V2R1 changes
Mirantis Kubernetes Engine STIG V2R1 (2024-07-24) replaced V1R1 (2024-05-08): 7 checks updated. It has 44 checks, against 44 in V1R1.
V2R1 checklistV1R1 checklist Compare V1R1 and V2R1 in STIG Compare
- 0 added
- 0 removed
- 7 updated
Updated fields: CCIs 6Fix text 2
Updated in V2R1 (7)
V-260903CAT IIThe Lifetime Minutes and Renewal Threshold Minutes Login Session Controls on MKE must be set.CCIs
V-260906CAT ILeast privilege access and need to know must be required to access MKE runtime and instantiate container images.CCIs
V-260909CAT IIMKE must be configured to integrate with an Enterprise Identity Provider.Fix text, CCIs
Fix text
To configure Identity Provider.
Log, log in to the MKE web UI and navigate to admin >> Admin Settings >> Authentication & Authorization >> Identity Provider Integration section.
To configure LDAP:
Click the radial button to set LDAP to "Enabled".
In the "LDAP Server" subsection set the following:
- "LDAP Server URL" to the URL for the organization's AD or LDAP server (URL must be https).
- "Reader DN" with the DN of the account used to search the LDAP entries.
- "Reader Password" with the password for the Reader account.
Click "Save".
To configure SAML:
Click, click the radial button to set SAML to "Enabled".
Enter URL in the "Service Provider Metadata URL" field.
Upload the certificate bundle for the IdP provider in "Root Certificates Bundle".
In the "SAML Service Provider" section, enter the "MKE IP address" in the MKE Host field.
Click "Save".
CCIs
CCI-000015,CCI-000016,CCI-000017,CCI-000044,CCI-000765,CCI-000766,CCI-000767004045,CCI-000768001941,CCI-000770003627,CCI-001942004066,CCI-000795004061,CCI-000205,CCI-000200,CCI-000192,CCI-000193,CCI-000194,CCI-001619,CCI-000195,CCI-000198,CCI-000199,CCI-000187,CCI-001683004045,CCI-001684,CCI-001685,CCI-001686,CCI-002142,CCI-002145,CCI-002130,CCI-002132,CCI-002238,CCI-001814003938,CCI-001953,CCI-002041,CCI-002009,CCI-002699,CCI-000172,CCI-000366
V-260911CAT IISwarm Secrets or Kubernetes Secrets must be used.CCIs
V-260938CAT IIDocker CLI commands must be run with an MKE client trust bundle and without unnecessary permissions.CCIs
V-260942CAT IIMKE must only run signed images.CCIs
V-260946CAT IIIMKE must display the Standard Mandatory DOD Notice and Consent Banner before granting access to platform components.Fix text
Fix text
Configure MKE to display the Standard Mandatory DOD Notice and Consent Banner before granting access to MKE:
Modify the existing MKE configuration:
Working as an MKE admin, use the config-toml API from within the directory of the client certificate bundle to export the current MKE settings to a TOML file (mke-config.toml).
1. Define the following environment variables:
export MKE_USERNAME=<mke-username>
export MKE_PASSWORD=<mke-password>
export MKE_HOST=<mke-fqdm-or-ip-address>
2. Obtain and define an AUTHTOKEN environment variable by executing the following:
AUTHTOKEN=$(curl --silent --insecure --data '{"username":"'$MKE_USERNAME'","password":"'$MKE_PASSWORD'"}' https://$MKE_HOST/auth/login | jq --raw-output .auth_token)
3. Download the current MKE configuration file by executing the following:
curl --silent --insecure -X GET "https://$MKE_HOST/api/MKE/config-toml" -H "accept: application/toml" -H "Authorization: Bearer $AUTHTOKEN" > mke-config.toml
4. Edit the MKE configuration (mke-config.toml) modify "pre_logon_message" settings to match the Standard Mandatory DOD Notice and Consent Banner.
Example:
pre_logon_message = "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions :1n1n-The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations.1n1n-At any time, the USG may inspect and seize data stored on this IS.1n1n-Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose.1n1n-This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy.1n1n-Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."
5. Upload the edited MKE configuration file by executing the following:
curl --silent --insecure -X PUT -H "accept: application/toml" -H "Authorization: Bearer $AUTHTOKEN" --upload-file 'mke-config.toml' https://$MKE_HOST/api/MKE/config-toml
Note: Users may need to reacquire the AUTHTOKEN, if significant time has passed since it was first acquired.
6. Log in to MKE and verify that the Standard Mandatory DOD Notice and Consent Banner is being displayed before granting access.
How these changes are found
Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V2R1 no longer has.
Comparing other releases, or this one against an older release? Pick any two in STIG Compare.