Allowing users and administrators to schedule containers on all nodes must be disabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-260917	CNTR-MK-000490	SV-260917r966108_rule		Medium

Description
MKE and MSR are set to disallow administrators and users to schedule containers. This setting must be checked for allowing administrators or users to schedule containers may override essential settings, and therefore is not permitted.

STIG	Date
Mirantis Kubernetes Engine Security Technical Implementation Guide	2024-06-17

Details

Check Text ( C-64646r966106_chk )
To ensure this setting has not been modified follow these steps on each node: Log in to the MKE web UI and navigate to admin >> Admin Settings >> Orchestration. Scroll to down "Container Scheduling". Verify that the "Allow administrators to deploy containers on MKE managers or nodes running MSR" is disabled. If it is checked (enabled), this is a finding. Verify that the "Allow users to schedule on all nodes, including MKE managers and MSR nodes" is disabled. If it is checked (enabled), this is a finding.

Check Text ( C-64646r966106_chk )

To ensure this setting has not been modified follow these steps on each node:

Log in to the MKE web UI and navigate to admin >> Admin Settings >> Orchestration. Scroll to down "Container Scheduling".

Verify that the "Allow administrators to deploy containers on MKE managers or nodes running MSR" is disabled. If it is checked (enabled), this is a finding.

Verify that the "Allow users to schedule on all nodes, including MKE managers and MSR nodes" is disabled. If it is checked (enabled), this is a finding.

Fix Text (F-64554r966107_fix)
Set MKE and MSR to disallow administrators and users to schedule containers. Log in to the MKE web UI and navigate to admin >> Admin Settings >> Orchestration. Scroll to down "Container Scheduling". Disable the "Allow administrators to deploy containers on MKE managers or nodes running MSR". Disable "Allow users to schedule on all nodes, including MKE managers and MSR nodes" options. Click "Save".

Fix Text (F-64554r966107_fix)

Set MKE and MSR to disallow administrators and users to schedule containers.

Log in to the MKE web UI and navigate to admin >> Admin Settings >> Orchestration. Scroll to down "Container Scheduling".

Disable the "Allow administrators to deploy containers on MKE managers or nodes running MSR".

Disable "Allow users to schedule on all nodes, including MKE managers and MSR nodes" options.

Click "Save".