Cis Ocp V190 2.3

CIS Red Hat OpenShift Container Platform Benchmark v1.9.0 - Control 2.3

Profile Applicability

• Level: 1

Description

Do not use self-signed certificates for TLS.

Rationale

etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should not be available to unauthenticated clients. You should enable the client authentication via valid certificates to secure the access to the etcd service.

Impact

Clients will not be able to use self-signed certificates for TLS.

Audit Procedure

OpenShift configures etcd with secure communication. OpenShift installs etcd as static pods on control plane nodes, and mounts the configuration files from /etc/etcd/ on the host. The etcd.conf file includes auto-tls configurations as referenced in /etc/etcd/etcd.conf.

OpenShift 4 includes multiple CAs providing independent chains of trust, which ensure that a platform CA will never accidentally sign a certificate that can be used for the wrong purpose, increasing the security posture of the cluster.

These internal self-signing CAs enable automation because the key is known to the cluster. The certificates generated by each CA are used to identify a particular OpenShift platform component to another OpenShift platform component. The OpenShift CAs are managed by the cluster and are only used within the cluster.

• Each cluster CA can only issue certificates for its own purpose within its own cluster.
• CAs for one OpenShift cluster cannot influence CAs for a different OpenShift cluster, thus avoiding cross-cluster interference.
• Cluster CAs cannot be influenced by an external CA that the cluster does not control.

Run the following command to verify if auto-TLS is enabled:

for i in $(oc get pods -oname -n openshift-etcd)
do
    oc exec -n openshift-etcd -c etcd $i -- \
      ps -o command= -C etcd | grep -- '--auto-tls=true 2>&1>/dev/null' ; \
      echo $?
done

Verify that 1 is returned for each etcd member.

Remediation

This setting is managed by the cluster etcd operator. No remediation required.

Default Value

By default, OpenShift configures etcd to use a cluster CA which creates self-signed certificates. These internal self-signing CAs enable automation because the key is known to the cluster. The certificates generated by each CA are used to identify a particular OpenShift platform component to another OpenShift platform component. The OpenShift CAs are managed by the cluster and are only used within the cluster. This means that

• Each cluster CA can only issue certificates for its own purpose within its own cluster.
• CAs for one OpenShift cluster cannot influence CAs for a different OpenShift cluster, thus avoiding cross-cluster interference.
• Cluster CAs cannot be influenced by an external CA that the cluster does not control.

This configuration cannot be changed.

References

1. https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/etcd-certificates.html
2. https://github.com/openshift/cluster-etcd-operator
3. https://github.com/openshift/cluster-etcd-operator/blob/release-4.5/bindata/etcd/pod.yaml#L154-L167
4. https://github.com/openshift/cluster-etcd-operator/blob/master/bindata/etcd/pod.yaml#L154-L167
5. https://etcd.io/
6. https://kubernetes.io/docs/tasks/administer-cluster/configure-upgrade-etcd/
7. https://etcd.io/#auto-tls

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)