Cis Ocp V160 4.1.4

CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 4.1.4

Profile Applicability

• Level: 1

Description

If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.

Rationale

The kubeconfig file for kube-proxy controls various parameters for the kube-proxy service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root.

Impact

None

Audit Procedure

In OpenShift 4, the kube-proxy runs within the sdn pods, which copies the kubeconfig from a configmap to the container at /tmp/kubeconfig, with root:root ownership. Run the following command:

for i in $(oc get pods -n openshift-sdn -l app=sdn -oname)
do
    oc exec -n openshift-sdn $i -- \
      stat -Lc %U:%G /config/kube-proxy-config.yaml
done

Verify that the kube-proxy-config.yaml file has ownership root:root.

Remediation

None required. The configuration is managed by OpenShift operators.

Default Value

By default, proxy file ownership is set to root:root.

References

1. https://docs.openshift.com/container-platform/4.5/networking/openshift_sdn/configuring-kube-proxy.html
2. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)