DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level
Rules and Groups employed by this XCCDF Profile
-
Ensure that Audit Log Forwarding Is Enabled
OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default and the best practice is to ship audit logs off the cluster for retention. The clust...Rule Medium Severity -
Authentication
In cloud workloads, there are many ways to create and configure to multiple authentication services. Some of these authentication methods by not be secure or common methodologies, or they may not b...Group -
Configure An Identity Provider
<p> For users to interact with OpenShift Container Platform, they must first authenticate to the cluster. The authentication layer identifies the user associated with requests to the...Rule Medium Severity -
Configure OAuth tokens to expire after a set period of inactivity
<p> You can configure OAuth tokens to expire after a set period of inactivity. By default, no token inactivity timeout is set. </p> <p> The inactivity timeout can be ei...Rule Medium Severity -
Configure OAuth tokens to expire after a set period of inactivity
<p> You can configure OAuth tokens to have have a custom duration. By default, the tokens are valid for 24 hours (86400 seconds). </p> <p> The maximum age can be either...Rule Medium Severity -
Do Not Use htpasswd-based IdP
<p> For users to interact with OpenShift Container Platform, they must first authenticate to the cluster. The authentication layer identifies the user associated with requests to the...Rule Medium Severity -
Only Use LDAP-based IdPs with TLS
<p> For users to interact with OpenShift Container Platform, they must first authenticate to the cluster. The authentication layer identifies the user associated with requests to the...Rule High Severity -
OpenShift Controller Settings
This section contains recommendations for the kube-controller-manager configurationGroup -
Ensure Controller insecure port argument is unset
To ensure the Controller Manager service is bound to secure loopback address and a secure port, set the <code>RotateKubeletServerCertificate</code> option to <code>true</code> in the <code>openshif...Rule Low Severity -
Ensure that the RotateKubeletServerCertificate argument is set
To enforce kubelet server certificate rotation on the Controller Manager, set the <code>RotateKubeletServerCertificate</code> option to <code>true</code> in the <code>openshift-kube-controller-mana...Rule Medium Severity -
Ensure Controller secure-port argument is set
To ensure the Controller Manager service is bound to secure loopback address using a secure port, set the <code>RotateKubeletServerCertificate</code> option to <code>true</code> in the <code>opensh...Rule Low Severity -
Configure the Service Account Certificate Authority Key for the Controller Manager
To ensure the API Server utilizes its own key pair, set the <code>masterCA</code> parameter to the public key file for service accounts in the <code>openshift-kube-controller-manager</code> configm...Rule Medium Severity -
Configure the Service Account Private Key for the Controller Manager
To ensure the API Server utilizes its own key pair, set the <code>privateKeyFile</code> parameter to the public key file for service accounts in the <code>openshift-kube-controller-manager</code> c...Rule Medium Severity -
Ensure that use-service-account-credentials is enabled
To ensure individual service account credentials are used, set the <code>use-service-account-credentials</code> option to <code>true</code> in the <code>openshift-kube-controller-manager</code> con...Rule Medium Severity -
OpenShift etcd Settings
Contains rules that check correct OpenShift etcd settings.Group -
Disable etcd Self-Signed Certificates
To ensure the <code>etcd</code> service is not using self-signed certificates, run the following command: <pre>$ oc get cm/etcd-pod -n openshift-etcd -o yaml</pre> The etcd pod configuration contai...Rule Medium Severity -
Ensure That The etcd Client Certificate Is Correctly Set
To ensure the etcd service is serving TLS to clients, make sure the <code>etcd-pod*</code> ConfigMaps in the <code>openshift-etcd</code> namespace contain the following argument for the <code>etcd<...Rule Medium Severity -
Enable The Client Certificate Authentication
To ensure the <code>etcd</code> service is serving TLS to clients, make sure the <code>etcd-pod*</code> <code>ConfigMaps</code> in the <code>openshift-etcd</code> namespace contain the follo...Rule Medium Severity -
Ensure That The etcd Key File Is Correctly Set
To ensure the etcd service is serving TLS to clients, make sure the <code>etcd-pod*</code> ConfigMaps in the <code>openshift-etcd</code> namespace contain the following argument for the <code>etcd<...Rule Medium Severity -
Disable etcd Peer Self-Signed Certificates
To ensure the <code>etcd</code> service is not using self-signed certificates, run the following command: <pre>$ oc get cm/etcd-pod -n openshift-etcd -o yaml</pre> The etcd pod configuration contai...Rule Medium Severity -
Enable The Peer Client Certificate Authentication
To ensure the <code>etcd</code> service is serving TLS to clients, make sure the <code>etcd-pod*</code> <code>ConfigMaps</code> in the <code>openshift-etcd</code> namespace contain the follo...Rule Medium Severity -
Kubernetes - General Security Practices
Contains evaluations for general security practices for operating a Kubernetes environment.Group -
Enable Classification Banner on OpenShift Console
A classification banner can be configured by creating a Console Notification CR on OpenShiftRule Medium Severity -
Apply Security Context to Your Pods and Containers
Apply Security Context to your Pods and ContainersRule Medium Severity -
Manage Image Provenance Using ImagePolicyWebhook
OpenShift administrators can control which images can be imported, tagged, and run in a cluster. There are two facilities for this purpose: (1) Allowed Registries, allowing administrators to restri...Rule Medium Severity -
The default namespace should not be used
Kubernetes provides a default namespace, where objects are placed if no namespace is specified for them. Placing objects in this namespace makes application of RBAC and other controls more difficult.Rule Medium Severity -
Ensure Seccomp Profile Pod Definitions
Enabledefaultseccomp profiles in your pod definitions.Rule Medium Severity -
Create administrative boundaries between resources using namespaces
Use namespaces to isolate your Kubernetes objects.Rule Medium Severity -
Ensure that the kubeadmin secret has been removed
The kubeadmin user is meant to be a temporary user used for bootstrapping purposes. It is preferable to assign system administrators whose users are backed by an Identity Provider. <br> Make sure ...Rule Medium Severity -
Ensure that the OpenShift OAuth login template is set
A legal notice can be configured via a customized login template. <br> This is achievable via the OAuth object by creating a custom login page, storing it in a Kubernetes Secret and referencing it...Rule Medium Severity -
Ensure that the OpenShift OAuth logout URL is set
The user can be redirected to a configured URL upon logout <br> This is achievable via the OAuth object by setting the <code>logoutRedirect</code> attribute. Refer to <a href="https://docs.openshi...Rule Medium Severity -
Ensure that the OpenShift OAuth provider selection is set
Custom login pages can be helpful to show users a branded page that they trust and expect before being redirected to the authentication provider. <br> This is achievable via the OAuth object by cr...Rule Medium Severity -
Ensure that the OpenShift MOTD is set
To configure OpenShift's MOTD, create a <b>ConfigMap</b> called <code>motd</code> in the <code>openshift</code> namespace. The object should look as follows: <pre> --- apiVersion: v1 kind: Config...Rule Medium Severity -
Ensure that project templates autocreate Resource Quotas
<p> Configure a template for newly created projects to use default resource quotas and make sure this template is referenced from the default project template. </p> <p>...Rule Medium Severity -
Ensure workloads use resource requests and limits per namespace
There are two ways to enable resource requests and limits. To create either: A multi-project quota, defined by a ClusterResourceQuota object, allows quotas to be shared across multiple projects. ...Rule Medium Severity -
This is a helper rule to fetch the required api resource for detecting HyperShift OCP version
no descriptionRule Medium Severity -
This is a helper rule to fetch the required api resource for detecting OCP version
no descriptionRule Medium Severity -
Kubernetes Kubelet Settings
The Kubernetes Kubelet is an agent that runs on each node in the cluster. It makes sure that containers are running in a pod. The kubelet takes a set of PodSpecs that are provided through various ...Group -
kubelet - Disable the Read-Only Port
To disable the read-only port, edit the kubelet configuration Edit the <code>openshift-kube-apiserver</code> configmap and set the <code>kubelet-read-only-port</code> parameter to 0: <pre> "apiServ...Rule Medium Severity -
OpenShift - Logging Settings
Contains evaluations for the cluster's logging configuration settings.Group -
Ensure that Audit Log Errors Emit Alerts
<p> OpenShift audit works at the API server level, logging all requests coming to the server. However, if API server instance is unable to write errors, an alert must be issued in order for the org...Rule High Severity -
Ensure that Audit Log Forwarding Uses TLS
<p> OpenShift audit works at the API server level, logging all requests coming to the server. Audit is on by default and the best practice is to ship audit logs off the cluster for r...Rule Medium Severity -
Ensure that the cluster's audit profile is properly set
<p> OpenShift can audit the details of requests made to the API server through the standard Kubernetes audit capabilities. </p> <p> In OpenShift, auditing of the API S...Rule Medium Severity -
Ensure that OpenShift Logging Operator is scanning the cluster
OpenShift Logging Operator provides ability to aggregate all the logs from the OpenShift Container Platform cluster, such as node system audit logs, application container logs, and infrastructure l...Rule Medium Severity -
Kubernetes - Network Configuration and Firewalls
Most systems must be connected to a network of some sort, and this brings with it the substantial risk of network attack. This section discusses the security impact of decisions about networking wh...Group -
Ensure that the CNI in use supports Network Policies
There are a variety of CNI plugins available for Kubernetes. If the CNI in use does not support Network Policies it may not be possible to effectively restrict traffic in the cluster. OpenShift sup...Rule High Severity -
Ensure that application Namespaces have Network Policies defined.
Use network policies to isolate traffic in your cluster network.Rule High Severity -
Ensure IngressController is configured to use secure tlsSecurityProfile
<p> The configuration <code>tlsSecurityProfile</code> specifies TLS configurations to be used while establishing connections with the externally exposed servers. Though secure transp...Rule Medium Severity -
Ensure that project templates autocreate Network Policies
Configure a template for newly created projects to use default network policies and make sure this template is referenced from the default project template. The OpenShift Container Platform API se...Rule Medium Severity -
Ensure that all Routes has rate limit enabled
OpenShift has an option to set the rate limit for Routes [1] when creating new Routes. All routes outside the openshift namespaces and the kube namespaces should use the rate-limiting annotations. ...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.