Check: CNTR-K8-003170
Kubernetes STIG:
CNTR-K8-003170
(in versions v1 r6 through v1 r2)
Title
The Kubernetes Kubelet certificate authority must be owned by root. (Cat II impact)
Discussion
The Kubernetes kube proxy kubeconfig contain the argument and setting for the Master Nodes. These settings contain network rules for restricting network communication between pods, clusters, and networks. If these files can be changed, data traversing between the Kubernetes Control Panel components would be compromised. Many of the security settings within the document are implemented through this file.
Check Content
Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Review the ownership of the Kubernetes client-ca-file by using the command: more kubelet --client-ca-file argument Note certificate location Review the ownership of the Kubernetes client-ca-file by using the command: stat -c %U:%G <location from --client-ca-file argument>| grep -v root:root If the command returns any non root:root file permissions, this is a finding.
Fix Text
Change the permissions of the Kube Proxy to "root" by executing the command: chown root:root <location from kubeconfig>.
Additional Identifiers
Rule ID: SV-242450r754804_rule
Vulnerability ID: V-242450
Group Title: SRG-APP-000516-CTR-001325
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |