
title: Ensure that all Routes has IP whitelist annotation

description: |-
  OpenShift has an option to set the IP whitelist for Routes [1] when
  creating new Routes. All routes outside the openshift namespaces and
  the kube namespaces should use the IP whitelist annotations. Requests
  from IP addresses that are not in the whitelist are dropped.

  [1] https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/ingress_and_load_balancing/configuring-routes#nw-route-specific-annotations_route-configuration

rationale: |-
  The usage of IP whitelist for Routes provides basic protection against unwanted access.

identifiers:
  cce: CCE-90596-8

references:
  nist: SC-7(5)

{{% set jqfilter = '[.items[] | select(.metadata.namespace | startswith("kube-") or startswith("openshift-") | not) | select(.metadata.annotations["haproxy.router.openshift.io/ip_whitelist"] | not) | .metadata.name]' %}}

ocil_clause: 'IP whitelist is not enabled for all routes outside the openshift namespaces'

ocil: |-
    Run the following command to retrieve a list routes that does not have IP whitelist set::
    <pre>$  oc get routes --all-namespaces -o json | jq '{{{ jqfilter }}}'</pre>
    Make sure that there is output nothing in the result.

severity: medium

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/route.openshift.io/v1/routes?limit=500': jqfilter}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
    ocp_data: "true"
    filepath: |-
      {{{ openshift_filtered_path('/apis/route.openshift.io/v1/routes?limit=500', jqfilter) }}}
    yamlpath: "[:]"
    check_existence: "none_exist"
    entity_check: "all"
    values:
      - value: "(.*?)"
        operation: "pattern match"


