OpenShift must enforce network policy on the namespace for controlling the flow of information within the container platform based on organization-defined information flow control policies.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257514	CNTR-OS-000100	SV-257514r921485_rule		Medium

Description
OpenShift provides several layers of protection to control the flow of information between the container platform components and user services. Each user project is given a separate namespace and OpenShift enforces RBAC policies controlling which projects and services users can access. OpenShift forces the use of namespaces. Service accounts are a namespace resource as well, so they are segregated. RBAC policies apply to service accounts. In addition, Network Policies are used to control the flow of requests between containers hosted on the container platform. It is important to define a default Network Policy on the namespace that will be applied automatically to new projects to prevent unintended requests. These policies can be updated by the project's administrator (with the appropriate RBAC permissions) to apply a policy that is appropriate to the service(s) within the project namespace.

Description

OpenShift provides several layers of protection to control the flow of information between the container platform components and user services. Each user project is given a separate namespace and OpenShift enforces RBAC policies controlling which projects and services users can access. OpenShift forces the use of namespaces. Service accounts are a namespace resource as well, so they are segregated. RBAC policies apply to service accounts. In addition, Network Policies are used to control the flow of requests between containers hosted on the container platform. It is important to define a default Network Policy on the namespace that will be applied automatically to new projects to prevent unintended requests. These policies can be updated by the project's administrator (with the appropriate RBAC permissions) to apply a policy that is appropriate to the service(s) within the project namespace.

STIG	Date
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide	2023-08-28

Details

Check Text ( C-61249r921483_chk )
Verify that each user namespace has a Network Policy by executing the following: for ns in $(oc get namespaces -ojson \| jq -r '.items[] \| select((.metadata.name \| startswith("openshift") \| not) and (.metadata.name \| startswith("kube-") \| not) and .metadata.name != "default") \| .metadata.name '); do oc get networkpolicy -n$ns; done If the above returns any lines saying "No resources found in namespace.", this is a finding. Empty output is not a finding.

Check Text ( C-61249r921483_chk )

Verify that each user namespace has a Network Policy by executing the following:

for ns in $(oc get namespaces -ojson | jq -r '.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default") | .metadata.name '); do oc get networkpolicy -n$ns; done

If the above returns any lines saying "No resources found in namespace.", this is a finding. Empty output is not a finding.

Fix Text (F-61173r921484_fix)
Add a Network Policy to an existing project namespace by performing the following steps: 1. Create .yaml and insert the desired resource Network Policy content. The following is an example resource quota definition: apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: allow-from-same-namespace namespace: spec: podSelector: {} ingress: - from: - podSelector: {} 2. Apply the Network Policy definition to the project namespace by executing the following: oc apply -f .yaml -n Details regarding the configuration of resource Network Policy can be reviewed at https://docs.openshift.com/container-platform/4.12/networking/network_policy/about-network-policy.html.

Fix Text (F-61173r921484_fix)

Add a Network Policy to an existing project namespace by performing the following steps:

1. Create .yaml and insert the desired resource Network Policy content. The following is an example resource quota definition:

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-same-namespace
namespace:
spec:
podSelector: {}
ingress:
- from:
- podSelector: {}

2. Apply the Network Policy definition to the project namespace by executing the following:

oc apply -f .yaml -n

Details regarding the configuration of resource Network Policy can be reviewed at https://docs.openshift.com/container-platform/4.12/networking/network_policy/about-network-policy.html.