1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
|
documentation_complete: true
title: 'Configure the Certificate for the API Server'
{{% set default_jqfilter = '[.data."config.yaml" | fromjson | select(.apiServerArguments["tls-cert-file"]) | .apiServerArguments["tls-cert-file"][] | select(test("{{.var_apiserver_tls_cert}}"))]' %}}
{{% set default_api_path = '/api/v1/namespaces/openshift-kube-apiserver/configmaps/config' %}}
{{% set hypershift_path = '/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/kas-config' %}}
{{% set hypershift_jqfilter = '[.data."config.json" | fromjson | select(.apiServerArguments["tls-cert-file"]) | .apiServerArguments["tls-cert-file"][] | select(test("/etc/kubernetes/certs/server/tls.crt"))]' %}}
{{% set custom_api_path = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_path ~ '{{else}}' ~ default_api_path ~ '{{end}}' %}}
{{% set custom_jqfilter = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_jqfilter ~ '{{else}}' ~ default_jqfilter ~ '{{end}}' %}}
{{% set dump_path = default_api_path ~ ',' ~ default_jqfilter ~ ',' ~ custom_jqfilter %}}
description: |-
To ensure the API Server utilizes its own TLS certificates, the
<tt>tls-cert-file</tt> must be configured. Verify
that the <tt>apiServerArguments</tt> section has the <tt>tls-cert-file</tt> configured in
the <tt>config</tt> configmap in the <tt>openshift-kube-apiserver</tt> namespace
similar to:
<pre>
"apiServerArguments":{
...
"tls-cert-file": [
"/etc/kubernetes/static-pod-certs/secrets/service-network-serving-certkey/tls.crt"
],
...
}
</pre>
rationale: |-
API Server communication contains sensitive parameters that should remain
encrypted in transit. Configure the API Server to serve only HTTPS
traffic.
identifiers:
cce@ocp4: CCE-83779-9
severity: medium
references:
cis@ocp4: 1.2.28
nerc-cip: CIP-003-8 R4.2,CIP-007-3 R5.1
nist: SC-8,SC-8(1),SC-8(2)
pcidss: Req-2.2,Req-2.2.3,Req-2.3
srg: SRG-APP-000441-CTR-001090,SRG-APP-000442-CTR-001095
platform: not ocp4-on-hypershift-hosted
ocil_clause: '<tt>tls-cert-file</tt> is not set as appropriate for <tt>apiServerArguments</tt>'
ocil: |-
Run the following command:
<pre>$ oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq -r '.apiServerArguments."tls-cert-file"'</pre>
The output should return <tt>/etc/kubernetes/static-pod-certs/secrets/service-network-serving-certkey/tls.crt</tt>
warnings:
- general: |-
{{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}
template:
name: yamlfile_value
vars:
ocp_data: "true"
filepath: {{{ openshift_filtered_path(default_api_path, default_jqfilter) }}}
yamlpath: "[:]"
check_existence: "at_least_one_exists"
entity_check: "all"
values:
- value: "(.*?)"
operation: "pattern match"
|
