The Kubernetes Kubelet certificate authority must be owned by root.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-242450 | CNTR-K8-003170 | SV-242450r754804_rule | Medium |
| Description |
|---|
| The Kubernetes kube proxy kubeconfig contain the argument and setting for the Master Nodes. These settings contain network rules for restricting network communication between pods, clusters, and networks. If these files can be changed, data traversing between the Kubernetes Control Panel components would be compromised. Many of the security settings within the document are implemented through this file. |
| STIG | Date |
|---|---|
| Kubernetes Security Technical Implementation Guide | 2021-06-17 |
Details
| Check Text ( C-45725r754803_chk ) |
|---|
| Change to the /etc/sysconfig/ directory on the Kubernetes Master Node. Review the ownership of the Kubernetes client-ca-file by using the command: more kubelet --client-ca-file argument Note certificate location Review the ownership of the Kubernetes client-ca-file by using the command: stat -c %U:%G If the command returns any non root:root file permissions, this is a finding. |
| Fix Text (F-45683r712705_fix) |
|---|
| Change the permissions of the Kube Proxy to "root" by executing the command: chown root:root |