STIGQter STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must restrict individuals' ability to launch organization-defined denial-of-service (DOS) attacks against other information systems by rate-limiting.

DISA Rule

SV-257555r1208206_rule

Vulnerability Number

V-257555

Group Title

SRG-APP-000246-CTR-000605

Rule Version

CNTR-OS-000630

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Add the "haproxy.router.openshift.io/rate-limit-connections= true" annotation to any routes outside the kube-* or openshift-* namespaces.

oc annotate route <route_name> -n <namespace> --overwrite=true " haproxy.router.openshift.io/rate-limit-connections= true "

https://docs.openshift.com/container-platform/4.9/networking/routes/route-configuration.html

Check Contents

Verify that all namespaces except those that start with kube-* or openshift-* use the rate-limiting annotation by executing the following:

oc get routes --all-namespaces -o json | jq '[.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name]'

If the above command returns any namespaces, this is a finding.

Vulnerability Number

V-257555

Documentable

False

Rule Version

CNTR-OS-000630

Severity Override Guidance

Verify that all namespaces except those that start with kube-* or openshift-* use the rate-limiting annotation by executing the following:

oc get routes --all-namespaces -o json | jq '[.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name]'

If the above command returns any namespaces, this is a finding.

Check Content Reference

M

Target Key

5547