documentation_complete: true


title: 'Ensure That The etcd Client Certificate Is Correctly Set'

{{% set default_api_path = '/api/v1/namespaces/openshift-etcd/configmaps/etcd-pod' %}}
{{% set default_jqfilter = '[.data."pod.yaml"]' %}}
{{% set hypershift_path = '/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/pods?labelSelector=app%3Detcd' %}}
{{% set hypershift_jqfilter = '[.items[0].spec.containers[0].command | join(" ")]' %}}
{{% set custom_api_path = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_path ~ '{{else}}' ~  default_api_path ~ '{{end}}' %}}
{{% set custom_jqfilter = '{{if ne .hypershift_cluster "None"}}' ~ hypershift_jqfilter ~ '{{else}}' ~  default_jqfilter ~ '{{end}}' %}}
{{% set dump_path = default_api_path ~ ',' ~ default_jqfilter ~ ',' ~ custom_jqfilter %}}

description: |-
    To ensure the etcd service is serving TLS to clients,
    make sure the <tt>etcd-pod*</tt> ConfigMaps in the
    <tt>openshift-etcd</tt> namespace contain the following argument
    for the <tt>etcd</tt> binary in the <tt>etcd</tt> pod:
    <pre>--cert-file=/etc/kubernetes/static-pod-certs/secrets/etcd-all-[a-z]+/etcd-serving-NODE_NAME.crt</pre>.

    Note that the <pre>[a-z]+</pre> is being used since the directory might
    change between OpenShift versions.

rationale: |-
    Without cryptographic integrity protections, information can be
    altered by unauthorized users without detection.

severity: medium

identifiers:
    cce@ocp4: CCE-83553-8

references:
    cis@ocp4: '2.1'
    nerc-cip: CIP-003-8 R4.2,CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R5.1,CIP-007-3 R6.1
    nist: CM-6,CM-6(1),SC-8,SC-8(1)
    pcidss: Req-2.2,Req-2.2.3,Req-2.3
    srg: SRG-APP-000516-CTR-001325

platform: not ocp4-on-hypershift-hosted

ocil_clause: 'the etcd client certificate is not configured'

ocil: |-
    Run the following command:
    <pre>oc get -nopenshift-etcd cm etcd-pod -oyaml | grep -E "\-\-cert-file=/etc/kubernetes/static-pod-certs/secrets/etcd-all-[a-z]+/etcd-serving-NODE_NAME.crt"</pre>
    Verify that there is a certificate configured.

warnings:
    - general: |-
        {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(8) }}}

template:
    name: yamlfile_value
    vars:
        ocp_data: "true"
        filepath: {{{ openshift_filtered_path(default_api_path, default_jqfilter) }}}
        yamlpath: "[:]"
        values:
          - value: "--cert-file="
            operation: "pattern match"
