Ensure that the OpenShift PKI certificate file permissions are set to 600 or more restrictive

높음레벨 1수동 검토openshift

설명

Ensure that OpenShift PKI certificate files have permissions of 644 or more restrictive. The benchmark marks this recommendation Manual.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

Certificates for control plane components like kube-apiserver, kube-controller-manager, and kube-scheduler are stored in the directory /etc/kubernetes/static-pod-certs/secrets. Certificate files all have permissions 600. Run the following command. # Should 600 or more restrictive for i in $(oc -n openshift-kube-apiserver get pod -l app=openshift-kube-apiserver -o jsonpath='{.items[*].metadata.name}') do echo $i static-pod-certs oc exec -n openshift-kube-apiserver $i -c kube-apiserver -- \ find /etc/kubernetes/static-pod-certs -type f -wholename '*/secrets/*.crt' -exec stat -c %a {} ...

조치 방법

조치 방식: 가이드 또는 인프라 패치

No remediation required; file permissions are managed by the operator.

속성

운영 체제: 모두
태그: openshiftcontrol-planefile-permissions
참고 자료: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.1.20 Ensure that the OpenShift PKI certificate file permissions are set to 600 or more restrictive