CNTR-K8-000150 - The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.

CAT|II

CCI|CCI-000068

Rule-ID|SV-242376r879519_rule

STIG-ID|CNTR-K8-000150

Vuln-ID|V-242376

CNTR-K8-000160 - The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.

Rule-ID|SV-242377r879519_rule

STIG-ID|CNTR-K8-000160

Vuln-ID|V-242377

CNTR-K8-000170 - The Kubernetes API Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.

Rule-ID|SV-242378r879519_rule

STIG-ID|CNTR-K8-000170

Vuln-ID|V-242378

CNTR-K8-000180 - The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.

Rule-ID|SV-242379r927237_rule

STIG-ID|CNTR-K8-000180

Vuln-ID|V-242379

CNTR-K8-000190 - The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.

Rule-ID|SV-242380r927238_rule

STIG-ID|CNTR-K8-000190

Vuln-ID|V-242380

CNTR-K8-000220 - The Kubernetes Controller Manager must create unique service accounts for each work payload.

CAT|I

CCI|CCI-000015

Rule-ID|SV-242381r927239_rule

STIG-ID|CNTR-K8-000220

Vuln-ID|V-242381

CNTR-K8-000270 - The Kubernetes API Server must enable Node,RBAC as the authorization mode.

CCI|CCI-000213

Rule-ID|SV-242382r927240_rule

STIG-ID|CNTR-K8-000270

Vuln-ID|V-242382

CNTR-K8-000290 - User-managed resources must be created in dedicated namespaces.

CCI|CCI-000366

Rule-ID|SV-242383r879533_rule

STIG-ID|CNTR-K8-000290

Vuln-ID|V-242383

CNTR-K8-000300 - The Kubernetes Scheduler must have secure binding.

Rule-ID|SV-242384r879530_rule

STIG-ID|CNTR-K8-000300

Vuln-ID|V-242384

CNTR-K8-000310 - The Kubernetes Controller Manager must have secure binding.

Rule-ID|SV-242385r879530_rule

STIG-ID|CNTR-K8-000310

Vuln-ID|V-242385

CNTR-K8-000320 - The Kubernetes API server must have the insecure port flag disabled.

Rule-ID|SV-242386r927241_rule

STIG-ID|CNTR-K8-000320

Vuln-ID|V-242386

CNTR-K8-000330 - The Kubernetes Kubelet must have the 'readOnlyPort' flag disabled - readOnlyPort flag disabled.

Rule-ID|SV-242387r918149_rule

STIG-ID|CNTR-K8-000330

Vuln-ID|V-242387

CNTR-K8-000340 - The Kubernetes API server must have the insecure bind address not set.

Rule-ID|SV-242388r927242_rule

STIG-ID|CNTR-K8-000340

Vuln-ID|V-242388

CNTR-K8-000350 - The Kubernetes API server must have the secure port set.

Rule-ID|SV-242389r927243_rule

STIG-ID|CNTR-K8-000350

Vuln-ID|V-242389

CNTR-K8-000360 - The Kubernetes API server must have anonymous authentication disabled.

Rule-ID|SV-242390r927244_rule

STIG-ID|CNTR-K8-000360

Vuln-ID|V-242390

CNTR-K8-000370 - The Kubernetes Kubelet must have anonymous authentication disabled.

Rule-ID|SV-242391r918152_rule

STIG-ID|CNTR-K8-000370

Vuln-ID|V-242391

CNTR-K8-000380 - The Kubernetes kubelet must enable explicit authorization.

Rule-ID|SV-242392r918155_rule

STIG-ID|CNTR-K8-000380

Vuln-ID|V-242392

CNTR-K8-000400 - Kubernetes Worker Nodes must not have sshd service running.

Rule-ID|SV-242393r879530_rule

STIG-ID|CNTR-K8-000400

Vuln-ID|V-242393

CNTR-K8-000410 - Kubernetes Worker Nodes must not have the sshd service enabled.

Rule-ID|SV-242394r879530_rule

STIG-ID|CNTR-K8-000410

Vuln-ID|V-242394

CNTR-K8-000420 - Kubernetes dashboard must not be enabled.

Rule-ID|SV-242395r879530_rule

STIG-ID|CNTR-K8-000420

Vuln-ID|V-242395

CNTR-K8-000430 - Kubernetes Kubectl cp command must give expected access and results.

Rule-ID|SV-242396r879530_rule

STIG-ID|CNTR-K8-000430

Vuln-ID|V-242396

CNTR-K8-000440 - The Kubernetes kubelet staticPodPath must not enable static pods.

Rule-ID|SV-242397r927245_rule

STIG-ID|CNTR-K8-000440

Vuln-ID|V-242397

CNTR-K8-000450 - Kubernetes DynamicAuditing must not be enabled - kubelet

Rule-ID|SV-242398r918161_rule

STIG-ID|CNTR-K8-000450

Vuln-ID|V-242398

CNTR-K8-000450 - Kubernetes DynamicAuditing must not be enabled - manifest

CNTR-K8-000460 - Kubernetes DynamicKubeletConfig must not be enabled - kubelet

Rule-ID|SV-242399r918164_rule

STIG-ID|CNTR-K8-000460

Vuln-ID|V-242399

CNTR-K8-000460 - Kubernetes DynamicKubeletConfig must not be enabled - manifest

CNTR-K8-000470 - The Kubernetes API server must have Alpha APIs disabled.

Rule-ID|SV-242400r927246_rule

STIG-ID|CNTR-K8-000470

Vuln-ID|V-242400

CNTR-K8-000610 - The Kubernetes API Server must have an audit log path set.

CCI|CCI-001464

Rule-ID|SV-242402r927248_rule

STIG-ID|CNTR-K8-000610

Vuln-ID|V-242402

CNTR-K8-000700 - Kubernetes API Server must generate audit records that identify what type of event has occurred, identify the source of the event, contain the event results, identify any users, and identify any containers associated with the event.

CCI|CCI-000018

CCI|CCI-000130

CCI|CCI-000131

CCI|CCI-000132

CCI|CCI-000133

CCI|CCI-000134

CCI|CCI-000135

CCI|CCI-000172

CCI|CCI-001403

CCI|CCI-001404

CCI|CCI-001487

CCI|CCI-001844

CCI|CCI-002264

Rule-ID|SV-242403r927249_rule

STIG-ID|CNTR-K8-000700

Vuln-ID|V-242403

CNTR-K8-000850 - Kubernetes Kubelet must deny hostname override.

CCI|CCI-001499

Rule-ID|SV-242404r918167_rule

STIG-ID|CNTR-K8-000850

Vuln-ID|V-242404

CNTR-K8-000860 - The Kubernetes manifests must be owned by root.

Rule-ID|SV-242405r879586_rule

STIG-ID|CNTR-K8-000860

Vuln-ID|V-242405

CNTR-K8-000880 - The Kubernetes KubeletConfiguration file must be owned by root.

Rule-ID|SV-242406r918168_rule

STIG-ID|CNTR-K8-000880

Vuln-ID|V-242406

CNTR-K8-000890 - The Kubernetes KubeletConfiguration files must have file permissions set to 644 or more restrictive.

Rule-ID|SV-242407r918171_rule

STIG-ID|CNTR-K8-000890

Vuln-ID|V-242407

CNTR-K8-000900 - The Kubernetes manifest files must have least privileges.

Rule-ID|SV-242408r918174_rule

STIG-ID|CNTR-K8-000900

Vuln-ID|V-242408

CNTR-K8-000910 - Kubernetes Controller Manager must disable profiling.

CCI|CCI-000381

Rule-ID|SV-242409r879587_rule

STIG-ID|CNTR-K8-000910

Vuln-ID|V-242409

CNTR-K8-000920 - The Kubernetes API Server must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).

CCI|CCI-000382

Rule-ID|SV-242410r879588_rule

STIG-ID|CNTR-K8-000920

Vuln-ID|V-242410

CNTR-K8-000930 - The Kubernetes Scheduler must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).

Rule-ID|SV-242411r879588_rule

STIG-ID|CNTR-K8-000930

Vuln-ID|V-242411

CNTR-K8-000940 - The Kubernetes Controllers must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).

Rule-ID|SV-242412r879588_rule

STIG-ID|CNTR-K8-000940

Vuln-ID|V-242412

CNTR-K8-000950 - The Kubernetes etcd must enforce ports, protocols, and services (PPS) that adhere to the Ports, Protocols, and Services Management Category Assurance List (PPSM CAL).

Rule-ID|SV-242413r879588_rule

STIG-ID|CNTR-K8-000950

Vuln-ID|V-242413

CNTR-K8-000960 - The Kubernetes cluster must use non-privileged host ports for user pods.

Rule-ID|SV-242414r879588_rule

STIG-ID|CNTR-K8-000960

Vuln-ID|V-242414

CNTR-K8-001160 - Secrets in Kubernetes must not be stored as environment variables.

CCI|CCI-000196

Rule-ID|SV-242415r879608_rule

STIG-ID|CNTR-K8-001160

Vuln-ID|V-242415

CNTR-K8-001300 - Kubernetes Kubelet must not disable timeouts.

CCI|CCI-001133

Rule-ID|SV-245541r918210_rule

STIG-ID|CNTR-K8-001300

Vuln-ID|V-245541

CNTR-K8-001360 - Kubernetes must separate user functionality.

CCI|CCI-001082

Rule-ID|SV-242417r879631_rule

STIG-ID|CNTR-K8-001360

Vuln-ID|V-242417

CNTR-K8-001400 - The Kubernetes API server must use approved cipher suites.

CCI|CCI-001184

Rule-ID|SV-242418r927250_rule

STIG-ID|CNTR-K8-001400

Vuln-ID|V-242418

CNTR-K8-001410 - Kubernetes API Server must have the SSL Certificate Authority set.

Detections

Analytics

DISA STIG Kubernetes v1r11

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous