STIGQter: STIG Summary: Red Hat OpenShift Container Platform 4.x Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Jul 2026:

OpenShift must protect against or limit the effects of all types of Denial-of-Service (DoS) attacks by employing organization-defined security safeguards by including a default resource quota.

DISA Rule

SV-257565r961620_rule

Vulnerability Number

V-257565

Group Title

SRG-APP-000435-CTR-001070

Rule Version

CNTR-OS-000800

Severity

CAT II

CCI(s)

• CCI-002385 - Protect against or limit the effects of organization-defined types of denial of service events.

Weight

10

Fix Recommendation

Configure a default resource quota as necessary to protect resource over utilization.

1. Create a bootstrap project template by executing the following:

oc adm create-bootstrap-project-template -o yaml > template.yaml

2. Edit the template and add a ResourceQuota object definition before the parameters section.

- apiVersion: v1
kind: ResourceQuota
metadata:
name: example
spec:
hard:
persistentvolumeclaims: "10"
requests.storage: "50Gi"
...
parameters:

3. Apply the project template to the cluster by executing the following:

oc create -f template.yaml -n openshift-config

Details regarding the configuration of resource quotas can be reviewed at https://docs.openshift.com/container-platform/4.8/applications/quotas/quotas-setting-per-project.html.

Check Contents

Verify the new project template includes a default resource quota by executing the following:

oc get templates/project-request -n openshift-config -o jsonpath="{.objects[?(.kind=='ResourceQuota')]}{'\n'}"

Review the ResourceQuota definition. If nothing is return, this is a finding.

Vulnerability Number

V-257565

Documentable

False

Rule Version

CNTR-OS-000800

Severity Override Guidance

Verify the new project template includes a default resource quota by executing the following:

oc get templates/project-request -n openshift-config -o jsonpath="{.objects[?(.kind=='ResourceQuota')]}{'\n'}"

Review the ResourceQuota definition. If nothing is return, this is a finding.

Check Content Reference

M

Target Key

5547