cis-ocp-v170-4-1-4

name	cis-ocp-v170-4.1.4
description	If proxy kubeconfig file exists ensure ownership is set to root:root (Manual)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","worker-node","config-files"]
cis_id	4.1.4
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 4.1.4

Profile Applicability

• Level: 1

Description

If kube-proxy is running, ensure that the file ownership of its kubeconfig file is set to root:root.

Rationale

The kubeconfig file for kube-proxy controls various parameters for the kube-proxy service in the worker node. You should set its file ownership to maintain the integrity of the file. The file should be owned by root:root.

Impact

None

Audit Procedure

In OpenShift 4, the kube-proxy runs within the sdn pods, which copies the kubeconfig from a configmap to the container at /tmp/kubeconfig, with root:root ownership.

Run the following command:

for i in $(oc get pods -n openshift-sdn -l app=sdn -oname)
do
  oc exec -n openshift-sdn $i -- \
    stat -Lc %U:%G /config/kube-proxy-config.yaml
done

Verify that the kube-proxy-config.yaml file has ownership root:root.

Remediation

None required. The configuration is managed by OpenShift operators.

Default Value

By default, proxy file ownership is set to root:root.

References

1. https://docs.openshift.com/container-platform/4.5/networking/openshift_sdn/configuring-kube-proxy.html
2. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-proxy/

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v8	5.4 Restrict Administrator Privileges to Dedicated Administrator Accounts	*	*	*