OpenControls Logo

STIG Viewer

STIGViewer Support

Kubernetes must separate user functionality.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-242417CNTR-K8-001360SV-242417r961095_ruleCCI-001082medium
Description
Separating user functionality from management functionality is a requirement for all the components within the Kubernetes Control Plane. Without the separation, users may have access to management functions that can degrade the Kubernetes architecture and the services being offered, and can offer a method to bypass testing and validation of functions before introduced into a production environment.
STIGDate
Kubernetes Security Technical Implementation Guide2025-05-16

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

SEA-03.2Application Partitioning
1.00
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (19) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AU-9Protection of Audit Information
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(3)Signed Components
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
IA-5(2)Public Key-based Authentication
1.00
SC-2Separation of System and User Functionality
1.00

+9 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.13.3
1.00
CCI1 mapping
CCI-001082
1.00

Details

Check Text (C-242417r961095_chk)

On the Control Plane, run the command: kubectl get pods --all-namespaces Review the namespaces and pods that are returned. Kubernetes system namespaces are kube-node-lease, kube-public, and kube-system. If any user pods are present in the Kubernetes system namespaces, this is a finding.

Fix Text (F-45650r712606_fix)

Move any user pods that are present in the Kubernetes system namespaces to user specific namespaces.