srg_requirement: |-
  {{{ full_name }}} must use a centralized user management solution to
  support account management functions.

vuldiscussion: |-
  OpenShift supports several different types of identity providers.
  In order to add users and grant access to OpenShift, an identity provider
  needs to be configured. Some of the identity provider types, such as
  HTPassword, only provide simple user management and are not intended
  for production. Other types are public services, like GitHub. These
  provider types may not be appropriate as they are managed by public
  service providers and therefore are unable to enforce the organizations
  account management requirements.

  After a new install, the default authentication uses kubeadmin as the
  default cluster-admin account.  This default account needs to be disabled,
  and another user account should be given cluster-admin rights.

checktext: |-
  Verify that the kubeadmin account is disabled

  > oc get secrets kubeadmin -n kube-system

  If the command returns an error that the secret was not found, this
  is not a finding. If the command returns a listing that includes the
  kubeadmin secret, its type, the data count, and age, this is a finding.

fixtext: |-
  > oc delete secrets kubeadmin -n kube-system
