
title: Ensure that full disk encryption is configured on cluster nodes

description: |-
  When full disk encryption is chosen as a way to protect card data at rest, OpenShift can provide
  several solutions depending on the hosting environment. 
  While LUKS (with TPM2 or Tang) can be used for bare metal use cases, cloud-provider specific
  disk encryption can be used as well. [1][2]

  [1] https://docs.openshift.com/container-platform/latest/machine_management/creating_machinesets/creating-machineset-azure.html#machineset-enabling-customer-managed-encryption-azure_creating-machineset-azure
  [2] https://docs.openshift.com/container-platform/latest/machine_management/creating_machinesets/creating-machineset-gcp.html#machineset-enabling-customer-managed-encryption_creating-machineset-gcp
  
rationale: |-
  Use of weak or untested encryption algorithms undermines the purposes of utilizing encryption to
  protect data. The system must implement cryptographic modules adhering to the higher
  standards approved by the federal government since this provides assurance they have been tested
  and validated.


identifiers:
  cce@ocp4: CCE-85858-9

references:
  pcidss: Req-3.4.1

{{% set azurejqfilter = '[.items[] | select(.spec.template.spec.providerSpec.value.osDisk.managedDisk.diskEncryptionSet.id != null) | .metadata.name]' %}}
{{% set ebsjqfilter = '[.items[] | .spec.template.spec.providerSpec.value.blockDevices[0].ebs.encrypted] | map(. == true)' %}}
{{% set gcpjqfilter = '[.items[] | select(.spec.template.spec.providerSpec.value.disks[0].encryptionKey.kmsKey.name != null) | .metadata.name]' %}}

ocil_clause: 'FIPS mode is not enabled on worker nodes'

ocil: |-
    Run the following command to see if EBS encryption is enabled:
    <pre>$ oc get machineset --all-namespaces -o json | jq '{{{ ebsjqfilter }}}'</pre>
    Make sure that the result is an array of 'true' values.

    Run the following command to retrieve if the GCP disk encryption is enabled:
    <pre>$ oc get machineset --all-namespaces -o json | jq '{{{ gcpjqfilter }}}'</pre>
    Make sure that the result is an array MachineSet names. These MachineSets 
    have references to the GCP's KMS key names, which can be inspected by going through them
    with <pre>$ oc get machineset --all-namespaces -o yaml</pre>

    Run the following command to retrieve if the Azure disk encryption is enabled:
    <pre>$ oc get machineset --all-namespaces -o json | jq '{{{ azurejqfilter }}}'</pre>
    Make sure that the result is an array of machineset names where
    disk encryption is enabled.
    This can be inspected by going through them
    with <pre>$ oc get machineset --all-namespaces -o yaml</pre>

    If not, run the following command to retrieve if the FIPS flag is enabled:
    <pre>$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.fips == true)'</pre>
    Make sure that the result is an array of 'true' values.
    Then, run this next command to retrieve if LUKS encryption is enabled:
    <pre>$ oc get machineconfig -o json | jq '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)'</pre>
    The result must also be an array of 'true' values.

severity: high

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting(
        {'/apis/machineconfiguration.openshift.io/v1/machineconfigs': '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.fips == true)'},
        {'/apis/machineconfiguration.openshift.io/v1/machineconfigs': '[.items[] | select(.metadata.name | test("^rendered-worker-[0-9a-z]+$|^rendered-master-[0-9a-z]+$"))] | map(.spec.config.storage.luks[0].clevis != null)'},
        {'/apis/machine.openshift.io/v1beta1/machinesets?limit=500': ebsjqfilter},
        {'/apis/machine.openshift.io/v1beta1/machinesets?limit=500': azurejqfilter},
        {'/apis/machine.openshift.io/v1beta1/machinesets?limit=500': gcpjqfilter},
      ) | indent(4) }}}
