Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The Kubernetes API server must have Alpha APIs disabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-242400 | CNTR-K8-000470 | SV-242400r712556_rule | Medium |
| Description |
|---|
| Kubernetes allows alpha API calls within the API server. The alpha features are disabled by default since they are not ready for production and likely to change without notice. These features may also contain security issues that are rectified as the feature matures. To keep the Kubernetes cluster secure and stable, these alpha features must not be used. |
| STIG | Date |
|---|---|
| Kubernetes Security Technical Implementation Guide | 2021-11-22 |
Details
| Check Text ( C-45675r712554_chk ) |
|---|
| On the Master node, change to the manifests' directory at /etc/kubernetes/manifests and run the command: grep -i feature-gates * Review the feature-gates setting, if one is returned. If the feature-gates setting is available and contains the AllAlpha flag set to "true", this is a finding. |
| Fix Text (F-45633r712555_fix) |
|---|
| Edit any manifest files that contain the feature-gates setting with AllAlpha set to "true". Set the flag to "false" or remove the AllAlpha setting completely. (AllAlpha- default=false) |