STIGQter STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

MSR's self-signed certificates must be replaced with DOD trusted, signed certificates.

DISA Rule

SV-260916r966105_rule

Vulnerability Number

V-260916

Group Title

SRG-APP-000141-CTR-000315

Rule Version

CNTR-MK-000480

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If MSR is not being utilized, this is Not Applicable.

Ensure the certificates are from a trusted DOD CA.

1. Add the secret to the cluster by executing the following:

kubectl create secret tls <secret-name> --key <keyfile>.pem --cert <certfile>.pem

2. Update MSR with the custom certificate by executing the following:

helm upgrade msr [REPO_NAME]/msr --version <helm-chart-version> --set-file license=path/to/file/license.lic --set
nginx.webtls.create=false --set nginx.webtls.secretName="<secret-name>"

Check Contents

If MSR is not being utilized, this is Not Applicable.

Check that MSR has been integrated with a trusted certificate authority (CA).

1. In one terminal window execute the following:
kubectl port-forward service/msr 8443:443

2. In a second terminal window execute the following:
openssl s_client -connect localhost:8443 -showcerts </dev/null

If the certificate chain in the output is not valid and does not match that of the trusted CA, then this is a finding.

Vulnerability Number

V-260916

Documentable

False

Rule Version

CNTR-MK-000480

Severity Override Guidance

If MSR is not being utilized, this is Not Applicable.

Check that MSR has been integrated with a trusted certificate authority (CA).

1. In one terminal window execute the following:
kubectl port-forward service/msr 8443:443

2. In a second terminal window execute the following:
openssl s_client -connect localhost:8443 -showcerts </dev/null

If the certificate chain in the output is not valid and does not match that of the trusted CA, then this is a finding.

Check Content Reference

M

Target Key

5595