cis-ocp-v170-1-2-26

name	cis-ocp-v170-1.2.26
description	Ensure that the --service-account-key-file argument is set as appropriate (Manual)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","control-plane","api-server"]
cis_id	1.2.26
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.26

Profile Applicability

• Level: 1

Description

Explicitly set a service account public key file for service accounts on the apiserver.

Rationale

By default, if no --service-account-key-file is specified to the apiserver, it uses the private key from the TLS serving certificate to verify service account tokens. To ensure that the keys for service account tokens could be rotated as needed, a separate public/private key pair should be used for signing service account tokens. Hence, the public key should be specified to the apiserver with --service-account-key-file.

Impact

The corresponding private key must be provided to the controller manager. You would need to securely maintain the key file and rotate the keys based on your organization's key rotation policy.

Audit Procedure

OpenShift API server does not use the service-account-key-file argument. OpenShift does not reuse the apiserver TLS key. The ServiceAccount token authenticator is configured with serviceAccountConfig.publicKeyFiles. OpenShift automatically manages and rotates the keys.

Run the following command:

oc get configmap config -n openshift-kube-apiserver -ojson | \
  jq -r '.data["config.yaml"]' | \
  jq -r '.serviceAccountPublicKeyFiles[]'

Verify that the following is returned: /etc/kubernetes/static-pod-resources/configmaps/sa-token-signing-certs /etc/kubernetes/static-pod-resources/configmaps/bound-sa-token-signing-certs

Remediation

The OpenShift API server does not use the service-account-key-file argument. The ServiceAccount token authenticator is configured with serviceAccountConfig.publicKeyFiles. OpenShift does not reuse the apiserver TLS key. This is not configurable.

Default Value

The OpenShift API server does not use the service-account-key-file argument. The ServiceAccount token authenticator is configured with serviceAccountConfig.publicKeyFiles. OpenShift does not reuse the apiserver TLS key.

References

1. https://docs.openshift.com/container-platform/4.5/operators/operator-reference.html#kube-apiserver-operator_red-hat-operators