STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

MKE host network namespace must not be shared.

DISA Rule

SV-260913r966096_rule

Vulnerability Number

V-260913

Group Title

SRG-APP-000039-CTR-000110

Rule Version

CNTR-MK-000150

Severity

CAT II

CCI(s)

• CCI-001414 - Enforce approved authorizations for controlling the flow of information between connected systems based on organization-defined information flow control policies.

Weight

10

Fix Recommendation

When using Kubernetes orchestration:
In Kubernetes, the hostNetwork setting is a part of the Pod's specification, and once a Pod is created, its hostNetwork setting cannot be directly modified. However, the desired effect can be achieved by creating a new Pod with the updated hostNetwork setting and then deleting the existing Pod. This process replaces the old Pod with the new one.

When using Swarm orchestration:
Review and remove nonsystem containers previously created by these users that allowed access to the host network namespace must be removed using:

docker container rm [container]

Check Contents

When using Kubernetes orchestration, ensure that Pods do not use the host machine's network namespace and uses its own isolated network namespace.

Note: If the hostNetwork field is not explicitly set in the Pod's specification, it will use the default behavior, which is equivalent to hostNetwork: false.

Execute the following for all pods:

kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.hostNetwork == true) | .metadata.name'

If the above command returns a namespace then the "hostNetwork" = true, this is a finding unless a documented exception is present in the System Security Plan (SSP).

When using Swarm orchestration, check that the host's network namespace is not shared.

Via CLI:
Linux: As an administrator, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --filter "label=com.docker.ucp.version" | awk '{print $1}' | xargs docker inspect --format '{{ .Name }}: NetworkMode={{ .HostConfig.NetworkMode }}'

If the above command returns NetworkMode=host, this is a finding unless a documented exception is present in the SSP.

Vulnerability Number

V-260913

Documentable

False

Rule Version

CNTR-MK-000150

Severity Override Guidance

When using Kubernetes orchestration, ensure that Pods do not use the host machine's network namespace and uses its own isolated network namespace.

Note: If the hostNetwork field is not explicitly set in the Pod's specification, it will use the default behavior, which is equivalent to hostNetwork: false.

Execute the following for all pods:

kubectl get pods --all-namespaces -o json | jq '.items[] | select(.spec.hostNetwork == true) | .metadata.name'

If the above command returns a namespace then the "hostNetwork" = true, this is a finding unless a documented exception is present in the System Security Plan (SSP).

When using Swarm orchestration, check that the host's network namespace is not shared.

Via CLI:
Linux: As an administrator, execute the following command using a Universal Control Plane (MKE) client bundle:

docker ps --filter "label=com.docker.ucp.version" | awk '{print $1}' | xargs docker inspect --format '{{ .Name }}: NetworkMode={{ .HostConfig.NetworkMode }}'

If the above command returns NetworkMode=host, this is a finding unless a documented exception is present in the SSP.

Check Content Reference

M

Target Key

5595