STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

IPSec network encryption must be configured.

DISA Rule

SV-260931r966150_rule

Vulnerability Number

V-260931

Group Title

SRG-APP-000158-CTR-000390

Rule Version

CNTR-MK-000770

Severity

CAT II

CCI(s)

• CCI-000778 - Uniquely identify organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection.

Weight

10

Fix Recommendation

To configure IPSec network encryption in Swarm orchestration, create an overlay network with --opt encrypted flag.

Example:
docker network create --opt encrypted --driver overlay my-network

To configure IPSec network encryption in Kubernetes orchestration, modify an existing MKE configuration.

Working as an MKE admin, use the config-toml API from within the directory of your client certificate bundle to export the current MKE settings to a TOML file (mke-config.toml).

1. Define the following environment variables:

export MKE_USERNAME=<mke-username>
export MKE_PASSWORD=<mke-password>
export MKE_HOST=<mke-fqdm-or-ip-address>

2. Obtain and define an AUTHTOKEN environment variable by executing the following:

AUTHTOKEN=$(curl --silent --insecure --data '{"username":"'$MKE_USERNAME'","password":"'$MKE_PASSWORD'"}' https://$MKE_HOST/auth/login | jq --raw-output .auth_token)

3. Download the current MKE configuration file by executing the following:

curl --silent --insecure -X GET "https://$MKE_HOST/api/MKE/config-toml" -H "accept: application/toml" -H "Authorization: Bearer $AUTHTOKEN" > mke-config.toml

4. Modify "secure_overlay" settings to "true".

5. Upload the newly edited MKE configuration file by executing the following:

curl --silent --insecure -X PUT -H "accept: application/toml" -H "Authorization: Bearer $AUTHTOKEN" --upload-file 'mke-config.toml' https://$MKE_HOST/api/MKE/config-toml

Note: Users may need to reacquire AUTHTOKEN, if significant time has passed since it was first attained.

Check Contents

Verify IPSec network encryption.

For Swarm orchestration log in to the MKE web UI and navigate to Swarm >> Networks.

If the "scope" is not local and the "driver" is not overlay, this is a finding.

Kubernetes orchestration:
Note: The path may need to be edited.

cat /etc/mke/config.toml | grep secure_overlay

If the "secure_overlay" settings is not set to "true", this is a finding.

Vulnerability Number

V-260931

Documentable

False

Rule Version

CNTR-MK-000770

Severity Override Guidance

Verify IPSec network encryption.

For Swarm orchestration log in to the MKE web UI and navigate to Swarm >> Networks.

If the "scope" is not local and the "driver" is not overlay, this is a finding.

Kubernetes orchestration:
Note: The path may need to be edited.

cat /etc/mke/config.toml | grep secure_overlay

If the "secure_overlay" settings is not set to "true", this is a finding.

Check Content Reference

M

Target Key

5595