STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Swarm Secrets or Kubernetes Secrets must be used.

DISA Rule

SV-260911r1015770_rule

Vulnerability Number

V-260911

Group Title

SRG-APP-000033-CTR-000100

Rule Version

CNTR-MK-000130

Severity

CAT II

CCI(s)

• CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
• CCI-001499 - Limit privileges to change software resident within software libraries.
• CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

10

Fix Recommendation

To create secrets when using Swarm Orchestration, log in to the MKE UI. Navigate to Swarm >> Secrets, and then click "Create".

Provide a name for the secret and enter the data into the "Content" field.

Add a label to allow for RBAC features to be used for access to secret.

Click "Save".

To create secrets when using Kubernetes orchestration, run the following command on the MKE Controller node:

Configure the $AUTH variable to contain the token for the SCIM API endpoint.

curl -X PUT -H 'Accept: application/json' -H "Authorization: Bearer $AUTH" -d '{"KMSEnabled":true,"KMSName"":"<kms_name>","KMSEndpoint":"/var/kms"}' "https://$MKE_ADDRESS/api/MKE/config/kubernetes"

Check Contents

Review the System Security Plan (SSP) and identify applications that leverage configuration files and/or small amounts of user-generated data, and ensure the data is stored in Docker Secrets or Kubernetes Secrets.

When using Swarm orchestration, log in to the MKE web UI and navigate to Swarm >> Secrets and view the configured secrets.

If items identified for secure storage are not included in the secrets, this is a finding.

When using Kubernetes orchestration, log on to the MKE Controller node then run the following command:

kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A

Or, using API, configure the $AUTH variable to contain the token for the SCIM API endpoint:

curl -k 'Accept: application/json' -H "Authorization: Bearer $AUTH" -s "https://$MKE_ADDRESS/api/MKE/config/kubernetes" | jq '.KMSEnabled' true

If any of the values returned reference environment variables, this is a finding.

Vulnerability Number

V-260911

Documentable

False

Rule Version

CNTR-MK-000130

Severity Override Guidance

Review the System Security Plan (SSP) and identify applications that leverage configuration files and/or small amounts of user-generated data, and ensure the data is stored in Docker Secrets or Kubernetes Secrets.

When using Swarm orchestration, log in to the MKE web UI and navigate to Swarm >> Secrets and view the configured secrets.

If items identified for secure storage are not included in the secrets, this is a finding.

When using Kubernetes orchestration, log on to the MKE Controller node then run the following command:

kubectl get all -o jsonpath='{range .items[?(@..secretKeyRef)]} {.kind} {.metadata.name} {"\n"}{end}' -A

Or, using API, configure the $AUTH variable to contain the token for the SCIM API endpoint:

curl -k 'Accept: application/json' -H "Authorization: Bearer $AUTH" -s "https://$MKE_ADDRESS/api/MKE/config/kubernetes" | jq '.KMSEnabled' true

If any of the values returned reference environment variables, this is a finding.

Check Content Reference

M

Target Key

5595