| Checked | Name | Title |
|---|
| ☐ | SV-242376r960759_rule | The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination. |
| ☐ | SV-242377r960759_rule | The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination. |
| ☐ | SV-242378r960759_rule | The Kubernetes API Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination. |
| ☐ | SV-242379r960759_rule | The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination. |
| ☐ | SV-242380r960759_rule | The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination. |
| ☐ | SV-242381r1043176_rule | The Kubernetes Controller Manager must create unique service accounts for each work payload. |
| ☐ | SV-242382r1137638_rule | The Kubernetes API Server must enable Node,RBAC as the authorization mode. |
| ☐ | SV-242383r1137641_rule | User-managed resources must be created in dedicated namespaces. |
| ☐ | SV-242384r1137638_rule | The Kubernetes Scheduler must have secure binding. |
| ☐ | SV-242385r1137638_rule | The Kubernetes Controller Manager must have secure binding. |
| ☐ | SV-242387r1137639_rule | The Kubernetes Kubelet must have the "readOnlyPort" flag disabled. |
| ☐ | SV-242389r1137640_rule | The Kubernetes API server must have the secure port set. |
| ☐ | SV-242390r1137640_rule | The Kubernetes API server must have anonymous authentication disabled. |
| ☐ | SV-242391r1137638_rule | The Kubernetes Kubelet must have anonymous authentication disabled. |
| ☐ | SV-242392r1137639_rule | The Kubernetes kubelet must enable explicit authorization. |
| ☐ | SV-242393r1137639_rule | Kubernetes Worker Nodes must not have sshd service running. |
| ☐ | SV-242394r1137639_rule | Kubernetes Worker Nodes must not have the sshd service enabled. |
| ☐ | SV-242395r1137639_rule | Kubernetes dashboard must not be enabled. |
| ☐ | SV-242396r1137638_rule | Kubernetes Kubectl cp command must give expected access and results. |
| ☐ | SV-242397r1137638_rule | The Kubernetes kubelet staticPodPath must not enable static pods. |
| ☐ | SV-242398r1137640_rule | Kubernetes DynamicAuditing must not be enabled. |
| ☐ | SV-242399r1137639_rule | Kubernetes DynamicKubeletConfig must not be enabled. |
| ☐ | SV-242400r1137638_rule | The Kubernetes API server must have Alpha APIs disabled. |
| ☐ | SV-242402r960888_rule | The Kubernetes API Server must have an audit log path set. |
| ☐ | SV-242403r986135_rule | Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event. |
| ☐ | SV-242404r960960_rule | Kubernetes Kubelet must deny hostname override. |
| ☐ | SV-242405r960960_rule | The Kubernetes manifests must be owned by root. |
| ☐ | SV-242406r960960_rule | The Kubernetes KubeletConfiguration file must be owned by root. |
| ☐ | SV-242407r960960_rule | The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242408r960960_rule | The Kubernetes manifest files must have least privileges. |
| ☐ | SV-242409r960963_rule | Kubernetes Controller Manager must disable profiling. |
| ☐ | SV-242410r1043177_rule | The Kubernetes API Server must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). |
| ☐ | SV-242411r1043177_rule | The Kubernetes Scheduler must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). |
| ☐ | SV-242412r1043177_rule | The Kubernetes Controllers must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). |
| ☐ | SV-242413r1043177_rule | The Kubernetes etcd must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL). |
| ☐ | SV-242414r1043177_rule | The Kubernetes cluster must use non-privileged host ports for user pods. |
| ☐ | SV-242415r1069466_rule | Secrets in Kubernetes must not be stored as environment variables. |
| ☐ | SV-242417r1137643_rule | Kubernetes must separate user functionality. |
| ☐ | SV-242418r1043178_rule | The Kubernetes API server must use approved cipher suites. |
| ☐ | SV-242419r1043178_rule | Kubernetes API Server must have the SSL Certificate Authority set. |
| ☐ | SV-242420r1043178_rule | Kubernetes Kubelet must have the SSL Certificate Authority set. |
| ☐ | SV-242421r1043178_rule | Kubernetes Controller Manager must have the SSL Certificate Authority set. |
| ☐ | SV-242422r1043178_rule | Kubernetes API Server must have a certificate for communication. |
| ☐ | SV-242423r1043178_rule | Kubernetes etcd must enable client authentication to secure service. |
| ☐ | SV-242424r1043178_rule | Kubernetes Kubelet must enable tlsPrivateKeyFile for client authentication to secure service. |
| ☐ | SV-242425r1043178_rule | Kubernetes Kubelet must enable tlsCertFile for client authentication to secure service. |
| ☐ | SV-242426r1043178_rule | Kubernetes etcd must enable client authentication to secure service. |
| ☐ | SV-242427r1043178_rule | Kubernetes etcd must have a key file for secure communication. |
| ☐ | SV-242428r1043178_rule | Kubernetes etcd must have a certificate for communication. |
| ☐ | SV-242429r1043178_rule | Kubernetes etcd must have the SSL Certificate Authority set. |
| ☐ | SV-242430r1043178_rule | Kubernetes etcd must have a certificate for communication. |
| ☐ | SV-242431r1043178_rule | Kubernetes etcd must have a key file for secure communication. |
| ☐ | SV-242432r1043178_rule | Kubernetes etcd must have peer-cert-file set for secure communication. |
| ☐ | SV-242433r1043178_rule | Kubernetes etcd must have a peer-key-file set for secure communication. |
| ☐ | SV-242434r961131_rule | Kubernetes Kubelet must enable kernel protection. |
| ☐ | SV-242436r961359_rule | The Kubernetes API server must have the ValidatingAdmissionWebhook enabled. |
| ☐ | SV-242437r961359_rule | Kubernetes must have a pod security policy set. |
| ☐ | SV-242438r961620_rule | Kubernetes API Server must configure timeouts to limit attack surface. |
| ☐ | SV-242442r1188293_rule | Kubernetes must remove old components after updated versions have been installed. |
| ☐ | SV-242443r1137649_rule | Kubernetes must contain the latest updates as authorized by IAVMs, CTOs, DTMs, and STIGs. |
| ☐ | SV-242444r961863_rule | The Kubernetes component manifests must be owned by root. |
| ☐ | SV-242445r961863_rule | The Kubernetes component etcd must be owned by etcd. |
| ☐ | SV-242446r961863_rule | The Kubernetes conf files must be owned by root. |
| ☐ | SV-242447r961863_rule | The Kubernetes Kube Proxy kubeconfig must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242448r961863_rule | The Kubernetes Kube Proxy kubeconfig must be owned by root. |
| ☐ | SV-242449r961863_rule | The Kubernetes Kubelet certificate authority file must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242450r961863_rule | The Kubernetes Kubelet certificate authority must be owned by root. |
| ☐ | SV-242451r961863_rule | The Kubernetes component PKI must be owned by root. |
| ☐ | SV-242452r961863_rule | The Kubernetes kubelet KubeConfig must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242453r961863_rule | The Kubernetes kubelet KubeConfig file must be owned by root. |
| ☐ | SV-242454r961863_rule | The Kubernetes kubeadm.conf must be owned by root. |
| ☐ | SV-242455r961863_rule | The Kubernetes kubeadm.conf must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242456r961863_rule | The Kubernetes kubelet config must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242457r961863_rule | The Kubernetes kubelet config must be owned by root. |
| ☐ | SV-242459r961863_rule | The Kubernetes etcd must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242460r961863_rule | The Kubernetes admin kubeconfig must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242461r961863_rule | Kubernetes API Server audit logs must be enabled. |
| ☐ | SV-242462r961863_rule | The Kubernetes API Server must be set to audit log max size. |
| ☐ | SV-242463r961863_rule | The Kubernetes API Server must be set to audit log maximum backup. |
| ☐ | SV-242464r961863_rule | The Kubernetes API Server audit log retention must be set. |
| ☐ | SV-242465r961863_rule | The Kubernetes API Server audit log path must be set. |
| ☐ | SV-242466r961863_rule | The Kubernetes PKI CRT must have file permissions set to 644 or more restrictive. |
| ☐ | SV-242467r961863_rule | The Kubernetes PKI keys must have file permissions set to 600 or more restrictive. |
| ☐ | SV-245541r1069469_rule | Kubernetes Kubelet must not disable timeouts. |
| ☐ | SV-245542r961632_rule | Kubernetes API Server must disable basic authentication to protect information in transit. |
| ☐ | SV-245543r961632_rule | Kubernetes API Server must disable token authentication to protect information in transit. |
| ☐ | SV-245544r961632_rule | Kubernetes endpoints must use approved organizational certificate and key pair to protect information in transit. |
| ☐ | SV-254800r961359_rule | Kubernetes must have a Pod Security Admission control file configured. |
| ☐ | SV-254801r961359_rule | Kubernetes must enable PodSecurity admission controller on static pods and Kubelets. |
| ☐ | SV-274882r1137640_rule | Kubernetes Secrets must be encrypted at rest. |
| ☐ | SV-274883r1107239_rule | Sensitive information must be stored using Kubernetes Secrets or an external Secret store provider. |
| ☐ | SV-274884r1107245_rule | Kubernetes must limit Secret access on a need-to-know basis. |
STIGQter: STIG Summary: