controls:
- id: SRG-APP-000142-CTR-000325
  levels:
  - medium
  title: {{{ full_name }}} runtime must enforce ports, protocols, and services
    that adhere to the PPSM CAL.
  status: manual
  check: |-
    Review the OpenShift documentation and configuration.
    (See for additional information: https://docs.openshift.com/container-platform/4.12/installing/installing_platform_agnostic/installing-platform-agnostic.html)

    1. Interview the application administrator.

    2. Identify the TCP/IP port numbers OpenShift is configured to utilize and is utilizing by using a combination of relevant OS commands and application configuration utilities.

    3. Identify the network ports and protocols that are utilized by kube-apiserver by executing the following:
    oc get configmap kube-apiserver-pod -n openshift-kube-apiserver -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

    oc get configmap kube-apiserver-pod -n openshift-kube-apiserver -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.hostPort?' | grep -v "null"

    oc get services -A --show-labels | grep apiserver | awk '{print $6,$8}' | grep apiserver

    4. Identify the network ports and protocols that are utilized by kube-scheduler by executing the following:
    oc get configmap kube-scheduler-pod -n openshift-kube-scheduler -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

    oc get services -A --show-labels | grep scheduler | awk '{print $6,$8}' | grep scheduler

    5. Identify the network ports and protocols that are utilized by kube-controller-manager by executing the following:
    oc get configmap kube-controller-manager-pod -n openshift-kube-controller-manager -o "jsonpath={ .data['pod\.yaml'] }" | jq '..|.containerPort?' | grep -v "null"

    oc get services -A --show-labels | grep kube-controller

    6. Identify the network ports and protocols that are utilized by etcd by executing the following:
    oc get configmap etcd-pod -n openshift-etcd -o "jsonpath={ .data['pod\.yaml'] }" | grep -Po '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}:[0-9]+' | sort -u


    Review the PPSM web page at:

    http://www.disa.mil/Network-Services/Enterprise-Connections/PPSM

    Review the PPSM Category Assurance List (CAL) directly at the following link: 

    https://disa.deps.mil/ext/cop/iase/ppsm/Pages/cal.aspx

    Verify the ports used by the OpenShift are approved by the PPSM CAL.

    If the ports, protocols, and services have not be registered locally, this is a finding.
  fixtext: |-
    Verify the accreditation documentation lists all interfaces and the ports, protocols, and services used.

    Register OpenShift's ports, protocols, and services with PPSM.
