How do I install the Cis Ocp V160 1.2.17 skill?

Run npx skillmds@latest add cyberstrikeus/cis-ocp-v160-1-2-17 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Ocp V160 1.2.17 skill do?

Ensure that the --insecure-port argument is set to 0 (Manual) It is listed under DevOps & Infra on SkillMD.

Is Cis Ocp V160 1.2.17 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Ocp V160 1.2.17?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Ocp V160 1.2.17 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Ocp V160 1.2.17?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Ocp V160 1.2.17 by cyberstrikeus

Name: Cis Ocp V160 1.2.17
Author: cyberstrikeus

File contents

CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 1.2.17

Profile Applicability

Level: 1

Description

Do not bind to insecure port.

Rationale

Setting up the apiserver to serve on an insecure port would allow unauthenticated and unencrypted access to your master node. This would allow attackers who could access this port, to easily take control of the cluster.

Impact

All components that use the API must connect via the secured port, authenticate themselves, and be authorized to use the API.

This includes:

kube-controller-manager
kube-proxy
kube-scheduler
kubelets

Audit Procedure

The openshift-kube-apiserver is served over HTTPS with authentication and authorization; the secure API endpoint is bound to 0.0.0.0:6443 by default. By default the insecure-port argument is set to 0. Note that the openshift-apiserver is not running in the host network namespace. The port is not exposed on the node, but only through the pod network.

Run the following command:

oc -n openshift-kube-apiserver get endpoints -o jsonpath='{.items[*].subsets[*].ports[*].port}'

Verify the return value is 6443.

Remediation

None.

Default Value

By default, the openshift-kube-server is served over HTTPS with authentication and authorization; the secure API endpoint is bound to 0.0.0.0:6443 and the insecure-port has been removed in Kubernetes 1.20+.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	16.11 Leverage Vetted Modules or Services for Application Security Components		x	x
v7	9.4 Apply Host-based Firewalls or Port Filtering	x	x	x

MITRE ATT&CK Mappings

Techniques / Sub-techniques	Tactics	Mitigations
T1609	TA0002	M1035

Profile

Level 1 (Manual)

---name: cis-ocp-v160-1-2-17description: Ensure that the --insecure-port argument is set to 0 (Manual)---# CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 1.2.17## Profile Applicability- **Level:** 1## DescriptionDo not bind to insecure port.## RationaleSetting up the `apiserver` to serve on an insecure port would allow unauthenticated and unencrypted access to your master node. This would allow attackers who could access this port, to easily take control of the cluster.## ImpactAll components that use the API must connect via the secured port, authenticate themselves, and be authorized to use the API.This includes:- kube-controller-manager- kube-proxy- kube-scheduler- kubelets## Audit ProcedureThe `openshift-kube-apiserver` is served over HTTPS with authentication and authorization; the secure API endpoint is bound to `0.0.0.0:6443` by default. By default the `insecure-port` argument is set to `0`. Note that the `openshift-apiserver` is not running in the host network namespace. The port is not exposed on the node, but only through the pod network.Run the following command:```bashoc -n openshift-kube-apiserver get endpoints -o jsonpath='{.items[*].subsets[*].ports[*].port}'```Verify the return value is `6443`.## RemediationNone.## Default ValueBy default, the `openshift-kube-server` is served over HTTPS with authentication and authorization; the secure API endpoint is bound to `0.0.0.0:6443` and the `insecure-port` has been removed in Kubernetes 1.20+.## References1. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.6/bindata/v4.1.0/config/defaultconfig.yaml#L102-L1032. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.5/bindata/v4.1.0/config/defaultconfig.yaml#L103-L1053. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.5/bindata/v4.1.0/kube-apiserver/pod.yaml#L155-L1574. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-apiserver-operator_red-hat-operators5. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#openshift-apiserver-operator_red-hat-operators6. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ----------------------------------------------------------------------------- | ---- | ---- | ---- || v8 | 16.11 Leverage Vetted Modules or Services for Application Security Components | | x | x || v7 | 9.4 Apply Host-based Firewalls or Port Filtering | x | x | x |## MITRE ATT&CK Mappings| Techniques / Sub-techniques | Tactics | Mitigations || --------------------------- | ------- | ----------- || T1609 | TA0002 | M1035 |## Profile**Level 1** (Manual)

Frequently asked questions

Cis Ocp V160 1.2.17