STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift runtime must enforce ports, protocols, and services that adhere to the PPSM CAL.

DISA Rule

SV-257539r1043177_rule

Vulnerability Number

V-257539

Group Title

SRG-APP-000142-CTR-000325

Rule Version

CNTR-OS-000390

Severity

CAT II

CCI(s)

• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.

Weight

10

Fix Recommendation

Verify the accreditation documentation lists all interfaces and the ports, protocols, and services used.

Register OpenShift's ports, protocols, and services with PPSM.

Check Contents

Review the OpenShift documentation and configuration.

For additional information, refer to https://docs.openshift.com/container-platform/4.12/installing/installing_platform_agnostic/installing-platform-agnostic.html.

1. Interview the application administrator.

2. Identify the TCP/IP port numbers OpenShift is configured to use and is utilizing by using a combination of relevant OS commands and application configuration utilities.

3. Identify the network ports and protocols that are used by kube-apiserver by executing the following:

oc get configmap kube-apiserver-pod -n openshift-kube-apiserver -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

oc get configmap kube-apiserver-pod -n openshift-kube-apiserver -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.hostPort?' | grep -v "null"

oc get services -A --show-labels | grep apiserver | awk '{print $6,$8}' | grep apiserver

4. Identify the network ports and protocols used by kube-scheduler by executing the following:

oc get configmap kube-scheduler-pod -n openshift-kube-scheduler -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

oc get services -A --show-labels | grep scheduler | awk '{print $6,$8}' | grep scheduler

5. Identify the network ports and protocols used by kube-controller-manager by executing the following:

oc get configmap kube-controller-manager-pod -n openshift-kube-controller-manager -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

oc get services -A --show-labels | grep kube-controller

6. Identify the network ports and protocols used by etcd by executing the following:

oc get configmap etcd-pod -n openshift-etcd -o "jsonpath={ .data['pod\.yaml'] }" | grep -Po '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+' | sort -u

Review the PPSM web page at: http://www.disa.mil/Network-Services/Enterprise-Connections/PPSM.

Review the PPSM Category Assurance List (CAL) directly at the following link: https://disa.deps.mil/ext/cop/iase/ppsm/Pages/cal.aspx.

Verify the ports used by the OpenShift are approved by the PPSM CAL.

If the ports, protocols, and services have not been registered locally, this is a finding.

Vulnerability Number

V-257539

Documentable

False

Rule Version

CNTR-OS-000390

Severity Override Guidance

Review the OpenShift documentation and configuration.

For additional information, refer to https://docs.openshift.com/container-platform/4.12/installing/installing_platform_agnostic/installing-platform-agnostic.html.

1. Interview the application administrator.

2. Identify the TCP/IP port numbers OpenShift is configured to use and is utilizing by using a combination of relevant OS commands and application configuration utilities.

3. Identify the network ports and protocols that are used by kube-apiserver by executing the following:

oc get configmap kube-apiserver-pod -n openshift-kube-apiserver -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

oc get configmap kube-apiserver-pod -n openshift-kube-apiserver -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.hostPort?' | grep -v "null"

oc get services -A --show-labels | grep apiserver | awk '{print $6,$8}' | grep apiserver

4. Identify the network ports and protocols used by kube-scheduler by executing the following:

oc get configmap kube-scheduler-pod -n openshift-kube-scheduler -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

oc get services -A --show-labels | grep scheduler | awk '{print $6,$8}' | grep scheduler

5. Identify the network ports and protocols used by kube-controller-manager by executing the following:

oc get configmap kube-controller-manager-pod -n openshift-kube-controller-manager -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

oc get services -A --show-labels | grep kube-controller

6. Identify the network ports and protocols used by etcd by executing the following:

oc get configmap etcd-pod -n openshift-etcd -o "jsonpath={ .data['pod\.yaml'] }" | grep -Po '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+' | sort -u

Review the PPSM web page at: http://www.disa.mil/Network-Services/Enterprise-Connections/PPSM.

Review the PPSM Category Assurance List (CAL) directly at the following link: https://disa.deps.mil/ext/cop/iase/ppsm/Pages/cal.aspx.

Verify the ports used by the OpenShift are approved by the PPSM CAL.

If the ports, protocols, and services have not been registered locally, this is a finding.

Check Content Reference

M

Target Key

5547