cis-ocp-v160-1-2-14

name	cis-ocp-v160-1.2.14
description	Ensure that the admission control plugin SecurityContextConstraint is set (Manual)
category	cis-openshift
version	1.6.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","control-plane","api-server","security-context-constraint"]
cis_id	1.2.14
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.6.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.6.0 - Control 1.2.14

Profile Applicability

• Level: 1

Description

Reject creating pods that do not match Pod Security Policies.

Rationale

A Pod Security Policy is a cluster-level resource that controls the actions a pod can perform and what it has the ability to access. The PodSecurityPolicy objects define a set of conditions that a pod must run with in order to be accepted into the system. Pod Security Policies are composed of settings and strategies that control the security features a pod has access to and hence this must be used to control pod access permissions.

Note: When the PodSecurityPolicy admission plugin is in use, there needs to be at least one PodSecurityPolicy in place for ANY pods to be admitted. See section 5.2 for recommendations on PodSecurityPolicy settings.

Impact

Default Security Context Constraint objects are present on the cluster and granted by default based on roles. Custom SCCs can be created and granted as needed.

Audit Procedure

OpenShift provides the same protection via the SecurityContextConstraints admission plugin, which is enabled by default. The PodSecurityPolicy admission control plugin is disabled by default as it is still beta and not yet supported with OpenShift. Security Context Constraints (SCCs) and Pod Security Policy cannot be used on the same cluster.

Use the following command to obtain a list of configured admission controllers:

oc -n openshift-kube-apiserver get configmap config -o json | jq -r '.data."config.yaml"' | jq '.apiServerArguments."enable-admission-plugins"'

Verify that security.openshift.io/SecurityContextConstraint is returned in the list.

Remediation

None.

Default Value

By default, the SecurityContextConstraints admission controller is configured and cannot be disabled.

References

1. https://docs.openshift.com/container-platform/latest/authentication/managing-security-context-constraints.html
2. https://docs.openshift.com/container-platform/latest/architecture/admission-plug-ins.html
3. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.6/bindata/v4.1.0/config/defaultconfig.yaml#L34-L78