Cis Ocp V160 1.3.5

CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 1.3.5

Profile Applicability

• Level: 1

Description

Do not bind the Controller Manager service to non-loopback insecure addresses.

Rationale

The Controller Manager API service which runs on port 10257/TCP by default is used for health and metrics information and is available without authentication or encryption. As such it should only be bound to a localhost interface, to minimize the cluster's attack surface.

Impact

None.

Audit Procedure

The bind-address argument is not used. The secure-port argument is set to 10257. The insecure-port argument is set to 0.

Use the following command to check the secure port configuration:

oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq '.extendedArguments["secure-port"][]'

Verify the returned value is 10257.

Ensure the metrics endpoint is protected from unauthorized access:

export POD=$(oc get pods -n openshift-kube-controller-manager -l app=kube-controller-manager -o jsonpath='{.items[0].metadata.name}')
oc rsh -n openshift-kube-controller-manager -c kube-controller-manager $POD curl https://localhost:10257/metrics -k

Verify an HTTP 403 response is returned and unset environment variables:

unset POD

Remediation

None.

Default Value

By default, the --bind-address argument is not present, the secure-port argument is set to 10257 and the port argument is set to 0.

References

1. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#cluster-openshift-controller-manager-operator_red-hat-operators
2. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-controller-manager-operator_red-hat-operators
3. https://github.com/openshift/cluster-kube-controller-manager-operator
4. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)