controls:
- id: SRG-APP-000516-CTR-001325
  levels:
  - medium
  title: Container platform components must be configured in accordance with the security
    configuration settings based on DoD security configuration or implementation guidance,
    including SRGs, STIGs, NSA configuration guides, CTOs, and DTMs.
  related_rules:
  - accounts_restrict_service_account_tokens
  - accounts_unique_service_account
  - api_server_admission_control_plugin_alwaysadmit
  - api_server_admission_control_plugin_alwayspullimages
  - api_server_admission_control_plugin_namespacelifecycle
  - api_server_admission_control_plugin_noderestriction
  - api_server_admission_control_plugin_scc
  - api_server_admission_control_plugin_securitycontextdeny
  - api_server_admission_control_plugin_service_account
  - api_server_anonymous_auth
  - api_server_api_priority_flowschema_catch_all
  - api_server_api_priority_gate_enabled
  - api_server_audit_log_maxbackup
  - api_server_audit_log_maxsize
  - api_server_audit_log_path
  - api_server_auth_mode_no_aa
  - api_server_auth_mode_node
  - api_server_auth_mode_rbac
  - api_server_basic_auth
  - api_server_bind_address
  - api_server_etcd_cert
  - api_server_etcd_key
  - api_server_https_for_kubelet_conn
  - api_server_insecure_bind_address
  - api_server_insecure_port
  - api_server_kubelet_certificate_authority
  - api_server_kubelet_client_cert
  - api_server_kubelet_client_key
  - api_server_no_adm_ctrl_plugins_disabled
  - api_server_oauth_https_serving_cert
  - api_server_openshift_https_serving_cert
  - api_server_profiling_protected_by_rbac
  - api_server_request_timeout
  - api_server_service_account_lookup
  - api_server_service_account_public_key
  - api_server_tls_cipher_suites
  - api_server_token_auth
  - ocp_api_server_audit_log_maxbackup
  - ocp_api_server_audit_log_maxsize
  - controller_insecure_port_disabled
  - controller_rotate_kubelet_server_certs
  - controller_secure_port
  - controller_service_account_ca
  - controller_service_account_private_key
  - controller_use_service_account
  - etcd_auto_tls
  - etcd_cert_file
  - etcd_client_cert_auth
  - etcd_key_file
  - etcd_peer_auto_tls
  - etcd_peer_client_cert_auth
  - etcd_unique_ca
  - general_apply_scc
  - general_configure_imagepolicywebhook
  - general_default_namespace_use
  - general_default_seccomp_profile
  - general_namespaces_in_use
  - kubelet_anonymous_auth
  - kubelet_authorization_mode
  - kubelet_configure_client_ca
  - kubelet_configure_event_creation
  - kubelet_configure_tls_cipher_suites
  - kubelet_disable_readonly_port
  - kubelet_enable_cert_rotation
  - kubelet_enable_client_cert_rotation
  - kubelet_enable_iptables_util_chains
  - kubelet_enable_protect_kernel_defaults
  - kubelet_enable_protect_kernel_sysctl
  - kubelet_enable_server_cert_rotation
  - kubelet_enable_streaming_connections
  - kubelet_eviction_thresholds_set_hard_imagefs_available
  - kubelet_eviction_thresholds_set_hard_memory_available
  - kubelet_eviction_thresholds_set_hard_nodefs_available
  - kubelet_eviction_thresholds_set_hard_nodefs_inodesfree
  - file_integrity_exists
  - file_groupowner_cni_conf
  - file_groupowner_controller_manager_kubeconfig
  - file_groupowner_etcd_data_dir
  - file_groupowner_etcd_data_files
  - file_groupowner_etcd_member
  - file_groupowner_etcd_pki_cert_files
  - file_groupowner_ip_allocations
  - file_groupowner_kube_apiserver
  - file_groupowner_kube_controller_manager
  - file_groupowner_kube_scheduler
  - file_groupowner_master_admin_kubeconfigs
  - file_groupowner_multus_conf
  - file_groupowner_openshift_pki_cert_files
  - file_groupowner_openshift_pki_key_files
  - file_groupowner_openshift_sdn_cniserver_config
  - file_groupowner_ovs_conf_db_openvswitch
  - file_groupowner_ovs_conf_db_hugetlbfs
  - file_groupowner_ovs_conf_db_lock_openvswitch
  - file_groupowner_ovs_conf_db_lock_hugetlbfs
  - file_groupowner_ovs_pid
  - file_groupowner_ovs_sys_id_conf_openvswitch
  - file_groupowner_ovs_sys_id_conf_hugetlbfs
  - file_groupowner_ovs_vswitchd_pid
  - file_groupowner_ovsdb_server_pid
  - file_groupowner_scheduler_kubeconfig
  - file_owner_cni_conf
  - file_owner_controller_manager_kubeconfig
  - file_owner_etcd_data_dir
  - file_owner_etcd_data_files
  - file_owner_etcd_member
  - file_owner_etcd_pki_cert_files
  - file_owner_ip_allocations
  - file_owner_kube_apiserver
  - file_owner_kube_controller_manager
  - file_owner_kube_scheduler
  - file_owner_master_admin_kubeconfigs
  - file_owner_multus_conf
  - file_owner_openshift_pki_cert_files
  - file_owner_openshift_pki_key_files
  - file_owner_openshift_sdn_cniserver_config
  - file_owner_ovs_conf_db
  - file_owner_ovs_conf_db_lock
  - file_owner_ovs_pid
  - file_owner_ovs_sys_id_conf
  - file_owner_ovs_vswitchd_pid
  - file_owner_ovsdb_server_pid
  - file_owner_scheduler_kubeconfig
  - file_permissions_cni_conf
  - file_permissions_controller_manager_kubeconfig
  - file_permissions_etcd_data_dir
  - file_permissions_etcd_data_files
  - file_permissions_etcd_member
  - file_permissions_etcd_pki_cert_files
  - file_permissions_ip_allocations
  - file_permissions_kube_apiserver
  - file_permissions_kube_controller_manager
  - file_permissions_master_admin_kubeconfigs
  - file_permissions_multus_conf
  - file_permissions_openshift_pki_cert_files
  - file_permissions_openshift_pki_key_files
  - file_permissions_ovs_conf_db
  - file_permissions_ovs_conf_db_lock
  - file_permissions_ovs_pid
  - file_permissions_ovs_sys_id_conf
  - file_permissions_ovs_vswitchd_pid
  - file_permissions_ovsdb_server_pid
  - file_permissions_scheduler
  - file_permissions_scheduler_kubeconfig
  - file_perms_openshift_sdn_cniserver_config
  - openshift_api_server_audit_log_path
  - rbac_debug_role_protects_pprof
  - rbac_limit_cluster_admin
  - rbac_limit_secrets_access
  - rbac_pod_creation_access
  - rbac_wildcard_use
  - scansettingbinding_exists
  - scc_drop_container_capabilities
  - scc_limit_container_allowed_capabilities
  - scc_limit_ipc_namespace
  - scc_limit_net_raw_capability
  - scc_limit_network_namespace
  - scc_limit_privilege_escalation
  - scc_limit_privileged_containers
  - scc_limit_process_id_namespace
  - scc_limit_root_containers
  - secrets_consider_external_storage
  - secrets_no_environment_variables
  - file_groupowner_kubelet_conf
  - file_groupowner_proxy_kubeconfig
  - file_groupowner_worker_ca
  - file_groupowner_worker_kubeconfig
  - file_groupowner_worker_service
  - file_owner_kubelet
  - file_owner_kubelet_conf
  - file_owner_proxy_kubeconfig
  - file_owner_worker_ca
  - file_owner_worker_kubeconfig
  - file_owner_worker_service
  - file_permissions_kubelet
  - file_permissions_kubelet_conf
  - file_permissions_proxy_kubeconfig
  - file_permissions_worker_ca
  - file_permissions_worker_kubeconfig
  - file_permissions_worker_service
  - file_permissions_ovn_cni_server_sock
  - file_groupowner_ovn_cni_server_sock
  - file_owner_ovn_cni_server_sock
  - file_groupowner_ovn_db_files
  - file_owner_ovn_db_files
  - file_permissions_ovn_db_files
  status: not applicable
