STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

MKE must have Grants created to control authorization to cluster resources.

DISA Rule

SV-260912r966093_rule

Vulnerability Number

V-260912

Group Title

SRG-APP-000038-CTR-000105

Rule Version

CNTR-MK-000140

Severity

CAT II

CCI(s)

• CCI-001368 - Enforce approved authorizations for controlling the flow of information within the system based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

Create Role Bindings/Grants by logging in to the MKE web UI as an MKE Admin. Navigate to Access Control >> Grants.

Using Kubernetes orchestration:
- Select the "Kubernetes" tab and click "Create Role Binding".
- Add Users, Organizations or Service Accounts as needed and click "Next".
- Under "Resource Set", enable "Apply Role Binding to all namespaces", and then click "Next".
- Under "Role" select a cluster role.
- Click "Create".

Using Swarm orchestration:
- Select the "Swarm" tab and click "Create Grant".
- Add Users, Organizations, or Service Accounts as needed and click "Next".
- Under "Resource Set", click "View Children" until the required Swarm collection displays, and then click "Next".
- Under "Role" select a cluster role.
- Click "Create".

Check Contents

Verify the applied RBAC policies set in MKE are configured per the requirements set forth by the System Security Plan (SSP).

Log in to the MKE web UI as an MKE Admin and navigate to Access Control >> Grants.

When using Kubernetes orchestration, select the "Kubernetes" tab and verify that cluster role bindings are configured per the requirements set forth by the SSP.

When using Swarm orchestration, select the "Swarm" tabs. Verify that all grants are configured per the requirements set forth by the SSP.

If the grants are not configured per the requirements set forth by the SSP, then this is a finding.

Vulnerability Number

V-260912

Documentable

False

Rule Version

CNTR-MK-000140

Severity Override Guidance

Verify the applied RBAC policies set in MKE are configured per the requirements set forth by the System Security Plan (SSP).

Log in to the MKE web UI as an MKE Admin and navigate to Access Control >> Grants.

When using Kubernetes orchestration, select the "Kubernetes" tab and verify that cluster role bindings are configured per the requirements set forth by the SSP.

When using Swarm orchestration, select the "Swarm" tabs. Verify that all grants are configured per the requirements set forth by the SSP.

If the grants are not configured per the requirements set forth by the SSP, then this is a finding.

Check Content Reference

M

Target Key

5595