STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

User-managed resources must be created in dedicated namespaces.

DISA Rule

SV-260905r966072_rule

Vulnerability Number

V-260905

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-MK-000580

Severity

CAT II

CCI(s)

• CCI-000381 - Configure the system to provide only organization-defined mission essential capabilities.

Weight

10

Fix Recommendation

Log in to the MKE web UI and navigate to Kubernetes >> Namespaces.

In the top right corner, enable "Set context for all namespaces".

Move any user-managed resources from the default, kube-public and kube-node-lease namespaces, to user namespaces.

- Navigate to Kubernetes >> Services.
- Select the user-managed service.
- Click on the settings wheel in the top right corner to view the .yaml for that service.
- Change the "namespace" to a user namespace.
- Click "Save".

Check Contents

This check only applies when using Kubernetes orchestration.

Log in to the MKE web UI and navigate to Kubernetes >> Namespaces.

The default namespaces are: "default", "kube-public", and "kube-node-lease".

1. In the top right corner, if "Set context for all namespaces" is not enabled, this is a finding.

2. Navigate to Kubernetes >> Services. Confirm that no service except "kubernetes" has the "default" namespace listed. Confirm that only approved system services have the "kube-system" namespace listed.

If "default" has a service other than the "kubernetes" services, this is a finding.

If "kube-system" has a service that is not listed in the System Security Plan (SSP), this is a finding.

Vulnerability Number

V-260905

Documentable

False

Rule Version

CNTR-MK-000580

Severity Override Guidance

This check only applies when using Kubernetes orchestration.

Log in to the MKE web UI and navigate to Kubernetes >> Namespaces.

The default namespaces are: "default", "kube-public", and "kube-node-lease".

1. In the top right corner, if "Set context for all namespaces" is not enabled, this is a finding.

2. Navigate to Kubernetes >> Services. Confirm that no service except "kubernetes" has the "default" namespace listed. Confirm that only approved system services have the "kube-system" namespace listed.

If "default" has a service other than the "kubernetes" services, this is a finding.

If "kube-system" has a service that is not listed in the System Security Plan (SSP), this is a finding.

Check Content Reference

M

Target Key

5595