documentation_complete: true


title: 'Verify Group Who Owns The Kubernetes Controller Manager Pod Specification File'

description: '{{{ describe_file_group_owner(file="/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml", group="root") }}}'

rationale: |-
    The Kubernetes specification file contains information about the configuration of the
    Kubernetes Controller Manager Server that is configured on the system. Protection of this file is
    critical for OpenShift security.

severity: medium

identifiers:
    cce@ocp4: CCE-83953-0

references:
    cis@ocp4: 1.1.4
    nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
    nist: CM-6,CM-6(1)
    srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_group_owner(file="/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml", group="root") }}}'

ocil: |-
    {{{ ocil_file_group_owner(file="/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-*/kube-controller-manager-pod.yaml", group="root") }}}

platform: ocp4-master-node

warnings:
    - dependency: |-
        This rule is only applicable for nodes that run the Kubernetes Controller Manager service.
        The aforementioned service is only running on the nodes labeled
        "master" by default.

template:
    name: file_groupowner
    vars:
        filepath: '^/etc/kubernetes/static-pod-resources/kube-controller-manager-pod-.*/kube-controller-manager-pod.yaml$'
        filepath_is_regex: 'true'
        gid_or_name: '0'
