SV-242450r961863: The Kubernetes Kubelet certificate authority must be owned by root. | Kubernetes STIG SCAP Benchmark

Loading benchmark…

Assessment Title

Rule Text

The Kubernetes Kubelet certificate authority must be owned by root.

Description

Discussion Text

The Kubernetes kube proxy kubeconfig contain the argument and setting for the Control Planes. These settings contain network rules for restricting network communication between pods, clusters, and networks. If these files can be changed, data traversing between the Kubernetes Control Panel components would be compromised. Many of the security settings within the document are implemented through this file.

How this relates to the STIG checklist: STIG vs SCAP benchmark.

IA Controls

NIST SP 800-53

Not mappedCCI-000366

References

DPMS Target Kubernetes DISA DPMS Target Kubernetes 5376

Checks

DISA STIG (Manual Reference)

On the Control Plane, run the command:
ps -ef | grep kubelet

If the "client-ca-file" option exists, this is a finding. 

Note the path to the config file (identified by --config).

Run the command:
grep -i clientCAFile <path_to_config_file>

Note the path to the client ca file.

Run the command:
stat -c %U:%G <path_to_client_ca_file>

If the command returns any non root:root file permissions, this is a finding.

SCC Automation Reference

The reconstructed evaluation script behind this rule's OVAL check(s) — every module a compound check combines, with this rule's own concrete values and DISA's SCC tool's real per-module mechanism curated from static teardown of SCC releases.

#!/bin/bash
# Reconstructed from oval:mil.disa.stig.kubernetes:def:242450
# The Kubernetes Kubelet certificate authority must be owned by root.
# Per-module read mechanism curated from static teardown of DISA's SCC tool
# (SCAP Compliance Checker) -- see the SCC Automation Reference above.
#
# MANUAL REVIEW REQUIRED -- the module(s) below could not be reconstructed
# into working code from curated SCC reference data, and are excluded from
# the automated result:
#   - file_object (file_test): no extractor for field "group_id"

# process58_object (process58_test)
test_2() {
  ! ( ps -eo args | grep -P '/usr/bin/kubelet\b.*--client-ca-file\b' &>/dev/null )
}

if test_2; then
  echo "PASS (automated portion only -- MANUAL REVIEW still required, see notes above)"
else
  echo "FAIL (or see MANUAL REVIEW note above)"
fi

Remediation

On the Control Plane, run the command:
ps -ef | grep kubelet

Remove the "client-ca-file" option.

Note the path to the config file (identified by --config).

Run the command:
grep -i clientCAFile <path_to_config_file>

Note the path to the client ca file.

Run the command:
chown root:root <path_to_client_ca_file>