Cis Ocp V170 1.1.8

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.1.8

Profile Applicability

• Level: 1

Description

Ensure that the /etc/kubernetes/manifests/etcd.yaml file ownership is set to root:root.

Rationale

The etcd pod specification file /etc/kubernetes/manifests/etcd.yaml controls various parameters that set the behavior of the etcd service in the master node. etcd is a highly-available key-value store which Kubernetes uses for persistent storage of all of its REST API object. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root.

Impact

None.

Audit Procedure

In OpenShift 4, starting with OpenShift 4.4, the etcd pod specification file is generated by the cluster etcd operator. The pod specification file is created on control plane nodes at /etc/kubernetes/manifests/etcd-member.yaml with ownership root:root. The default etcd pod specification file is available here: openshift/cluster-etcd-operator

Run the following command.

#Verify openshift-etcd ownership
for i in $(oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd )
do
  echo "check pod $i"
  oc rsh  -n openshift-etcd  $i \
       stat -c %U:%G /etc/kubernetes/manifests/etcd-pod.yaml
done

Verify that the ownership is set to root:root.

Remediation

No remediation required; file permissions are managed by the operator.

Default Value

By default, in OpenShift 4, /etc/kubernetes/manifests/etcd-member.yaml file ownership is set to root:root.

References

1. https://coreos.com/etcd
2. https://kubernetes.io/docs/admin/etcd/
3. https://docs.openshift.com/container-platform/latest/architecture/control-plane.html#defining-masters_control-plane

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)