Home
Security Hardening
DISA STIG Kubernetes V1R4

DISA STIG Kubernetes V1R4

CNTR-K8-000150 – The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.
Details The Kubernetes Controller Manager will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure...
CNTR-K8-000160 – The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.
Details The Kubernetes Scheduler will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication....
CNTR-K8-000170 – The Kubernetes API Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.
Details The Kubernetes API Server will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure...
CNTR-K8-000180 – The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.
Details Kubernetes etcd will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure communication. The...
CNTR-K8-000190 – The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.
Details The Kubernetes API Server will prohibit the use of SSL and unauthorized versions of TLS protocols to properly secure...
CNTR-K8-000220 – The Kubernetes Controller Manager must create unique service accounts for each work payload.
Details The Kubernetes Controller Manager is a background process that embeds core control loops regulating cluster system state through the...
CNTR-K8-000270 – The Kubernetes API Server must enable Node,RBAC as the authorization mode.
Details To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DoD-approved...
CNTR-K8-000290 – User-managed resources must be created in dedicated namespaces.
Details Creating namespaces for user-managed resources is important when implementing Role-Based Access Controls (RBAC). RBAC allows for the authorization of...
CNTR-K8-000370 – The Kubernetes Kubelet must have anonymous authentication disabled.
Details A user who has access to the Kubelet essentially has root access to the nodes contained within the Kubernetes...
CNTR-K8-000380 – The Kubernetes kubelet must enable explicit authorization.
Details Kubelet is the primary agent on each node. The API server communicates with each kubelet to perform tasks such...

DISA STIG Kubernetes V1R4

CNTR-K8-000150 – The Kubernetes Controller Manager must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.

CNTR-K8-000160 – The Kubernetes Scheduler must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.

CNTR-K8-000170 – The Kubernetes API Server must use TLS 1.2, at a minimum, to protect the confidentiality of sensitive data during electronic dissemination.

CNTR-K8-000180 – The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.

CNTR-K8-000190 – The Kubernetes etcd must use TLS to protect the confidentiality of sensitive data during electronic dissemination.

CNTR-K8-000220 – The Kubernetes Controller Manager must create unique service accounts for each work payload.

CNTR-K8-000270 – The Kubernetes API Server must enable Node,RBAC as the authorization mode.

CNTR-K8-000290 – User-managed resources must be created in dedicated namespaces.

CNTR-K8-000370 – The Kubernetes Kubelet must have anonymous authentication disabled.

CNTR-K8-000380 – The Kubernetes kubelet must enable explicit authorization.