STIGQter: STIG Summary: Mirantis Kubernetes Engine Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 24 Jul 2024:

Older Universal Control Plane (MKE) and Docker Trusted Registry (DTR) images must be removed from all cluster nodes upon upgrading.

DISA Rule

SV-260944r966189_rule

Vulnerability Number

V-260944

Group Title

SRG-APP-000454-CTR-001110

Rule Version

CNTR-MK-001600

Severity

CAT II

CCI(s)

• CCI-002617 - Remove previous versions of organization-defined software components after updated versions have been installed.

Weight

10

Fix Recommendation

Remove all outdated MKE and DTR container images from all nodes in the cluster:

Via CLI: As an MKE admin, execute the following commands using a client bundle:

docker rmi -f $(docker images --filter reference='mirantis/ucp*:[outdated_tags]' -q)
docker rmi -f $(docker images --filter reference='registry.mirantis.com/msr/[msr]*:[outdated_tags]' -q)

Check Contents

Verify all outdated MKE and DTR container images have been removed from all nodes in the cluster.

Via CLI: As an MKE admin, execute the following command using a client bundle:

docker images --filter reference='mirantis/[ucp]*'
docker images --filter reference='registry.mirantis.com/msr/[msr]*'

Verify there are no tags listed older than the currently installed versions of MKE and DTR.

If any of the tags listed are older than the currently installed versions of MKE and DTR, then this is a finding. If no tags are listed, this is not a finding.

Vulnerability Number

V-260944

Documentable

False

Rule Version

CNTR-MK-001600

Severity Override Guidance

Verify all outdated MKE and DTR container images have been removed from all nodes in the cluster.

Via CLI: As an MKE admin, execute the following command using a client bundle:

docker images --filter reference='mirantis/[ucp]*'
docker images --filter reference='registry.mirantis.com/msr/[msr]*'

Verify there are no tags listed older than the currently installed versions of MKE and DTR.

If any of the tags listed are older than the currently installed versions of MKE and DTR, then this is a finding. If no tags are listed, this is not a finding.

Check Content Reference

M

Target Key

5595