documentation_complete: true


title: 'Verify User Who Owns The Kubernetes Scheduler Kubeconfig File'

description: |-
  {{{ describe_file_owner(file="/etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig", owner="root") }}}

rationale: |-
  The kubeconfig for the Scheduler contains parameters for the scheduler
  to access the Kube API.
  You should set its file ownership to maintain the integrity of the file.

severity: medium

identifiers:
  cce@ocp4: CCE-84017-3

references:
  cis@ocp4: 1.1.16
  nerc-cip: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R6.1
  nist: CM-6,CM-6(1)
  srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_owner(file="/etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig", owner="root") }}}'

ocil: |-
  {{{ ocil_file_owner(file="/etc/kubernetes/static-pod-resources/kube-scheduler-pod-*/configmaps/scheduler-kubeconfig/kubeconfig", owner="root") }}}

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Kubernetes Scheduler service.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

template:
  name: file_owner
  vars:
    filepath: ^/etc/kubernetes/static-pod-resources/kube-scheduler-pod-.*/configmaps/scheduler-kubeconfig/kubeconfig$
    uid_or_name: '0'
    filepath_is_regex: "true"
