Cis Ocp V160 4.1.9

CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 4.1.9

Profile Applicability

• Level: 1

Description

Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 600 or more restrictive.

Rationale

The kubelet reads various parameters, including security settings, from a config file specified by the --config argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.

Impact

None

Audit Procedure

In OpenShift 4, the kubelet configuration file is managed by the Machine Config Operator and is found at /var/lib/kubelet/config.json or '/var/data/kubelet/config.json' with file permissions set to 600. In OpenShift 4.13 and above Run the following command to check the permission:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
      oc debug node/${node} -- chroot /host stat -c %a /var/data/kubelet/config.json
done

For Earlier Versions Run the following command to check the permission:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
      oc debug node/${node} -- chroot /host stat -c %a /var/lib/kubelet/config.json
done

Verify that the permissions are 600.

Remediation

None.

Default Value

By default, the /var/lib/kubelet/config.json file has permissions of 600.

References

1. https://docs.openshift.com/container-platform/latest/architecture/control-plane.html#understanding-machine-config-operator_control-plane
2. https://kubernetes.io/docs/tasks/administer-cluster/kubelet-config-file/

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Automated)