STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

The network ports on all running containers must be limited to required ports.

DISA Rule

SV-260941r966180_rule

Vulnerability Number

V-260941

Group Title

SRG-APP-000383-CTR-000910

Rule Version

CNTR-MK-001360

Severity

CAT II

CCI(s)

• CCI-001762 - Disable or remove organization-defined functions, ports, protocols, software, and services within the system deemed to be unnecessary and/or nonsecure.

Weight

10

Fix Recommendation

Configuring an ingress controller is the preferred method to manage external ports. If an ingress controller is not used and unnecessary ports are in use, the container or pod network configurations must be updated.

To update a pod's configuration, log in to the MKE UI as an administrator.

Navigate to Kubernetes >> Pods and click the pod with an open port that is not allowed.

Click the three dots in the upper right corner (edit).

Modify the .yaml file to remove the port. Example:

spec:
container:
- name: [pod name]
ports:
- containerPort: 80 [replace with 443]

Click "Save".

For a Swarm service, navigate to Swarm >> Services and click on the service with unauthorized port.

Click the three dots in the top left corner.

Select "Network" in the pop-up and remove the unauthorized port.

Click "Save".

Check Contents

Verify that only needed ports are open on all running containers. If an ingress controller is configured for the cluster, this check is not applicable.

Via CLI: As a remote MKE admin, execute the following command using a client bundle:

docker ps -q | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure that the ports mapped are the ones really needed for the containers per the requirements set forth by the System Security Plan (SSP).

If ports are not documented and approved in the SSP, this is a finding.

Vulnerability Number

V-260941

Documentable

False

Rule Version

CNTR-MK-001360

Severity Override Guidance

Verify that only needed ports are open on all running containers. If an ingress controller is configured for the cluster, this check is not applicable.

Via CLI: As a remote MKE admin, execute the following command using a client bundle:

docker ps -q | xargs docker inspect --format '{{ .Id }}: Ports={{ .NetworkSettings.Ports }}'

Review the list and ensure that the ports mapped are the ones really needed for the containers per the requirements set forth by the System Security Plan (SSP).

If ports are not documented and approved in the SSP, this is a finding.

Check Content Reference

M

Target Key

5595