
title: Ensure that LUKS is configured on worker nodes

description: |-
  OpenShift has an installation-time flag that can enable LUKS (TPM2 or TANG) full disk encryption
  at installation. The object <pre>luks</pre> must be present at install time in the <pre>machineconfig</pre> file
  prepared with the <pre>install-config.yaml</pre> file.
  
rationale: |-
  Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
  protect data. The system must implement cryptographic modules adhering to the higher
  standards approved by the federal government since this provides assurance they have been tested
  and validated.


identifiers:
  cce@ocp4: CCE-85862-1

references:
  pcidss: Req-3.4.1

ocil_clause: 'LUKS encryption is not enabled on worker nodes'

ocil: |-
    Run the following command to retrieve if the LUKS object is configured:
    <pre>$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)'</pre>
    Make sure that the result is an array of 'true' values.
severity: high

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/machineconfiguration.openshift.io/v1/machineconfigs': '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)'}) | indent(4) }}}
template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: |-
      {{{ openshift_filtered_path('/apis/machineconfiguration.openshift.io/v1/machineconfigs', '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)') }}}
    yamlpath: "[:]"
    check_existence: "all_exist"
    entity_check: "all"
    values:
      - value: "true"
        operation: "equals"
