CIS Red Hat OpenShift Container Platform Benchmark

Secure configuration guidelines for Red Hat OpenShift Container Platform 4

v1.6.0 February 2025

Overview

▶

This CIS Benchmark provides prescriptive guidance for establishing a secure configuration posture for Red Hat OpenShift Container Platform 4. Recommendations cover control plane components, worker nodes, RBAC and authentication, networking, pod security, and logging and monitoring.

~140Recommendations
6Sections
2Profile Levels
SectionAreaFocus
1Control PlaneAPI server, etcd
2Worker NodesKubelet, node security
3RBAC/AuthRoles, identity providers
4NetworkingPolicies, routes, ingress
5Pod SecuritySCCs, image security
6LoggingLogging operator, Prometheus

Profile Definitions

▶
ProfileDescriptionIntended Use
L1Level 1 — StandardEssential security for all Red Hat OpenShift deployments; minimal performance impact.
L2Level 2 — HardenedAdvanced hardening for PCI-DSS, HIPAA, or high-security environments.

1 — Control Plane Components

▶

1.1 API Server

▶
1.1.1 Ensure API Server Anonymous Auth Is Disabled (Automated)
L1 Auto
Description

This recommendation verifies that API Server Anonymous Auth Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that API Server Anonymous Auth Is Disabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.1.2 Ensure API Server Basic Auth Is Not Used (Automated)
L1 Auto
Description

This recommendation verifies that API Server Basic Auth Is Not Used on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that API Server Basic Auth Is Not Used:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.1.3 Ensure API Server Audit Logging Is Enabled (Automated)
L1 Auto
Description

This recommendation verifies that API Server Audit Logging Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that API Server Audit Logging Is Enabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.1.4 Ensure API Server TLS Certificates Are Configured (Automated)
L1 Auto
Description

This recommendation verifies that API Server TLS Certificates Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that API Server TLS Certificates Are Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.1.5 Ensure API Server Admission Controllers Are Configured (Automated)
L1 Auto
Description

This recommendation verifies that API Server Admission Controllers Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that API Server Admission Controllers Are Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.2 Controller Manager & Scheduler

▶
1.2.1 Ensure Controller Manager Bind Address Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that Controller Manager Bind Address Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Controller Manager Bind Address Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.2.2 Ensure Controller Manager Profiling Is Disabled (Automated)
L1 Auto
Description

This recommendation verifies that Controller Manager Profiling Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that Controller Manager Profiling Is Disabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.2.3 Ensure Scheduler Bind Address Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that Scheduler Bind Address Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Scheduler Bind Address Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.2.4 Ensure Scheduler Profiling Is Disabled (Automated)
L1 Auto
Description

This recommendation verifies that Scheduler Profiling Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that Scheduler Profiling Is Disabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.3 etcd

▶
1.3.1 Ensure etcd Peer TLS Is Enabled (Automated)
L1 Auto
Description

This recommendation verifies that etcd Peer TLS Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that etcd Peer TLS Is Enabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.3.2 Ensure etcd Client TLS Is Enabled (Automated)
L1 Auto
Description

This recommendation verifies that etcd Client TLS Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that etcd Client TLS Is Enabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

1.3.3 Ensure etcd Data Is Encrypted at Rest (Automated)
L1 Auto
Description

This recommendation verifies that etcd Data Is Encrypted at Rest on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that etcd Data Is Encrypted at Rest:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2 — Worker Nodes

▶

2.1 Kubelet Configuration

▶
2.1.1 Ensure Kubelet Anonymous Auth Is Disabled (Automated)
L1 Auto
Description

This recommendation verifies that Kubelet Anonymous Auth Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that Kubelet Anonymous Auth Is Disabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.1.2 Ensure Kubelet Authorization Mode Is Not AlwaysAllow (Automated)
L1 Auto
Description

This recommendation verifies that Kubelet Authorization Mode Is Not AlwaysAllow on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that Kubelet Authorization Mode Is Not AlwaysAllow:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.1.3 Ensure Kubelet Client Certificate Rotation Is Enabled (Automated)
L1 Auto
Description

This recommendation verifies that Kubelet Client Certificate Rotation Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Kubelet Client Certificate Rotation Is Enabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.1.4 Ensure Kubelet Read-Only Port Is Disabled (Automated)
L1 Auto
Description

This recommendation verifies that Kubelet Read-Only Port Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that Kubelet Read-Only Port Is Disabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.1.5 Ensure Kubelet Streaming Connection Idle Timeout Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that Kubelet Streaming Connection Idle Timeout Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Kubelet Streaming Connection Idle Timeout Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.2 Node Security

▶
2.2.1 Ensure Node File Permissions Are Restricted (Automated)
L1 Auto
Description

This setting ensures that Node File Permissions Are Restricted on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Rationale

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.

Audit

Run the following command and verify that Node File Permissions Are Restricted:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.2.2 Ensure Machine Config Pools Are Configured (Automated)
L1 Auto
Description

This recommendation verifies that Machine Config Pools Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Machine Config Pools Are Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.2.3 Ensure CoreOS Auto-Update Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that CoreOS Auto-Update Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that CoreOS Auto-Update Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

2.2.4 Ensure SELinux Is Enforcing on Nodes (Automated)
L1 Auto
Description

This recommendation verifies that SELinux Is Enforcing on Nodes on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that SELinux Is Enforcing on Nodes:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3 — RBAC & Authentication

▶

3.1 RBAC Configuration

▶
3.1.1 Ensure Cluster-Admin Role Is Minimized (Manual)
L1 Manual
Description

This setting ensures that Cluster-Admin Role Is Minimized on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Rationale

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.

Audit

Run the following command and verify that Cluster-Admin Role Is Minimized:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.1.2 Ensure Service Account Tokens Are Not Automounted (Automated)
L1 Auto
Description

This recommendation verifies that Service Account Tokens Are Not Automounted on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Service Account Tokens Are Not Automounted:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.1.3 Ensure Default Service Accounts Are Restricted (Automated)
L1 Auto
Description

This setting ensures that Default Service Accounts Are Restricted on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Rationale

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.

Audit

Run the following command and verify that Default Service Accounts Are Restricted:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.1.4 Ensure Roles and ClusterRoles Are Reviewed (Manual)
L1 Manual
Description

This recommendation verifies that Roles and ClusterRoles Are Reviewed on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Roles and ClusterRoles Are Reviewed:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.2 Identity Providers

▶
3.2.1 Ensure OAuth Identity Provider Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that OAuth Identity Provider Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that OAuth Identity Provider Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.2.2 Ensure HTPasswd Provider Is Not Used in Production (Manual)
L1 Manual
Description

This recommendation verifies that HTPasswd Provider Is Not Used in Production on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that HTPasswd Provider Is Not Used in Production:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.2.3 Ensure LDAP or OIDC Provider Uses TLS (Automated)
L1 Auto
Description

This recommendation verifies that LDAP or OIDC Provider Uses TLS on the Red Hat OpenShift container platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Rationale

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Red Hat OpenShift container platform uses the correct component aligns with industry best practices and standards.

Audit

Run the following command and verify that LDAP or OIDC Provider Uses TLS:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

3.2.4 Ensure kubeadmin User Is Removed After Configuration (Manual)
L1 Manual
Description

This recommendation verifies that kubeadmin User Is Removed After Configuration on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that kubeadmin User Is Removed After Configuration:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4 — Networking

▶

4.1 Network Configuration

▶
4.1.1 Ensure Network Policies Are Defined (Automated)
L1 Auto
Description

This recommendation verifies that Network Policies Are Defined on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Network Policies Are Defined:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4.1.2 Ensure Default Project Network Policies Are Configured (Automated)
L1 Auto
Description

This recommendation verifies that Default Project Network Policies Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Default Project Network Policies Are Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4.1.3 Ensure Egress Firewall Is Configured (Automated)
L2 Auto
Description

This recommendation verifies that Egress Firewall Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Egress Firewall Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4.1.4 Ensure Multus CNI Plugins Are Reviewed (Manual)
L2 Manual
Description

This recommendation verifies that Multus CNI Plugins Are Reviewed on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Multus CNI Plugins Are Reviewed:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4.2 Ingress & Routes

▶
4.2.1 Ensure Routes Use TLS Termination (Automated)
L1 Auto
Description

This recommendation verifies that Routes Use TLS Termination on the Red Hat OpenShift container platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Rationale

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Red Hat OpenShift container platform uses the correct component aligns with industry best practices and standards.

Audit

Run the following command and verify that Routes Use TLS Termination:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4.2.2 Ensure Ingress Controller TLS Security Profile Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that Ingress Controller TLS Security Profile Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Ingress Controller TLS Security Profile Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

4.2.3 Ensure Wildcard Routes Are Disabled (Automated)
L1 Auto
Description

This recommendation verifies that Wildcard Routes Are Disabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Wildcard Routes Are Disabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5 — Pod Security

▶

5.1 Security Context Constraints

▶
5.1.1 Ensure SCCs Are Configured with Least Privilege (Manual)
L1 Manual
Description

This recommendation verifies that SCCs Are Configured with Least Privilege on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that SCCs Are Configured with Least Privilege:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.1.2 Ensure Privileged SCC Is Not Assigned to General Users (Automated)
L1 Auto
Description

This recommendation verifies that Privileged SCC Is Not Assigned to General Users on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Rationale

Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

Audit

Run the following command and verify that Privileged SCC Is Not Assigned to General Users:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.1.3 Ensure Containers Run as Non-Root (Automated)
L1 Auto
Description

This recommendation verifies that Containers Run as Non-Root on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Containers Run as Non-Root:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.1.4 Ensure Read-Only Root Filesystem Is Used (Automated)
L2 Auto
Description

This recommendation verifies that Read-Only Root Filesystem Is Used on the Red Hat OpenShift container platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.

Rationale

Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Red Hat OpenShift container platform uses the correct component aligns with industry best practices and standards.

Audit

Run the following command and verify that Read-Only Root Filesystem Is Used:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.1.5 Ensure Host Network and PID Namespaces Are Not Shared (Automated)
L1 Auto
Description

This recommendation verifies that Host Network and PID Namespaces Are Not Shared on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Host Network and PID Namespaces Are Not Shared:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.2 Image & Registry Security

▶
5.2.1 Ensure Internal Registry Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that Internal Registry Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Internal Registry Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.2.2 Ensure Image Content Policies Are Configured (Automated)
L1 Auto
Description

This recommendation verifies that Image Content Policies Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Image Content Policies Are Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.2.3 Ensure Image Signature Verification Is Enabled (Automated)
L2 Auto
Description

This recommendation verifies that Image Signature Verification Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Image Signature Verification Is Enabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

5.2.4 Ensure Allowed Registries Are Restricted (Automated)
L1 Auto
Description

This setting ensures that Allowed Registries Are Restricted on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Rationale

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.

Audit

Run the following command and verify that Allowed Registries Are Restricted:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6 — Logging & Monitoring

▶

6.1 Cluster Logging

▶
6.1.1 Ensure Cluster Logging Operator Is Installed (Automated)
L1 Auto
Description

This recommendation verifies that Cluster Logging Operator Is Installed on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Cluster Logging Operator Is Installed:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6.1.2 Ensure Audit Logs Are Forwarded to SIEM (Automated)
L2 Auto
Description

This recommendation verifies that Audit Logs Are Forwarded to SIEM on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Audit Logs Are Forwarded to SIEM:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6.1.3 Ensure Log Retention Policy Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that Log Retention Policy Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Log Retention Policy Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6.2 Monitoring & Alerting

▶
6.2.1 Ensure Cluster Monitoring Operator Is Running (Automated)
L1 Auto
Description

This recommendation verifies that Cluster Monitoring Operator Is Running on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Cluster Monitoring Operator Is Running:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6.2.2 Ensure AlertManager Is Configured (Automated)
L1 Auto
Description

This recommendation verifies that AlertManager Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that AlertManager Is Configured:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6.2.3 Ensure Prometheus Metrics Are Collected (Automated)
L1 Auto
Description

This recommendation verifies that Prometheus Metrics Are Collected on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that Prometheus Metrics Are Collected:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.

6.2.4 Ensure User Workload Monitoring Is Enabled (Automated)
L2 Auto
Description

This recommendation verifies that User Workload Monitoring Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Rationale

Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Audit

Run the following command and verify that User Workload Monitoring Is Enabled:

oc get ... -o yaml | grep ...
Alternatively, review the configuration via the OpenShift web console.

Remediation

Apply the configuration using the OpenShift CLI:

oc patch ... --type merge -p '...'
Alternatively, update the configuration via the OpenShift web console.