STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 13 Apr 2021:

The Kubernetes kubelet static PodPath must not enable static pods.

DISA Rule

SV-242397r712547_rule

Vulnerability Number

V-242397

Group Title

SRG-APP-000033-CTR-000090

Rule Version

CNTR-K8-000440

Severity

CAT I

CCI(s)

• CCI-000213 - The information system enforces approved authorizations for logical access to information and system resources in accordance with applicable access control policies.

Weight

10

Fix Recommendation

Edit the kubelet file on each node under the /etc/sysconfig directory to remove the staticPodPath setting and restart the kubelet service by executing the command:

service kubelet restart

Check Contents

On the Master and Worker nodes, change to the /etc/sysconfig/ directory and run the command:

grep -i staticPodPath kubelet

If any of the nodes return a value for staticPodPath, this is a finding.

Vulnerability Number

V-242397

Documentable

False

Rule Version

CNTR-K8-000440

Severity Override Guidance

On the Master and Worker nodes, change to the /etc/sysconfig/ directory and run the command:

grep -i staticPodPath kubelet

If any of the nodes return a value for staticPodPath, this is a finding.

Check Content Reference

M

Target Key

5376

Comments