OpenShift must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-257561	CNTR-OS-000740	SV-257561r921626_rule		Medium

Description
Integrity of the OpenShift platform is handled by the cluster version operator. The cluster version operator will by default GPG verify the integrity of the release image before applying it. The release image contains a sha256 digest of machine-os-content which is used by the machine config operators for updates. On the host, the container runtime (podman) verifies the integrity of that sha256 when pulling the image before the machine config operator reads its content. Hence, there is end-to-end GPG-verified integrity for the operating system updates (as well as the rest of the cluster components which run as regular containers).

Description

Integrity of the OpenShift platform is handled by the cluster version operator. The cluster version operator will by default GPG verify the integrity of the release image before applying it. The release image contains a sha256 digest of machine-os-content which is used by the machine config operators for updates. On the host, the container runtime (podman) verifies the integrity of that sha256 when pulling the image before the machine config operator reads its content. Hence, there is end-to-end GPG-verified integrity for the operating system updates (as well as the rest of the cluster components which run as regular containers).

STIG	Date
Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide	2023-08-28

Details

Check Text ( C-61296r921624_chk )
To verify integrity of the cluster version, execute the following: oc get clusterversion version If the Cluster Version Operator is not installed or the AVAILABLE is not set to True, this is a finding. Run the following command to retrieve the Cluster Version objects in the system: oc get clusterversion version -o yaml If "verified: true", under status history for each item is not present, this is a finding.

Check Text ( C-61296r921624_chk )

To verify integrity of the cluster version, execute the following:

oc get clusterversion version

If the Cluster Version Operator is not installed or the AVAILABLE is not set to True, this is a finding.

Run the following command to retrieve the Cluster Version objects in the system:

oc get clusterversion version -o yaml

If "verified: true", under status history for each item is not present, this is a finding.

Fix Text (F-61220r921625_fix)
By default, the integrity of RH CoreOS is checked by cluster version operator on OpenShift platform. If the integrity is not verified, reinstall of the cluster is necessary. Refer to instructions: https://docs.openshift.com/container-platform/4.10/installing/index.html