How do I install the Cis Ocp V180 1.3.4 skill?

Run npx skillmds@latest add cyberstrikeus/cis-ocp-v180-1-3-4 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cis Ocp V180 1.3.4 skill do?

Ensure --root-ca-file set as appropriate (Manual) It is listed under DevOps & Infra on SkillMD.

Is Cis Ocp V180 1.3.4 safe to use?

SkillMD's automated safety review verdict for this skill is PASS. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cis Ocp V180 1.3.4?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cis Ocp V180 1.3.4 free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cis Ocp V180 1.3.4?

cyberstrikeus (@cyberstrikeus) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cis Ocp V180 1.3.4 by cyberstrikeus

Name: Cis Ocp V180 1.3.4
Author: cyberstrikeus

File contents

CIS Red Hat OpenShift Container Platform Benchmark v1.8.0 - Control 1.3.4

Profile Applicability

Level: 1

Description

Allow pods to verify the API server's serving certificate before establishing connections.

Rationale

Processes running within pods that need to contact the API server must verify the API server's serving certificate. Failing to do so could be a subject to man-in-the-middle attacks.

Providing the root certificate for the API server's serving certificate to the controller manager with the --root-ca-file argument allows the controller manager to inject the trusted bundle into pods so that they can verify TLS connections to the API server.

Impact

OpenShift clusters manage and maintain certificate authorities and certificates for cluster components.

Audit Procedure

Certificates for OpenShift platform components are automatically created and rotated by the OpenShift Container Platform.

Run the following command:

oc get configmaps config -n openshift-kube-controller-manager -ojson | \
  jq -r '.data["config.yaml"]' | \
  jq -r '.extendedArguments["root-ca-file"][]'

Verify that the --root-ca-file argument exists and is set to /etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt.

Remediation

None.

Default Value

By default, OpenShift sets the Kubernetes Controller Manager root-ca-file to /etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt.

References

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	13.10 Perform Application Layer Filtering			*
v7	4.4 Use Unique Passwords		*	*

MITRE ATT&CK Mappings

Techniques / Sub-techniques	Tactics	Mitigations
T1552	TA0006	M1022

Profile

Level 1 (Manual)

---name: cis-ocp-v180-1-3-4description: Ensure --root-ca-file set as appropriate (Manual)---# CIS Red Hat OpenShift Container Platform Benchmark v1.8.0 - Control 1.3.4## Profile Applicability- **Level:** 1## DescriptionAllow pods to verify the API server's serving certificate before establishing connections.## RationaleProcesses running within pods that need to contact the API server must verify the API server's serving certificate. Failing to do so could be a subject to man-in-the-middle attacks.Providing the root certificate for the API server's serving certificate to the controller manager with the `--root-ca-file` argument allows the controller manager to inject the trusted bundle into pods so that they can verify TLS connections to the API server.## ImpactOpenShift clusters manage and maintain certificate authorities and certificates for cluster components.## Audit ProcedureCertificates for OpenShift platform components are automatically created and rotated by the OpenShift Container Platform.Run the following command:```bashoc get configmaps config -n openshift-kube-controller-manager -ojson | \ jq -r '.data["config.yaml"]' | \ jq -r '.extendedArguments["root-ca-file"][]'```Verify that the `--root-ca-file` argument exists and is set to `/etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt`.## RemediationNone.## Default ValueBy default, OpenShift sets the Kubernetes Controller Manager `root-ca-file` to `/etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt`.## References1. https://docs.openshift.com/container-platform/4.13/operators/operator-reference.html2. https://docs.openshift.com/container-platform/latest/operators/operator-reference.html#cluster-openshift-controller-manager-operator_cluster-operators-ref3. https://docs.openshift.com/container-platform/4.13/security/certificate_types_descriptions/control-plane-certificates.html4. https://github.com/openshift/cluster-kube-controller-manager-operator/blob/release-4.5/bindata/bootkube/bootstrap-manifests/kube-controller-manager-pod.yaml5. https://github.com/openshift/cluster-kube-controller-manager-operator/blob/release-4.5/bindata/bootkube/config/bootstrap-config-overrides.yaml6. https://github.com/openshift/cluster-kube-controller-manager-operator/blob/release-4.5/bindata/v4.1.0/kube-controller-manager/kubeconfig-cm.yaml7. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-controller-manager/8. https://github.com/kubernetes/kubernetes/issues/11000## CIS Controls| Controls Version | Control | IG 1 | IG 2 | IG 3 || ---------------- | ----------------------------------------- | ---- | ---- | ---- || v8 | 13.10 Perform Application Layer Filtering | | | \* || v7 | 4.4 Use Unique Passwords | | \* | \* |## MITRE ATT&CK Mappings| Techniques / Sub-techniques | Tactics | Mitigations || --------------------------- | ------- | ----------- || T1552 | TA0006 | M1022 |## Profile**Level 1** (Manual)

Frequently asked questions

Cis Ocp V180 1.3.4