cis-ocp-v170-4-1-9

name	cis-ocp-v170-4.1.9
description	Ensure that the kubelet --config configuration file has permissions set to 600 or more restrictive (Automated)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","worker-node","config-files"]
cis_id	4.1.9
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 4.1.9

Profile Applicability

• Level: 1

Description

Ensure that if the kubelet refers to a configuration file with the --config argument, that file has permissions of 600 or more restrictive.

Rationale

The kubelet reads various parameters, including security settings, from a config file specified by the --config argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be writable by only the administrators on the system.

Impact

None

Audit Procedure

In OpenShift 4, the kubelet configuration file is managed by the Machine Config Operator and is found at /var/lib/kubelet/config.json or /var/data/kubelet/config.json with file permissions set to 600.

In OpenShift 4.13 and above, run the following command to check the permission:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
  oc debug node/${node} -- chroot /host stat -c %a /var/data/kubelet/config.json
done

For Earlier Versions, run the following command to check the permission:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
  oc debug node/${node} -- chroot /host stat -c %a /var/lib/kubelet/config.json
done

Verify that the permissions are 600.

Remediation

None.

Default Value

By default, the /var/lib/kubelet/config.json file has permissions of 600.

References

1. https://docs.openshift.com/container-platform/latest/architecture/control-plane.html#understanding-machine-config-operator_control-plane