cis-ocp-v170-4-1-10

name	cis-ocp-v170-4.1.10
description	Ensure that the kubelet configuration file ownership is set to root:root (Automated)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","worker-node","config-files"]
cis_id	4.1.10
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 4.1.10

Profile Applicability

• Level: 1

Description

Ensure that if the kubelet refers to a configuration file with the --config argument, that file is owned by root:root.

Rationale

The kubelet reads various parameters, including security settings, from a config file specified by the --config argument. If this file is specified you should restrict its file permissions to maintain the integrity of the file. The file should be owned by root:root.

Impact

None

Audit Procedure

In OpenShift 4, the kubelet configuration file is managed by the Machine Config Operator and is found at /var/lib/kubelet/config.json or /var/data/kubelet/config.json with ownership set to root:root.

In OpenShift 4.13 and above, run the following command to check the permission:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
  oc debug node/${node} -- chroot /host stat -c %a /var/data/kubelet/config.json
done

For Earlier Versions, run the following command to check the permission:

for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}')
do
  oc debug node/${node} -- chroot /host stat -c %a /var/lib/kubelet/config.json
done

Verify that the ownership is set to root:root.

Remediation

None.

Default Value

By default, /var/lib/kubelet/config.json file is owned by root:root.

References

1. https://docs.openshift.com/container-platform/latest/architecture/control-plane.html#understanding-machine-config-operator_control-plane