Cis Ocp V170 1.2.13

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.13

Profile Applicability

• Level: 1

Description

Reject creating objects in a namespace that is undergoing termination.

Rationale

Setting admission control policy to NamespaceLifecycle ensures that objects cannot be created in non-existent namespaces, and that namespaces undergoing termination are not used for creating the new objects. This is recommended to enforce the integrity of the namespace termination process and also for the availability of the newer objects.

Impact

None.

Audit Procedure

OpenShift enables the NamespaceLifecycle plugin by default.

Use the following command to obtain a list of configured admission controllers:

oc -n openshift-kube-apiserver get configmap config -o json | jq -r '.data."config.yaml"' | jq '.apiServerArguments."enable-admission-plugins"'

Verify that NamespaceLifecycle is present in the returned list.

Remediation

None.

Default Value

OpenShift configures NamespaceLifecycle admission controller by default.

References

1. https://docs.openshift.com/container-platform/latest/architecture/admission-plug-ins.html
2. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.6/bindata/v4.1.0/config/defaultconfig.yaml#L34-L78
3. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
4. https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#namespacelifecycle

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)