title: Ensure that all edge-terminated OpenShift Routes prefer TLS

description: |-
  OpenShift Container Platform provides methods for communicating from
  outside the cluster with services running in the cluster. TLS must
  be used to protect these communications. This rule specifically
  focuses on edge-terminated OpenShift Routes, which require additional
  TLS configuration. For these routes, ensure that any request coming
  from the outside must use TLS by setting the <tt>.spec.tls.insecureEdgeTerminationPolicy</tt>
  to either <tt>None</tt> or <tt>Redirect</tt> to ensure a secure endpoint
  is used for edge-terminated routes.

rationale: |-
  Using clear-text communications for edge-terminated routes may leak
  sensitive information, compromising the security of the cluster's
  external communication channels.

identifiers:
  cce@ocp4: CCE-84225-2

{{% set jqfilter = '[.items[] | select(.spec.tls.termination == "edge") | select(.spec.tls.insecureEdgeTerminationPolicy != null) | select(.spec.tls.insecureEdgeTerminationPolicy | test("^(^$|None|Redirect)$"; "") | not) | .metadata.name]' %}}

references:
  nerc-cip: CIP-003-8 R4,CIP-003-8 R4.2,CIP-003-8 R5,CIP-004-6 R3,CIP-007-3 R5.1,CIP-007-3 R7.1
  nist: AC-4,AC-4(21),AC-17(3),SC-8,SC-8(1),SC-8(2),SI-4,SI-4(22)
  pcidss: Req-6.5.4
  srg: SRG-APP-000441-CTR-001090,SRG-APP-000442-CTR-001095

ocil_clause: 'Edge-terminated routes do not have a secure insecureEdgeTerminationPolicy'

ocil: |-
    Run the following command to retrieve all routes in the system:
    <pre>$ oc get routes --all-namespaces</pre>
    Focus on edge-terminated routes and ensure that each has either <tt>None</tt>
    or <tt>Redirect</tt> set in the <tt>.spec.tls.insecureEdgeTerminationPolicy</tt>
    setting to maintain secure external communications.

severity: medium

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({'/apis/route.openshift.io/v1/routes': jqfilter}) | indent(4) }}}

template:
  name: yamlfile_value
  vars:
      ocp_data: "true"
      filepath: "{{{ openshift_filtered_path('/apis/route.openshift.io/v1/routes', jqfilter) }}}"
      yamlpath: "[:]"
      check_existence: "none_exist"
      entity_check: "all"
      values:
        - value: "(.*?)"
          operation: "pattern match"
