documentation_complete: true


title: 'Verify User Who Owns The OpenShift Admin Kubeconfig Files'

description: |-
  {{{ describe_file_owner(file="/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig", owner="root") }}}

rationale: |-
  There are various kubeconfig files that can be used by the administrator,
  defining various settings for the administration of the cluster. These files
  contain credentials that can be used to control the cluster and are needed
  for disaster recovery and each kubeconfig points to a different endpoint in
  the cluster. You should restrict its file permissions to maintain the
  integrity of the kubeconfig file as an attacker who gains access to these
  files can take over the cluster.

identifiers:
  cce@ocp4: CCE-83719-5


severity: medium

references:
  cis@ocp4: 1.1.14
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig", owner="root") }}}'

ocil: |-
  {{{ ocil_file_owner(file="/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/*.kubeconfig", owner="root") }}}

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Kubernetes Control Plane.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

template:
  name: file_owner
  vars:
    filepath: ^/etc/kubernetes/static-pod-resources/kube-apiserver-certs/secrets/node-kubeconfigs/.*\.kubeconfig$
    uid_or_name: '0'
    filepath_is_regex: "true"
