Cis Ocp V160 1.2.16

CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 1.2.16

Profile Applicability

• Level: 1

Description

Do not bind the insecure API service.

Rationale

If you bind the apiserver to an insecure address, basically anyone who could connect to it over the insecure port, would have unauthenticated and unencrypted access to your master node. The apiserver doesn't do any authentication checking for insecure binds and traffic to the Insecure API port is not encrypted, allowing attackers to potentially read sensitive data in transit.

Impact

Connections to the API server will require valid authentication credentials.

Audit Procedure

The openshift-kube-apiserver is served over HTTPS with authentication and authorization; the secure API endpoint for the openshift-kube-apiserver is bound to 0.0.0.0:6443 by default. Note that the openshift-apiserver is not running in the host network namespace. The port is not exposed on the node, but only through the pod network.

Use the following command to obtain a list of configured feature gates on the API server:

oc get kubeapiservers.operator.openshift.io cluster -ojson | jq '.spec.observedConfig.apiServerArguments."feature-gates"'

Verify that InsecureBindAddress=true is not in the returned list.

Next, query Kubernetes API server endpoints:

oc -n openshift-kube-apiserver get endpoints -o jsonpath='{.items[*].subsets[*].ports[*].port}'

Verify the API server port for the Kubernetes API server is using 6443.

Next, query the OpenShift API server endpoints:

oc -n openshift-apiserver get endpoints -o jsonpath='{.items[*].subsets[*].ports[*].port}'

Verify the API server port for the OpenShift API server is using 8443. Note that the openshift-apiserver is not running in the host network namespace. The port is not exposed on the node, but only through the pod network.

Remediation

None.

Default Value

By default, the openshift-kube-apiserver is served over HTTPS with authentication and authorization; the secure API endpoint is bound to 0.0.0.0:6443. Note that the openshift-apiserver is not running in the host network namespace. The port is not exposed on the node, but only through the pod network.

References

1. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.5/bindata/v4.1.0/config/defaultconfig.yaml#L104-L105
2. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-apiserver-operator_red-hat-operators
3. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#openshift-apiserver-operator_red-hat-operators
4. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)