is not set
The <code>AlwaysPullImages</code> admission control plugin should be disabled, since it can introduce new failure modes for control plane component...Rule High Severity -
Enable the NamespaceLifecycle Admission Control Plugin
OpenShift enables theNamespaceLifecycleplugin by default.Rule Medium Severity -
Enable the NodeRestriction Admission Control Plugin
To limit the <code>Node</code> and <code>Pod</code> objects that a kubelet could modify, ensure that the <code>NodeRestriction</code> plugin on kub...Rule Medium Severity -
Enable the SecurityContextConstraint Admission Control Plugin
To ensure pod permissions are managed, make sure that theSecurityContextConstraintadmission control plugin is used.Rule Medium Severity -
Enable the ServiceAccount Admission Control Plugin
To ensure <code>ServiceAccount</code> objects must be created and granted before pod creation is allowed, follow the documentation and create <code...Rule Medium Severity -
Ensure that anonymous requests to the API Server are authorized
By default, anonymous access to the OpenShift API is enabled, but at the same time, all requests must be authorized. If no authentication mechanism...Rule Medium Severity -
Enable the APIPriorityAndFairness feature gate
To limit the rate at which the API Server accepts requests, make sure that the API Priority and Fairness feature is enabled. Using <code>APIPriorit...Rule Medium Severity -
Configure the Kubernetes API Server Maximum Retained Audit Logs
To configure how many rotations of audit logs are retained, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>audit-log-ma...Rule Low Severity -
Configure Kubernetes API Server Maximum Audit Log Size
To rotate audit logs upon reaching a maximum size, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>audit-log-maxsize</co...Rule Medium Severity -
Configure the Audit Log Path
To enable auditing on the Kubernetes API Server, the audit log path must be set. Edit the <code>openshift-kube-apiserver</code> configmap and set t...Rule High Severity -
The authorization-mode cannot be AlwaysAllow
Do not always authorize all requests.Rule Medium Severity -
Ensure authorization-mode RBAC is configured
To ensure OpenShift restricts different identities to a defined set of operations they are allowed to perform, check that the API server's <code>au...Rule Medium Severity -
Disable basic-auth-file for the API Server
Basic Authentication should not be used for any reason. If needed, edit API Edit the <code>openshift-kube-apiserver</code> configmap and remove the...Rule Medium Severity -
Ensure that the bindAddress is set to a relevant secure port
The bindAddress is set by default to0.0.0.0:6443, and listening with TLS enabled.Rule Low Severity -
Configure the Client Certificate Authority for the API Server
Certificates must be provided to fully setup TLS client certificate authentication. To ensure the API Server utilizes its own TLS certificates, the...Rule Medium Severity -
Configure the Encryption Provider Cipher
<p> When you enable etcd encryption, the following OpenShift API server and Kubernetes API server resources are encrypted: <ul> <li>...Rule Medium Severity -
Configure the etcd Certificate Authority for the API Server
To ensure etcd is configured to make use of TLS encryption for client connections, follow the OpenShift documentation and setup the TLS connection ...Rule Medium Severity -
Configure the etcd Certificate for the API Server
To ensure etcd is configured to make use of TLS encryption for client communications, follow the OpenShift documentation and setup the TLS connecti...Rule Medium Severity -
Configure the etcd Certificate Key for the API Server
To ensure etcd is configured to make use of TLS encryption for client communications, follow the OpenShift documentation and setup the TLS connecti...Rule Medium Severity -
Ensure that the --kubelet-https argument is set to true
The kube-apiserver ensures https to the kubelet by default. The apiserver flag "--kubelet-https" is deprecated and should be either set to "true" o...Rule Medium Severity -
Disable Use of the Insecure Bind Address
OpenShift should not bind to non-loopback insecure addresses. Edit the <code>openshift-kube-apiserver</code> configmap and remove the <code>insecur...Rule Medium Severity -
Prevent Insecure Port Access
By default, traffic for the OpenShift API server is served over HTTPS with authentication and authorization, and the secure API endpoint is bound t...Rule Medium Severity -
Configure the kubelet Certificate Authority for the API Server
To ensure OpenShift verifies kubelet certificates before establishing connections, follow the OpenShift documentation and setup the TLS connection ...Rule High Severity -
Configure the kubelet Certificate File for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Configure the kubelet Certificate File for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Configure the kubelet Certificate Key for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Configure the kubelet Certificate Key for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Ensure the openshift-oauth-apiserver service uses TLS
By default, the OpenShift OAuth API Server uses TLS. HTTPS should be used for connections between openshift-oauth-apiserver and kube-apiserver. By ...Rule Medium Severity -
Ensure the openshift-oauth-apiserver service uses TLS
By default, the OpenShift API Server uses TLS. HTTPS should be used for connections between openshift-apiserver and kube-apiserver. By default, the...Rule Medium Severity -
Profiling is protected by RBAC
Ensure that the cluster-debugger cluster role includes the /metrics resource URL. This demonstrates that profiling is protected by RBAC, with a spe...Rule Medium Severity -
Configure the API Server Minimum Request Timeout
The API server minimum request timeout defines the minimum number of seconds a handler must keep a request open before timing it out. To set this, ...Rule Medium Severity -
Ensure that the service-account-lookup argument is set to true
Validate service account before validating token.Rule Medium Severity -
Configure the Service Account Public Key for the API Server
To ensure the API Server utilizes its own key pair, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>serviceAccountPublic...Rule Medium Severity -
Configure the Certificate for the API Server
To ensure the API Server utilizes its own TLS certificates, the <code>tls-cert-file</code> must be configured. Verify that the <code>apiServerArgum...Rule Medium Severity -
Use Strong Cryptographic Ciphers on the API Server
To ensure that the API Server is configured to only use strong cryptographic ciphers, verify the <code>openshift-kube-apiserver</code> configmap co...Rule Medium Severity -
Configure the Certificate Key for the API Server
To ensure the API Server utilizes its own TLS certificates, the <code>tls-private-key-file</code> must be configured. Verify that the <code>apiServ...Rule Medium Severity -
Disable Token-based Authentication
To ensure OpenShift does not accept token-based authentication, follow the OpenShift documentation and configure alternate mechanisms for authentic...Rule High Severity -
Ensure that Audit Log Forwarding Is Enabled
OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default and the best practice is to ship a...Rule Medium Severity -
Ensure that Audit Log Webhook Is Configured
Audit is on by default and the best practice is to ship audit logs off an cluster for retention. HyperShift is able to do this with the a audit web...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.