用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill cis-ocp-v170-1-2-18命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
基于 SOC 职业分类
正在显示 SKILL.md
| name | cis-ocp-v170-1.2.18 |
| description | Ensure that the --secure-port argument is not set to 0 (Manual) |
| category | cis-openshift |
| version | 1.7.0 |
| author | cyberstrike-official |
| tags | ["cis","openshift","kubernetes","redhat","control-plane","api-server"] |
| cis_id | 1.2.18 |
| cis_benchmark | CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 |
| tech_stack | ["kubernetes","openshift","redhat"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Do not disable the secure port.
The secure port is used to serve https with authentication and authorization. If you disable it, no https traffic is served and all traffic is served unencrypted.
You need to set the API Server up with the right TLS certificates.
The openshift-kube-apiserver is served over HTTPS with authentication and authorization; the secure API endpoint is bound to 0.0.0.0:6443 by default. In OpenShift, the only supported way to access the API server pod is through the load balancer and then through the internal service. The value is set by the bindAddress argument under the servingInfo parameter.
Run the following command:
oc get kubeapiservers.operator.openshift.io cluster -o json | jq '.spec.observedConfig.servingInfo.bindAddress'
Verify the bind address is 0.0.0.0:6443.
oc get pods -n openshift-kube-apiserver -l app=openshift-kube-apiserver -o jsonpath='{.items[*].spec.containers[?(@.name=="kube-apiserver")].ports[*].containerPort}'
Verify the ports returned are 6443.
None.
By default, the openshift-kube-apiserver is served over HTTPS with authentication and authorization; the secure API endpoint is bound to 0.0.0.0:6443. Note that the openshift-apiserver is not running in the host network namespace. The port is not exposed on the node, but only through the pod network.
The OpenShift platform manages the TLS certificates for the API servers. External access is only available through the load balancer and then through the internal service.
| Controls Version | Control | IG 1 | IG 2 | IG 3 |
|---|---|---|---|---|
| v8 | 3.10 Encrypt Sensitive Data in Transit | * | * | |
| v7 | 14.4 Encrypt All Sensitive Information in Transit | * | * |
| Techniques / Sub-techniques | Tactics | Mitigations |
|---|---|---|
| T1609 | TA0002 | M1035 |
Level 1 (Manual)