documentation_complete: true


title: 'Verify Permissions on the OpenShift PKI Private Key Files'

description: |-
  {{{ describe_file_permissions(file="/etc/kubernetes/static-pod-resources/*/*/*/*.key", perms="0600") }}}

rationale: |-
  OpenShift makes use of a number of key files as part of the operation of its
  components. The permissions on these files should be set to <pre>600</pre>
  to protect their integrity and confidentiality.

identifiers:
  cce@ocp4: CCE-83580-1


severity: medium

references:
  cis@ocp4: 1.1.21
  nerc-cip: CIP-003-8 R1.3,CIP-003-8 R3,CIP-003-8 R3.1,CIP-003-8 R3.2,CIP-003-8 R3.3,CIP-003-8 R5.1.1,CIP-003-8 R5.3,CIP-004-6 R2.2.3,CIP-004-6 R2.3,CIP-007-3 R5.1,CIP-007-3 R5.1.2,CIP-007-3 R5.2,CIP-007-3 R5.3.1,CIP-007-3 R5.3.2,CIP-007-3 R5.3.3
  nist: CM-6,CM-6(1),IA-5(2)
  srg: SRG-APP-000516-CTR-001325

ocil_clause: '{{{ ocil_clause_file_permissions(file="/etc/kubernetes/static-pod-resources/*/*/*/*.key", perms="-rw-------") }}}'

ocil: |-
  {{{ ocil_file_permissions(file="/etc/kubernetes/static-pod-resources/*/*/*/*.key", perms="-rw-------") }}}

platform: ocp4-master-node

warnings:
  - dependency: |-
      This rule is only applicable for nodes that run the Kubernetes Control Plane.
      The aforementioned service is only running on the nodes labeled
      "master" by default.

# Note that this recursively checks for files, and the form is as follows:
#
#  /etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key
#
# Taking as an example:
#
#  /etc/kubernetes/static-pod-resources/kube-apiserver-pod-3/secrets/kubelet-client/tls.key
#
# - /etc/kubernetes/static-pod-resources/ is the base path
# - 'kube-apiserver-pod-3' This initial versioned resourced directory (e.g. pod version)
# - 'secrets' The type of resource (e.g. configmap or secret)
# - 'kubelet-client' the mount name
# - 'tls.key' the file
template:
  name: file_permissions
  vars:
    filepath: ^/etc/kubernetes/static-pod-resources/.*/.*/.*/.*\.key$
    filemode: '0600'
    filepath_is_regex: "true"
