Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

To fix CMP-2548 #12008

Merged
merged 6 commits into from
Jun 25, 2024
Merged

To fix CMP-2548 #12008

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
a582345
To fix CMP-2548
rutvik23 May 20, 2024
651cfa9
modifying rule content and selection criteria
rutvik23 Jun 14, 2024
35f5869
adding warning section
rutvik23 Jun 17, 2024
028049f
fixing whitespaces in warning section
rutvik23 Jun 17, 2024
c378c08
updating platform check and tests
rutvik23 Jun 24, 2024
3beb2f6
fixing e2e assertions
rutvik23 Jun 24, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 8 additions & 9 deletions applications/openshift/controller/controller_rotate_kubelet_server_certs/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,26 +43,25 @@ platform: not ocp4-on-hypershift-hosted

ocil_clause: |-
<tt>RotateKubeletServerCertificate</tt> argument is set to <tt>false</tt> in the
<tt>controllerArguments</tt> options
<tt>kubeletconfig</tt> options
rutvik23 marked this conversation as resolved.
Show resolved Hide resolved

ocil: |-
To verify that <tt>RotateKubeletServerCertificate</tt> is configured correctly,
run the following command:
<pre>$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["feature-gates"]'</pre>
The output should return <tt>RotateKubeletServerCertificate=true</tt>.
The output should return <tt>RotateKubeletServerCertificate=true</tt>

identifiers:
cce@ocp4: CCE-83730-2

warnings:
- general: |-
{{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}
rutvik23 marked this conversation as resolved.
Show resolved Hide resolved
- functionality: |-
rutvik23 marked this conversation as resolved.
Show resolved Hide resolved
This recommendation only applies if you let kubelets get their
certificates from the API Server. In case your certificates come from an
outside Certificate Authority/tool (e.g. Vault) then you need to take care
of rotation yourself

In OpenShift 4, the kubelete certification rotation is enabled by default.
rutvik23 marked this conversation as resolved.
Show resolved Hide resolved
Openshift v4 automatically generates a new kube-apiserver-to-kubelet-signer CA certificates at 292
days, removes old CA certificate after 365 days, and the kubelet-client, kubelet-server
certs are auto-rotated once every month. Hence, this rule is deprecated and not-applicable.
ref: https://access.redhat.com/articles/5651701

references:
nerc-cip: CIP-003-8 R4.2,CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R5.1,CIP-007-3 R6.1
nist: CM-6,CM-6(1),SC-8,SC-8(1)
Expand Down
2 changes: 1 addition & 1 deletion applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/e2e.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,2 +1,2 @@
---
default_result: PASS
default_result: NOT-APPLICABLE
yuumasato marked this conversation as resolved.
Show resolved Hide resolved
4 changes: 0 additions & 4 deletions controls/nist_ocp4.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4898,7 +4898,6 @@ controls:
- file_owner_proxy_kubeconfig
- file_groupowner_etcd_data_files
- api_server_auth_mode_node
- controller_rotate_kubelet_server_certs
- api_server_openshift_https_serving_cert
- api_server_service_account_lookup
- file_groupowner_openshift_pki_cert_files
Expand Down Expand Up @@ -5121,7 +5120,6 @@ controls:
- file_owner_proxy_kubeconfig
- file_groupowner_etcd_data_files
- api_server_auth_mode_node
- controller_rotate_kubelet_server_certs
- api_server_openshift_https_serving_cert
- api_server_service_account_lookup
- file_groupowner_openshift_pki_cert_files
Expand Down Expand Up @@ -13887,7 +13885,6 @@ controls:
- etcd_peer_client_cert_auth
- controller_secure_port
- etcd_peer_cert_file
- controller_rotate_kubelet_server_certs
- api_server_openshift_https_serving_cert
- api_server_etcd_key
- kubelet_configure_tls_cert
Expand Down Expand Up @@ -13943,7 +13940,6 @@ controls:
- etcd_peer_client_cert_auth
- controller_secure_port
- etcd_peer_cert_file
- controller_rotate_kubelet_server_certs
- api_server_openshift_https_serving_cert
- api_server_etcd_key
- kubelet_configure_tls_cert
Expand Down
1 change: 0 additions & 1 deletion controls/srg_ctr/SRG-APP-000516-CTR-001325.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,6 @@ controls:
- ocp_api_server_audit_log_maxbackup
- ocp_api_server_audit_log_maxsize
- controller_insecure_port_disabled
- controller_rotate_kubelet_server_certs
- controller_secure_port
- controller_service_account_ca
- controller_service_account_private_key
Expand Down
1 change: 0 additions & 1 deletion products/ocp4/profiles/stig-v1r1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,6 @@ selections:
- api_server_tls_cipher_suites
- api_server_token_auth
- controller_insecure_port_disabled
- controller_rotate_kubelet_server_certs
- controller_secure_port
- controller_service_account_ca
- controller_service_account_private_key
Expand Down
Loading