STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

MKE must only run signed images.

DISA Rule

SV-260942r1015772_rule

Vulnerability Number

V-260942

Group Title

SRG-APP-000386-CTR-000920

Rule Version

CNTR-MK-001380

Severity

CAT II

CCI(s)

• CCI-001774 - Employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs on the system.
• CCI-003992 - Prevent the installation of organization-defined software and firmware components without verification that the component has been digitally signed using a certificate that is recognized and approved by the organization.

Weight

10

Fix Recommendation

On each node, enable Content Trust enforcement in MKE.

1. Log in to the MKE web UI and navigate to admin >> Admin Settings >> Docker Content Trust.

Under Content Trust Settings section, enable "Run only signed images".

2. Log in to the MKE web UI and navigate to admin >> Admin Settings >> Docker Content Trust.

Click "Add Team +" and set the appropriate Orgs and Teams that must sign images. Use the drop-down ("v") that follows to match the organizational policies.

Remove any unwanted teams by clicking the minus symbol.

Click "Save".

3. Manually remove any unsigned images sitting on an MKE cluster by executing the following:

docker rmi <IMAGE_ID>

Check Contents

On each node, check that MKE is configured to only run images signed by applicable Orgs and Teams.

1. Log in to the MKE web UI and navigate to admin >> Admin Settings >> Docker Content Trust.

If Content Trust Settings "Run only signed images" is disabled, this is a finding.

2. Verify that the Orgs and Teams that images must be signed by in the drop-down matches the organizational policies.

If an Org or Team selected does not match organizational policies, this is a finding.

3. Verify that all images sitting on an MKE cluster are signed.

Via CLI:
Linux: As an MKE Admin, execute the following commands using a client bundle:

docker trust inspect $(docker images | awk '{print $1 ":" $2}')

Verify that all image tags in the output have valid signatures. If the images are not signed, this is a finding.

Vulnerability Number

V-260942

Documentable

False

Rule Version

CNTR-MK-001380

Severity Override Guidance

On each node, check that MKE is configured to only run images signed by applicable Orgs and Teams.

1. Log in to the MKE web UI and navigate to admin >> Admin Settings >> Docker Content Trust.

If Content Trust Settings "Run only signed images" is disabled, this is a finding.

2. Verify that the Orgs and Teams that images must be signed by in the drop-down matches the organizational policies.

If an Org or Team selected does not match organizational policies, this is a finding.

3. Verify that all images sitting on an MKE cluster are signed.

Via CLI:
Linux: As an MKE Admin, execute the following commands using a client bundle:

docker trust inspect $(docker images | awk '{print $1 ":" $2}')

Verify that all image tags in the output have valid signatures. If the images are not signed, this is a finding.

Check Content Reference

M

Target Key

5595