documentation_complete: true


title: 'Verify User Who Owns The OpenShift PKI Private Key Files'

description: |-
  {{{ describe_file_owner(file="/etc/kubernetes/static-pod-resources/*/*/*/*.key", owner="root") }}}

rationale: |-
  OpenShift makes use of a number of certificates as part of its operation.
  You should verify the ownership of the directory containing the PKI
  information and all files in that directory to maintain their integrity.
  The directory and files should be owned by root:root.

identifiers:
  cce@ocp4: CCE-83435-8


severity: medium

references:
  cis@ocp4: 1.1.19
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/kubernetes/static-pod-resources/*/*/*/*.key", owner="root") }}}'

ocil: |-
  {{{ ocil_file_owner(file="/etc/kubernetes/static-pod-resources/*/*/*/*.key", owner="root") }}}

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Kubernetes Control Plane.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

# Note that this recursively checks for files, and the form is as follows:
#
#  /etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key
#
# Taking as an example:
#
#  /etc/kubernetes/static-pod-resources/kube-apiserver-pod-3/secrets/kubelet-client/tls.key
#
# - /etc/kubernetes/static-pod-resources/ is the base path
# - 'kube-apiserver-pod-3' This initial versioned resourced directory (e.g. pod version)
# - 'secrets' The type of resource (e.g. configmap or secret)
# - 'kubelet-client' the mount name
# - 'tls.key' the file
template:
  name: file_owner
  vars:
    filepath: ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$
    uid_or_name: '0'
    filepath_is_regex: "true"
