The Kubernetes API server must have Alpha APIs disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-242400	CNTR-K8-000470	SV-242400r960792_rule		Medium

Description

Kubernetes allows alpha API calls within the API server. The alpha features are disabled by default since they are not ready for production and likely to change without notice. These features may also contain security issues that are rectified as the feature matures. To keep the Kubernetes cluster secure and stable, these alpha features must not be used.

STIG	Date
Kubernetes Security Technical Implementation Guide	2024-08-22

Details

Check Text (C-45675r927094_chk)

On the Control Plane, change to the manifests' directory at /etc/kubernetes/manifests and run the command:
grep -i feature-gates *

Review the "--feature-gates" setting, if one is returned.

If the "--feature-gate"s setting is available and contains the "AllAlpha" flag set to "true", this is a finding.

Fix Text (F-45633r927095_fix)

Edit any manifest file that contains the "--feature-gates" setting with "AllAlpha" set to "true".

Set the value of "AllAlpha" to "false" or remove the setting completely. (AllAlpha - default=false)