STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must enforce approved authorizations for controlling the flow of information within the container platform based on organization-defined information flow control policies.

DISA Rule

SV-257515r1208198_rule

Vulnerability Number

V-257515

Group Title

SRG-APP-000039-CTR-000110

Rule Version

CNTR-OS-000110

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Configure a default network policy as necessary to protect the flow of information by performing the following steps:

1. Create a bootstrap project template (if not already created) by executing the following:
oc adm create-bootstrap-project-template -o yaml > template.yaml

2. Edit the template and add network policy object definitions before the parameters section. For example, the following section defines two policies: one to allow requests from the same namespace and one to allow from the OpenShift ingress routing service.
- apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-same-namespace
spec:
podSelector:
ingress:
- from:
- podSelector: {}
- apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: allow-from-openshift-ingress
spec:
ingress:
- from:
- namespaceSelector:
matchLabels:
network.openshift.io/policy-group: ingress
podSelector: {}
policyTypes:
- Ingress
parameters:

3. Apply the project template to the cluster by executing the following:
oc create -f template.yaml -n openshift-config

4. Set the default cluster project request template by executing the following:
oc patch project.config.openshift.io/cluster --type=merge -p '{'spec':{'projectRequestTemplate':{'name': '<PROJECT_REQUEST_TEMPLATE>'}}}'

For additional information regarding network policies, refer to https://docs.openshift.com/container-platform/4.8/networking/network_policy/about-network-policy.html.

Where OpenShift Virtualization is enabled:
$ oc patch hyperconverged kubevirt-hyperconverged -n openshift-cnv
--type='json' -p='[
{"op": "replace", "path": "/spec/featureGates/downwardMetrics",
"value": false },
]'

Check Contents

Check for network policy. Verify a default project template is defined by executing the following:
oc get project.config.openshift.io/cluster -o jsonpath='{.spec.projectRequestTemplate.name}'

If no project request template is in use by the project config, this is a finding.

Verify the project request template creates a network policy:
oc get templates/<PROJECT-REQUEST-TEMPLATE> -n openshift-config -o jsonpath='{.objects[?(.kind=='NetworkPolicy')]}{'\n'}'

Replace <PROJECT-REQUEST-TEMPLATE> with the name of the project request template returned from the earlier query. If the project template is not defined, or there are no network policy definitions in it, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.featureGates.downwardMetrics}'

If this is set to anything other than "false", this is a finding.

Vulnerability Number

V-257515

Documentable

False

Rule Version

CNTR-OS-000110

Severity Override Guidance

Check for network policy. Verify a default project template is defined by executing the following:
oc get project.config.openshift.io/cluster -o jsonpath='{.spec.projectRequestTemplate.name}'

If no project request template is in use by the project config, this is a finding.

Verify the project request template creates a network policy:
oc get templates/<PROJECT-REQUEST-TEMPLATE> -n openshift-config -o jsonpath='{.objects[?(.kind=='NetworkPolicy')]}{'\n'}'

Replace <PROJECT-REQUEST-TEMPLATE> with the name of the project request template returned from the earlier query. If the project template is not defined, or there are no network policy definitions in it, this is a finding.

Where OpenShift Virtualization is enabled:
$ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv
-ojsonpath='{.spec.featureGates.downwardMetrics}'

If this is set to anything other than "false", this is a finding.

Check Content Reference

M

Target Key

5547