Skip to content

Commit b50dcd4

Browse files
rhmdndrhmdnd
committed
Add ITSAR NFV section 2 profile and controls
ITSAR has a benchmark for NFV functionality, which is applicable to OpenShift and RHCOS. Let's build out those profiles section by section, starting with section 2. Section 1 is reserved as an overview and doesn't contain any technical controls.
1 parent 3268ddd commit b50dcd4

6 files changed

Lines changed: 191 additions & 0 deletions

File tree

‎controls/itsar_nfv.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
---
2+
policy: ITSAR NFV
3+
title: ITSAR NFV
4+
id: itsar_nfv
5+
source: ''
6+
7+
product:
8+
- ocp4
9+
- rhcos4

‎controls/itsar_nfv/section-2.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
---
2+
controls:
3+
- id: '2'
4+
title: System Management
5+
status: automated
6+
rules: []
7+
controls:
8+
- id: '2.1'
9+
title: Authentication
10+
status: pending
11+
rules: []
12+
controls:
13+
- id: 2.1.1
14+
title: Ensure mutual authentication is enabled for system management interfaces
15+
status: automated
16+
rules:
17+
- api_server_client_ca
18+
- api_server_kubelet_client_cert
19+
- etcd_client_cert_auth
20+
- etcd_peer_client_cert_auth
21+
- kubelet_configure_client_ca
22+
- id: 2.1.2
23+
title: Management Traffic Protection
24+
status: automated
25+
rules:
26+
- api_server_tls_security_profile
27+
- api_server_tls_security_profile_not_old
28+
- api_server_tls_security_profile_custom_min_tls_version
29+
- api_server_tls_cipher_suites
30+
- api_server_tls_cert
31+
- api_server_tls_private_key
32+
- api_server_https_for_kubelet_conn
33+
- api_server_insecure_port
34+
- api_server_insecure_bind_address
35+
- kubelet_configure_tls_min_version
36+
- kubelet_configure_tls_cipher_suites
37+
- etcd_cert_file
38+
- etcd_key_file
39+
- etcd_peer_cert_file
40+
- etcd_peer_key_file
41+
- etcd_auto_tls
42+
- etcd_peer_auto_tls
43+
- etcd_check_cipher_suite
44+
- id: 2.1.3
45+
title: Role-Based Access Control (RBAC) Policy
46+
status: automated
47+
rules:
48+
- api_server_auth_mode_rbac
49+
- rbac_least_privilege
50+
- rbac_cluster_roles_defined
51+
- rbac_roles_defined
52+
- rbac_limit_cluster_admin
53+
- rbac_wildcard_use
54+
- id: 2.1.4
55+
title: User Authentication
56+
status: automated
57+
rules:
58+
- idp_is_configured
59+
- ocp_idp_no_htpasswd
60+
- kubeadmin_removed
61+
- ocp_no_ldap_insecure
62+
- api_server_token_auth
63+
- api_server_basic_auth
64+
- accounts_unique_service_account
65+
- accounts_restrict_service_account_tokens
66+
- controller_use_service_account
67+
- api_server_service_account_lookup
68+
- id: 2.1.5
69+
title: Remote Login Restrictions for Privileged Users
70+
status: automated
71+
rules:
72+
- sshd_disable_root_login
73+
- no_direct_root_logins
74+
- id: 2.1.6
75+
title: Authorization Policy
76+
status: automated
77+
rules:
78+
- scc_limit_privileged_containers
79+
- scc_limit_root_containers
80+
- scc_limit_privilege_escalation
81+
- scc_limit_host_dir_volume_plugin
82+
- scc_drop_container_capabilities
83+
- scc_limit_container_allowed_capabilities
84+
- scc_limit_net_raw_capability
85+
- scc_limit_ipc_namespace
86+
- scc_limit_network_namespace
87+
- scc_limit_process_id_namespace
88+
- scc_limit_host_ports
89+
- id: 2.1.7
90+
title: Unambiguous Identification of the User & Group Accounts Removal
91+
status: automated
92+
rules:
93+
- idp_is_configured
94+
- ocp_idp_no_htpasswd
95+
- kubeadmin_removed
96+
- accounts_unique_service_account
97+
- accounts_no_clusterrolebindings_default_service_account
98+
- accounts_no_rolebindings_default_service_account
99+
- audit_logging_enabled
100+
- audit_profile_set
101+
- id: 2.1.8
102+
title: Out of Band Management
103+
status: partial
104+
notes: |-
105+
This is an infrastructure-level control. Verify that the
106+
Kubernetes API server and OpenShift Console are accessible
107+
only through a private management network or a secure VPN
108+
tunnel that enforces MFA.
109+
rules:
110+
- configure_network_policies
111+
- configure_network_policies_namespaces
112+
- project_config_and_template_network_policy

‎products/ocp4/profiles/itsar-nfv-v2-0-0.profile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
documentation_complete: true
3+
4+
title: 'ITSAR NFV for Red Hat OpenShift Container Platform 4'
5+
6+
platform: ocp4
7+
8+
reference: https://nccs.gov.in/home/itsars
9+
10+
metadata:
11+
version: V2.0.0
12+
13+
description: |-
14+
This profile defines a baseline that aligns to the ITSAR NFV
15+
requirements for Red Hat OpenShift Container Platform 4.
16+
17+
selections:
18+
- itsar_nfv:all

‎products/ocp4/profiles/itsar-nfv.profile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
documentation_complete: true
3+
4+
title: 'ITSAR NFV for Red Hat OpenShift Container Platform 4'
5+
6+
platform: ocp4
7+
8+
reference: https://nccs.gov.in/home/itsars
9+
10+
metadata:
11+
version: V2.0.0
12+
13+
description: |-
14+
This profile defines a baseline that aligns to the ITSAR NFV
15+
requirements for Red Hat OpenShift Container Platform 4.
16+
17+
extends: itsar-nfv-v2-0-0

‎products/rhcos4/profiles/itsar-nfv-v2-0-0.profile‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
---
2+
documentation_complete: true
3+
4+
title: 'ITSAR NFV for Red Hat Enterprise Linux CoreOS 4'
5+
6+
platform: rhcos4
7+
8+
reference: https://nccs.gov.in/home/itsars
9+
10+
metadata:
11+
version: V2.0.0
12+
13+
description: |-
14+
This profile defines a baseline that aligns to the ITSAR NFV
15+
requirements for Red Hat Enterprise Linux CoreOS 4.
16+
17+
selections:
18+
- itsar_nfv:all

‎products/rhcos4/profiles/itsar-nfv.profile‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
documentation_complete: true
3+
4+
title: 'ITSAR NFV for Red Hat Enterprise Linux CoreOS 4'
5+
6+
platform: rhcos4
7+
8+
reference: https://nccs.gov.in/home/itsars
9+
10+
metadata:
11+
version: V2.0.0
12+
13+
description: |-
14+
This profile defines a baseline that aligns to the ITSAR NFV
15+
requirements for Red Hat Enterprise Linux CoreOS 4.
16+
17+
extends: itsar-nfv-v2-0-0

0 commit comments

Comments
 (0)