STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

The kubeadmin account must be disabled.

DISA Rule

SV-257508r1043176_rule

Vulnerability Number

V-257508

Group Title

SRG-APP-000023-CTR-000055

Rule Version

CNTR-OS-000040

Severity

CAT II

CCI(s)

• CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).

Weight

10

Fix Recommendation

If an alternative IDP is already configured and an administrative user exists with the role of cluster-admin, disable the kubeadmin account by running the following command as a cluster administrator:

oc delete secrets kubeadmin -n kube-system

Check Contents

Verify the kubeadmin account is disabled by executing the following:

oc get secrets kubeadmin -n kube-system

If the command returns an error, the secret was not found, and this is not a finding.

(Example output:
Error from server (NotFound): secrets "kubeadmin" not found)

If the command returns a listing that includes the kubeadmin secret, its type, the data count, and age, this is a finding.

(Example Output for not a finding:
NAME TYPE DATA AGE
kubeadmin Opaque 1 6h3m)

Vulnerability Number

V-257508

Documentable

False

Rule Version

CNTR-OS-000040

Severity Override Guidance

Verify the kubeadmin account is disabled by executing the following:

oc get secrets kubeadmin -n kube-system

If the command returns an error, the secret was not found, and this is not a finding.

(Example output:
Error from server (NotFound): secrets "kubeadmin" not found)

If the command returns a listing that includes the kubeadmin secret, its type, the data count, and age, this is a finding.

(Example Output for not a finding:
NAME TYPE DATA AGE
kubeadmin Opaque 1 6h3m)

Check Content Reference

M

Target Key

5547