Cis Ocp V190 2.6

CIS Red Hat OpenShift Container Platform Benchmark v1.9.0 - Control 2.6

Profile Applicability

• Level: 1

Description

Do not use automatically generated self-signed certificates for TLS connections between peers.

Rationale

etcd is a highly-available key value store used by Kubernetes deployments for persistent storage of all of its REST API objects. These objects are sensitive in nature and should be accessible only by authenticated etcd peers in the etcd cluster. Hence, do not use self-signed certificates for authentication.

Impact

All peers attempting to communicate with the etcd server require a valid client certificate for authentication.

Audit Procedure

OpenShift does not use the --peer-auto-tls argument. OpenShift 4 includes multiple CAs providing independent chains of trust, which ensure that a platform CA will never accidentally sign a certificate that can be used for the wrong purpose, increasing the security posture of the cluster.

These internal self-signing CAs enable automation because the key is known to the cluster. The certificates generated by each CA are used to identify a particular OpenShift platform component to another OpenShift platform component. The OpenShift CAs are managed by the cluster and are only used within the cluster. This means that

• Each cluster CA can only issue certificates for its own purpose within its own cluster.
• CAs for one OpenShift cluster cannot influence CAs for a different OpenShift cluster, thus avoiding cross-cluster interference.

Cluster CAs cannot be influenced by an external CA that the cluster does not control.

Run the following command to check the value of --peer-auto-tls:

for i in $(oc get pods -oname -n openshift-etcd)
do
    oc exec -n openshift-etcd -c etcd $i -- \
      ps -o command= -C etcd | grep -- --peer-auto-tls=true 2>&1>/dev/null ; \
      echo $?
done

Verify that 1 is returned for each etcd member.

Remediation

This setting is managed by the cluster etcd operator. No remediation required.

Default Value

OpenShift does not use the --peer-auto-tls argument. By default, OpenShift configures etcd to use a cluster CA which creates self-signed certificates. These internal self-signing CAs enable automation because the key is known to the cluster. The certificates generated by each CA are used to identify a particular OpenShift platform component to another OpenShift platform component. The OpenShift CAs are managed by the cluster and are only used within the cluster. This means that

• Each cluster CA can only issue certificates for its own purpose within its own cluster.
• CAs for one OpenShift cluster cannot influence CAs for a different OpenShift cluster, thus avoiding cross-cluster interference.
• Cluster CAs cannot be influenced by an external CA that the cluster does not control.

This configuration cannot be changed.

References

1. https://docs.openshift.com/container-platform/latest/security/certificate_types_descriptions/etcd-certificates.html
2. https://github.com/openshift/cluster-etcd-operator
3. https://github.com/openshift/cluster-etcd-operator/blob/release-4.5/bindata/etcd/pod.yaml#L154-L167
4. https://github.com/openshift/cluster-etcd-operator/blob/master/bindata/etcd/pod.yaml#L154-L167
5. https://etcd.io/
6. https://etcd.io/#peer-auto-tls
7. https://etcd.io/#peer-auto-tls

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)