How do I install the Cis Ocp V170 1.2.15 skill?

Run npx skillmds@latest add cyberstrikeus/cis-ocp-v170-1-2-15 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Ocp V170 1.2.15 skill do?

Ensure that the admission control plugin NodeRestriction is set (Manual) It is listed under DevOps & Infra on SkillMD.

Is Cis Ocp V170 1.2.15 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Ocp V170 1.2.15?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Ocp V170 1.2.15 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Ocp V170 1.2.15?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Ocp V170 1.2.15 by cyberstrikeus

Name: Cis Ocp V170 1.2.15
Author: cyberstrikeus

File contents

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.15

Profile Applicability

Level: 1

Description

Limit the Node and Pod objects that a kubelet could modify.

Rationale

Using the NodeRestriction plug-in ensures that the kubelet is restricted to the Node and Pod objects that it could modify as defined. Such kubelets will only be allowed to modify their own Node API object, and only modify Pod API objects that are bound to their node.

Impact

None.

Audit Procedure

In OpenShift, the NodeRestriction admission plugin is enabled by default.

Use the following command to obtain a list of configured admission controllers:

oc -n openshift-kube-apiserver get configmap config -o json | jq -r '.data."config.yaml"' | jq '.apiServerArguments."enable-admission-plugins"'

Verify the list includes NodeRestriction.

Remediation

None.

Default Value

In OpenShift, the NodeRestriction admission plugin is enabled by default and cannot be disabled.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	16.11 Leverage Vetted Modules or Services for Application Security Components		*	*
v7	9.4 Apply Host-based Firewalls or Port Filtering	*	*	*

MITRE ATT&CK Mappings

Techniques / Sub-techniques	Tactics	Mitigations
T1609, T1610	TA0002	M1038

Profile

Level 1 (Manual)

---name: cis-ocp-v170-1-2-15description: Ensure that the admission control plugin NodeRestriction is set (Manual)---# CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.15## Profile Applicability- **Level:** 1## DescriptionLimit the `Node` and `Pod` objects that a kubelet could modify.## RationaleUsing the `NodeRestriction` plug-in ensures that the kubelet is restricted to the `Node` and `Pod` objects that it could modify as defined. Such kubelets will only be allowed to modify their own `Node` API object, and only modify `Pod` API objects that are bound to their node.## ImpactNone.## Audit ProcedureIn OpenShift, the `NodeRestriction` admission plugin is enabled by default.Use the following command to obtain a list of configured admission controllers:```bashoc -n openshift-kube-apiserver get configmap config -o json | jq -r '.data."config.yaml"' | jq '.apiServerArguments."enable-admission-plugins"'```Verify the list includes `NodeRestriction`.## RemediationNone.## Default ValueIn OpenShift, the `NodeRestriction` admission plugin is enabled by default and cannot be disabled.## References1. https://docs.openshift.com/container-platform/latest/architecture/admission-plug-ins.html2. https://github.com/openshift/origin/blob/release-4.5/vendor/k8s.io/kubernetes/cmd/kubeadm/app/phases/controlplane/manifests.go#L132## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ----------------------------------------------------------------------------- | ---- | ---- | ---- || v8 | 16.11 Leverage Vetted Modules or Services for Application Security Components | | \* | \* || v7 | 9.4 Apply Host-based Firewalls or Port Filtering | \* | \* | \* |## MITRE ATT&CK Mappings| Techniques / Sub-techniques | Tactics | Mitigations || --------------------------- | ------- | ----------- || T1609, T1610 | TA0002 | M1038 |## Profile**Level 1** (Manual)

Frequently asked questions

Cis Ocp V170 1.2.15