NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level
Rules and Groups employed by this XCCDF Profile
-
Kubernetes Settings
Each section of this configuration guide includes information about the configuration of a Kubernetes cluster and a set of recommendations for hard...Group -
System and Software Integrity
System and software integrity can be gained by installing antivirus, increasing system encryption strength with FIPS, verifying installed software,...Group -
Ensure that Cluster Version Operator is deployed
Integrity of the OpenShift platform is handled to start by the cluster version operator. Cluster Version Operator will by default GPG verify the in...Rule Medium Severity -
Ensure that Cluster Version Operator verifies integrity
Integrity of the OpenShift platform is handled to start by the cluster version operator. Cluster Version Operator will by default GPG verify the in...Rule Medium Severity -
Ensure that File Integrity Operator is scanning the cluster
<a href="https://docs.openshift.com/container-platform/4.7/security/file_integrity_operator/file-integrity-operator-understanding.html">The File In...Rule Medium Severity -
System Cryptographic Policies
OpenShift has the capability to centrally configure cryptographic polices.Group -
Ensure that FIPS mode is enabled on all cluster nodes
OpenShift has an installation-time flag that can enable FIPS mode for the cluster. The flag <pre>fips: true</pre> must be enabled at install time i...Rule High Severity -
Kubernetes - Account and Access Control
In traditional Unix security, if an attacker gains shell access to a certain login account, they can perform any action or access any file to which...Group -
Restrict Automounting of Service Account Tokens
Service accounts tokens should not be mounted in pods except where the workload running in the pod explicitly needs to communicate with the API ser...Rule Medium Severity -
Ensure Usage of Unique Service Accounts
Using the <code>default</code> service account prevents accurate application rights review and audit tracing. Instead of <code>default</code>, crea...Rule Medium Severity -
OpenShift Kube API Server
This section contains recommendations for kube-apiserver configuration.Group -
Disable the AlwaysAdmit Admission Control Plugin
To ensure OpenShift only responses to requests explicitly allowed by the admission control plugin. Check that the <code>config</code> ConfigMap obj...Rule Medium Severity -
Ensure that the Admission Control Plugin AlwaysPullImages is not set
The <code>AlwaysPullImages</code> admission control plugin should be disabled, since it can introduce new failure modes for control plane component...Rule High Severity -
Enable the NamespaceLifecycle Admission Control Plugin
OpenShift enables theNamespaceLifecycleplugin by default.Rule Medium Severity -
Enable the NodeRestriction Admission Control Plugin
To limit the <code>Node</code> and <code>Pod</code> objects that a kubelet could modify, ensure that the <code>NodeRestriction</code> plugin on kub...Rule Medium Severity -
Enable the SecurityContextConstraint Admission Control Plugin
To ensure pod permissions are managed, make sure that theSecurityContextConstraintadmission control plugin is used.Rule Medium Severity -
Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used
Instead of using a customized SecurityContext for pods, a Pod Security Policy (PSP) or a SecurityContextConstraint should be used. These are cluste...Rule Medium Severity -
Enable the ServiceAccount Admission Control Plugin
To ensure <code>ServiceAccount</code> objects must be created and granted before pod creation is allowed, follow the documentation and create <code...Rule Medium Severity -
Ensure that anonymous requests to the API Server are authorized
By default, anonymous access to the OpenShift API is enabled, but at the same time, all requests must be authorized. If no authentication mechanism...Rule Medium Severity -
Ensure catch-all FlowSchema object for API Priority and Fairness Exists
Using <code>APIPriorityAndFairness</code> feature provides a fine-grained way to control the behaviour of the Kubernetes API server in an overload ...Rule Medium Severity -
Enable the APIPriorityAndFairness feature gate
To limit the rate at which the API Server accepts requests, make sure that the API Priority and Fairness feature is enabled. Using <code>APIPriorit...Rule Medium Severity -
Configure the Kubernetes API Server Maximum Retained Audit Logs
To configure how many rotations of audit logs are retained, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>audit-log-ma...Rule Low Severity -
Configure Kubernetes API Server Maximum Audit Log Size
To rotate audit logs upon reaching a maximum size, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>audit-log-maxsize</co...Rule Medium Severity -
Configure the Audit Log Path
To enable auditing on the Kubernetes API Server, the audit log path must be set. Edit the <code>openshift-kube-apiserver</code> configmap and set t...Rule High Severity -
The authorization-mode cannot be AlwaysAllow
Do not always authorize all requests.Rule Medium Severity -
Ensure authorization-mode Node is configured
Restrict kubelet nodes to reading only objects associated with them.Rule Medium Severity -
Ensure authorization-mode RBAC is configured
To ensure OpenShift restricts different identities to a defined set of operations they are allowed to perform, check that the API server's <code>au...Rule Medium Severity -
Disable basic-auth-file for the API Server
Basic Authentication should not be used for any reason. If needed, edit API Edit the <code>openshift-kube-apiserver</code> configmap and remove the...Rule Medium Severity -
Ensure that the bindAddress is set to a relevant secure port
The bindAddress is set by default to0.0.0.0:6443, and listening with TLS enabled.Rule Low Severity -
Configure the Client Certificate Authority for the API Server
Certificates must be provided to fully setup TLS client certificate authentication. To ensure the API Server utilizes its own TLS certificates, the...Rule Medium Severity -
Configure the Encryption Provider Cipher
<p> When you enable etcd encryption, the following OpenShift API server and Kubernetes API server resources are encrypted: <ul> <li>...Rule Medium Severity -
Configure the etcd Certificate Authority for the API Server
To ensure etcd is configured to make use of TLS encryption for client connections, follow the OpenShift documentation and setup the TLS connection ...Rule Medium Severity -
Configure the etcd Certificate for the API Server
To ensure etcd is configured to make use of TLS encryption for client communications, follow the OpenShift documentation and setup the TLS connecti...Rule Medium Severity -
Configure the etcd Certificate Key for the API Server
To ensure etcd is configured to make use of TLS encryption for client communications, follow the OpenShift documentation and setup the TLS connecti...Rule Medium Severity -
Ensure that the --kubelet-https argument is set to true
The kube-apiserver ensures https to the kubelet by default. The apiserver flag "--kubelet-https" is deprecated and should be either set to "true" o...Rule Medium Severity -
Disable Use of the Insecure Bind Address
OpenShift should not bind to non-loopback insecure addresses. Edit the <code>openshift-kube-apiserver</code> configmap and remove the <code>insecur...Rule Medium Severity -
Prevent Insecure Port Access
By default, traffic for the OpenShift API server is served over HTTPS with authentication and authorization, and the secure API endpoint is bound t...Rule Medium Severity -
Configure the kubelet Certificate Authority for the API Server
To ensure OpenShift verifies kubelet certificates before establishing connections, follow the OpenShift documentation and setup the TLS connection ...Rule High Severity -
Configure the kubelet Certificate File for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Configure the kubelet Certificate File for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Configure the kubelet Certificate Key for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Configure the kubelet Certificate Key for the API Server
To enable certificate based kubelet authentication, edit the <code>config</code> configmap in the <code>openshift-kube-apiserver</code> namespace a...Rule High Severity -
Ensure all admission control plugins are enabled
To make sure none of them is explicitly disabled except PodSecurity, run the following command: <pre>$ oc -n openshift-kube-apiserver get configmap...Rule Medium Severity -
Ensure the openshift-oauth-apiserver service uses TLS
By default, the OpenShift OAuth API Server uses TLS. HTTPS should be used for connections between openshift-oauth-apiserver and kube-apiserver. By ...Rule Medium Severity -
Ensure the openshift-oauth-apiserver service uses TLS
By default, the OpenShift API Server uses TLS. HTTPS should be used for connections between openshift-apiserver and kube-apiserver. By default, the...Rule Medium Severity -
Profiling is protected by RBAC
Ensure that the cluster-debugger cluster role includes the /metrics resource URL. This demonstrates that profiling is protected by RBAC, with a spe...Rule Medium Severity -
Configure the API Server Minimum Request Timeout
The API server minimum request timeout defines the minimum number of seconds a handler must keep a request open before timing it out. To set this, ...Rule Medium Severity -
Ensure that the service-account-lookup argument is set to true
Validate service account before validating token.Rule Medium Severity -
Configure the Service Account Public Key for the API Server
To ensure the API Server utilizes its own key pair, edit the <code>openshift-kube-apiserver</code> configmap and set the <code>serviceAccountPublic...Rule Medium Severity -
Configure the Certificate for the API Server
To ensure the API Server utilizes its own TLS certificates, the <code>tls-cert-file</code> must be configured. Verify that the <code>apiServerArgum...Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.