STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift keystore must implement encryption to prevent unauthorized disclosure of information at rest within the container platform.

DISA Rule

SV-257564r1050650_rule

Vulnerability Number

V-257564

Group Title

SRG-APP-000429-CTR-001060

Rule Version

CNTR-OS-000780

Severity

CAT II

CCI(s)

CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

Fix Recommendation

Set API encryption type by executing the following:

oc edit apiserver

Set the encryption field type to aescbc:
spec:
encryption:
type: aescbc

Additional details about the configuration can be found in the documentation:
https://docs.openshift.com/container-platform/4.8/security/encrypting-etcd.html

Check Contents

Review the API server encryption by running by executing the following:

oc edit apiserver

EXAMPLE OUTPUT
spec:
encryption:
type: aescbc

If the encryption type is not "aescbc", this is a finding.

Vulnerability Number

V-257564

Documentable

False

Rule Version

CNTR-OS-000780

Severity Override Guidance

Review the API server encryption by running by executing the following:

oc edit apiserver

EXAMPLE OUTPUT
spec:
encryption:
type: aescbc

If the encryption type is not "aescbc", this is a finding.

Check Content Reference

Target Key

5547