cyberstrikeus CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 4.1.4
Profile Applicability
- Level: 1
Description
If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.
Rationale
The kubeconfig file for kube-proxy controls various parameters for the kube-proxy service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root.
Impact
None
Audit Procedure
In OpenShift 4, the kube-proxy runs within the sdn pods, which copies the kubeconfig from a configmap to the container at /tmp/kubeconfig, with root:root ownership.
Run the following command:
for i in $(oc get pods -n openshift-sdn -l app=sdn -oname)
do
oc exec -n openshift-sdn $i -- \
stat -Lc %U:%G /config/kube-proxy-config.yaml
done
Verify that the kube-proxy-config.yaml file has ownership root:root.
Remediation
None required. The configuration is managed by OpenShift operators.
Default Value
By default, proxy file ownership is set to root:root.
References
- https://docs.openshift.com/container-platform/4.5/networking/openshift_sdn/configuring-kube-proxy.html
- https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/
CIS Controls
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts | * | * | * |
| v7 | 4.3 Ensure the Use of Dedicated Administrative Accounts | * | * | * |
MITRE ATT&CK Mappings
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1083, T1222 | TA0005, TA0007 | M1026 |
Profile
Level 1 (Manual)