CIS Red Hat OpenShift Container Platform Benchmark
Secure configuration guidelines for Red Hat OpenShift Container Platform 4
v1.6.0 February 2025Overview
▶This CIS Benchmark provides prescriptive guidance for establishing a secure configuration posture for Red Hat OpenShift Container Platform 4. Recommendations cover control plane components, worker nodes, RBAC and authentication, networking, pod security, and logging and monitoring.
| Section | Area | Focus |
|---|---|---|
| 1 | Control Plane | API server, etcd |
| 2 | Worker Nodes | Kubelet, node security |
| 3 | RBAC/Auth | Roles, identity providers |
| 4 | Networking | Policies, routes, ingress |
| 5 | Pod Security | SCCs, image security |
| 6 | Logging | Logging operator, Prometheus |
Profile Definitions
▶| Profile | Description | Intended Use |
|---|---|---|
| L1 | Level 1 — Standard | Essential security for all Red Hat OpenShift deployments; minimal performance impact. |
| L2 | Level 2 — Hardened | Advanced hardening for PCI-DSS, HIPAA, or high-security environments. |
1 — Control Plane Components
▶1.1 API Server
▶This recommendation verifies that API Server Anonymous Auth Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that API Server Anonymous Auth Is Disabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that API Server Basic Auth Is Not Used on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that API Server Basic Auth Is Not Used:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that API Server Audit Logging Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that API Server Audit Logging Is Enabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that API Server TLS Certificates Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that API Server TLS Certificates Are Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that API Server Admission Controllers Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that API Server Admission Controllers Are Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
1.2 Controller Manager & Scheduler
▶This recommendation verifies that Controller Manager Bind Address Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Controller Manager Bind Address Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Controller Manager Profiling Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that Controller Manager Profiling Is Disabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Scheduler Bind Address Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Scheduler Bind Address Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Scheduler Profiling Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that Scheduler Profiling Is Disabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
1.3 etcd
▶This recommendation verifies that etcd Peer TLS Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that etcd Peer TLS Is Enabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that etcd Client TLS Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that etcd Client TLS Is Enabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that etcd Data Is Encrypted at Rest on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that etcd Data Is Encrypted at Rest:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
2 — Worker Nodes
▶2.1 Kubelet Configuration
▶This recommendation verifies that Kubelet Anonymous Auth Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that Kubelet Anonymous Auth Is Disabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Kubelet Authorization Mode Is Not AlwaysAllow on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that Kubelet Authorization Mode Is Not AlwaysAllow:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Kubelet Client Certificate Rotation Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Kubelet Client Certificate Rotation Is Enabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Kubelet Read-Only Port Is Disabled on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that Kubelet Read-Only Port Is Disabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Kubelet Streaming Connection Idle Timeout Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Kubelet Streaming Connection Idle Timeout Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
2.2 Node Security
▶This setting ensures that Node File Permissions Are Restricted on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.
Run the following command and verify that Node File Permissions Are Restricted:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Machine Config Pools Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Machine Config Pools Are Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that CoreOS Auto-Update Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that CoreOS Auto-Update Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that SELinux Is Enforcing on Nodes on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that SELinux Is Enforcing on Nodes:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
3 — RBAC & Authentication
▶3.1 RBAC Configuration
▶This setting ensures that Cluster-Admin Role Is Minimized on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.
Run the following command and verify that Cluster-Admin Role Is Minimized:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Service Account Tokens Are Not Automounted on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Service Account Tokens Are Not Automounted:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This setting ensures that Default Service Accounts Are Restricted on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.
Run the following command and verify that Default Service Accounts Are Restricted:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Roles and ClusterRoles Are Reviewed on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Roles and ClusterRoles Are Reviewed:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
3.2 Identity Providers
▶This recommendation verifies that OAuth Identity Provider Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that OAuth Identity Provider Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that HTPasswd Provider Is Not Used in Production on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that HTPasswd Provider Is Not Used in Production:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that LDAP or OIDC Provider Uses TLS on the Red Hat OpenShift container platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Red Hat OpenShift container platform uses the correct component aligns with industry best practices and standards.
Run the following command and verify that LDAP or OIDC Provider Uses TLS:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that kubeadmin User Is Removed After Configuration on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that kubeadmin User Is Removed After Configuration:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
4 — Networking
▶4.1 Network Configuration
▶This recommendation verifies that Network Policies Are Defined on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Network Policies Are Defined:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Default Project Network Policies Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Default Project Network Policies Are Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Egress Firewall Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Egress Firewall Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Multus CNI Plugins Are Reviewed on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Multus CNI Plugins Are Reviewed:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
4.2 Ingress & Routes
▶This recommendation verifies that Routes Use TLS Termination on the Red Hat OpenShift container platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Red Hat OpenShift container platform uses the correct component aligns with industry best practices and standards.
Run the following command and verify that Routes Use TLS Termination:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Ingress Controller TLS Security Profile Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Ingress Controller TLS Security Profile Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Wildcard Routes Are Disabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Wildcard Routes Are Disabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
5 — Pod Security
▶5.1 Security Context Constraints
▶This recommendation verifies that SCCs Are Configured with Least Privilege on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that SCCs Are Configured with Least Privilege:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Privileged SCC Is Not Assigned to General Users on the Red Hat OpenShift container platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.
Running unnecessary components on the Red Hat OpenShift container platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.
Run the following command and verify that Privileged SCC Is Not Assigned to General Users:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Containers Run as Non-Root on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Containers Run as Non-Root:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Read-Only Root Filesystem Is Used on the Red Hat OpenShift container platform. Using the recommended component or protocol ensures alignment with security best practices and reduces risk.
Using an insecure or legacy component instead of the recommended approach increases the risk of compromise. Ensuring the Red Hat OpenShift container platform uses the correct component aligns with industry best practices and standards.
Run the following command and verify that Read-Only Root Filesystem Is Used:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Host Network and PID Namespaces Are Not Shared on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Host Network and PID Namespaces Are Not Shared:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
5.2 Image & Registry Security
▶This recommendation verifies that Internal Registry Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Internal Registry Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Image Content Policies Are Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Image Content Policies Are Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Image Signature Verification Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Image Signature Verification Is Enabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This setting ensures that Allowed Registries Are Restricted on the Red Hat OpenShift container platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.
Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Red Hat OpenShift container platform is essential for defense in depth.
Run the following command and verify that Allowed Registries Are Restricted:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
6 — Logging & Monitoring
▶6.1 Cluster Logging
▶This recommendation verifies that Cluster Logging Operator Is Installed on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Cluster Logging Operator Is Installed:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Audit Logs Are Forwarded to SIEM on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Audit Logs Are Forwarded to SIEM:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Log Retention Policy Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Log Retention Policy Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
6.2 Monitoring & Alerting
▶This recommendation verifies that Cluster Monitoring Operator Is Running on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Cluster Monitoring Operator Is Running:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that AlertManager Is Configured on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that AlertManager Is Configured:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that Prometheus Metrics Are Collected on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to implement this control may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that Prometheus Metrics Are Collected:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.
This recommendation verifies that User Workload Monitoring Is Enabled on the Red Hat OpenShift container platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.
Failure to properly configure this setting may leave the Red Hat OpenShift container platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.
Run the following command and verify that User Workload Monitoring Is Enabled:
oc get ... -o yaml | grep ...Alternatively, review the configuration via the OpenShift web console.
Apply the configuration using the OpenShift CLI:
oc patch ... --type merge -p '...'Alternatively, update the configuration via the OpenShift web console.