Menú
De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.
Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.
Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.
Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v170-1-3-4El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.
¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.
Basado en la clasificación ocupacional SOC
Mostrando SKILL.md
| name | cis-ocp-v170-1.3.4 |
| description | Ensure --root-ca-file set as appropriate (Manual) |
| category | cis-openshift |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","control-plane","controller-manager"] |
| cis_id | 1.3.4 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 |
| tech_stack | ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Allow pods to verify the API server's serving certificate before establishing connections.
Processes running within pods that need to contact the API server must verify the API server's serving certificate. Failing to do so could be a subject to man-in-the-middle attacks.
Providing the root certificate for the API server's serving certificate to the controller manager with the --root-ca-file argument allows the controller manager to inject the trusted bundle into pods so that they can verify TLS connections to the API server.
OpenShift clusters manage and maintain certificate authorities and certificates for cluster components.
Certificates for OpenShift platform components are automatically created and rotated by the OpenShift Container Platform.
Run the following command:
oc get configmaps config -n openshift-kube-controller-manager -ojson | \
jq -r '.data["config.yaml"]' | \
jq -r '.extendedArguments["root-ca-file"][]'
Verify that the --root-ca-file argument exists and is set to /etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt.
None.
By default, OpenShift sets the Kubernetes Controller Manager root-ca-file to /etc/kubernetes/static-pod-resources/configmaps/serviceaccount-ca/ca-bundle.crt.
Certificates for OpenShift platform components are automatically created and rotated by the OpenShift Container Platform.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 13.10 Perform Application Layer Filtering | * | ||
| v7 | 4.4 Use Unique Passwords | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1552 | TA0006 | M1022 |
Level 1 (Manual)