
title: Ensure that the kubeadmin secret has been removed

description: |-
  The kubeadmin user is meant to be a temporary user used for
  bootstrapping purposes. It is preferable to assign system
  administrators whose users are backed by an Identity Provider.

  <br />
  Make sure to remove the user as
  {{{ weblink(link="https://docs.openshift.com/container-platform/latest/authentication/remove-kubeadmin.html",
              text="described in the documentation") }}}

rationale: |-
  The kubeadmin user has an auto-generated password
  and a self-signed certificate, and has effectively <pre>cluster-admin</pre>
  permissions; therefore, it's considered a security liability.

severity: medium

identifiers:
  cce@ocp4: CCE-90387-2

references:
  cis@ocp4: 3.1.1,5.1.1
  nerc-cip: CIP-004-6 R2.2.2,CIP-004-6 R2.2.3,CIP-007-3 R.1.3,CIP-007-3 R2,CIP-007-3 R5,CIP-007-3 R5.1.1,CIP-007-3 R5.1.3,CIP-007-3 R5.2.1,CIP-007-3 R5.2.3,CIP-007-3 R6.1,CIP-007-3 R6.2,CIP-007-3 R6.3,CIP-007-3 R6.4
  nist: AC-2(2),AC-2(7),AC-2(9),AC-2(10),AC-12(1),IA-2(5),MA-4,SC-12(1)
  pcidss: Req-2.1
  srg: SRG-APP-000023-CTR-000055

platform: not ocp4-on-hypershift

ocil_clause: 'the kubeadmin secret has not been deleted'

ocil: |-
  To verify that the kubeadmin secret has been deleted, make sure
  that <pre>oc get secrets kubeadmin -n kube-system</pre>
  returns a <pre>NotFound</pre> error.

warnings:
  - general: |-
      {{{ openshift_cluster_setting("/api/v1/namespaces/kube-system/secrets/kubeadmin") | indent(6) }}}

template:
  name: compliance_operator_not_found
  vars:
    filepath: /api/v1/namespaces/kube-system/secrets/kubeadmin

