1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
title: Ensure authorization-mode RBAC is configured
{{% set default_jqfilter = '.data."config.yaml" | fromjson' %}}
{{% set default_api_path = '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' %}}
{{% set hypershift_path = '/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config' %}}
{{% set hypershift_jqfilter = '.data."config.json" | fromjson' %}}
{{% set custom_api_path = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_path ~ '{{else}}' ~ default_api_path ~ '{{end}}' %}}
{{% set custom_jqfilter = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_jqfilter ~ '{{else}}' ~ default_jqfilter ~ '{{end}}' %}}
{{% set dump_path = default_api_path ~ ',' ~ default_jqfilter ~ ',' ~ custom_jqfilter %}}
description: |-
To ensure OpenShift restricts different identities to a defined set
of operations they are allowed to perform, check that the API server's
<tt>authorization-mode</tt> configuration option list contains RBAC.
rationale: |-
Role Based Access Control (RBAC) allows fine-grained control over the
operations that different entities can perform on different objects in
the cluster. Enabling RBAC is critical in regulating access to an
OpenShift cluster as the RBAC rules specify, given a user, which operations
can be executed over a set of namespaced or cluster-wide resources.
identifiers:
cce@ocp4: CCE-84102-3
severity: medium
references:
cis@ocp4: 1.2.8
nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
nist: CM-6,CM-6(1)
pcidss: Req-2.2
srg: SRG-APP-000516-CTR-001325
platform: not ocp4-on-hypershift-hosted
ocil_clause: 'The RBAC authorization mode is enabled'
ocil: |-
To verify that RBAC authorization mode is enabled, run the following command:
<pre>$ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | grep '"authorization-mode":\[[^]]*"RBAC"'</pre>
The output should show that the "authorization-mode" list contains the "RBAC" authorizer.
warnings:
- general: |-
{{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}
template:
name: yamlfile_value
vars:
ocp_data: "true"
entity_check: "at least one"
filepath: {{{ openshift_filtered_path(default_api_path, default_jqfilter) }}}
yamlpath: '.apiServerArguments["authorization-mode"][:]'
values:
- value: 'RBAC'
operation: "pattern match"
type: "string"
entity_check: "at least one"
|
