# an available choice for the specs control
name:
  CisPolicy
description:
  cis compliance for OCP
multiselect:
  specs
replacements: # if user select this choice, the template variable names and values to use
  standards: |
    NIST-CSF
  categories: |
    PR.PT Protective Technology
  controls: |
    PR.PT-3 Least Functionality
  policyTemplates: |
    - objectDefinition:
        apiVersion: policy.open-cluster-management.io/v1
        kind: CisPolicy # cis compliance for OCP
        metadata:
          labels:
            controller-tools.k8s.io: "1.0"
          name: {{name}}-pci-ocp-example
        spec:
          cisSpecVersion: 1.4
          severity: medium
          kubernetesCisPolicy:
            masterNodeExcludeRules:
            - 1.1 Maintain default behavior for anonymous access
            - 1.3 Insecure Tokens
            - 1.8 Do not expose API server profiling data
            - 1.11 Manage the AlwaysPullImages admission controller
            - 1.12 Use Security Context Constraints instead of DenyEscalatingExec admission
            - 1.13 Use Security Context Constraints instead of the SecurityContextDeny admission controller
            - 1.15 Configure API server auditing - audit log file path
            - 1.16 Configure API server auditing - audit log retention
            - 1.17 Configure API server auditing - audit log backup retention
            - 1.18 Configure audit log file size
            - 1.23 Verify that the service account lookup flag is not set
            - 1.24 Verify the PodSecurityPolicy is disabled to ensure use of SecurityContextConstraints
            - 1.31 Verify that the authorization-mode argument is not set
            - 1.34 Set the encryption provider to aescbc for etcd data at rest
            - 1.35 Enable the EventRateLimit plugin
            - 1.37 Adjust the request timeout argument for your cluster resources
            - 2.1 Verify that Scheduler profiling is not exposed to the web
            - 3.1 Adjust the terminated-pod-gc-threshold argument as needed
            - 3.2 Verify that Controller profiling is not exposed to the web
            - 3.6 Verify that Security Context Constraints are applied to Your Pods and Containers
            - 3.7 Manage certificate rotation
            - 4.6 Verify the scheduler pod specification file ownership set by OpenShift
            - 4.9 Verify the default OpenShift Container Network Interface file permissions
            - 4.12 Verify the default OpenShift etcd data directory ownership
            - 5.1 Verify the default OpenShift cert-file and key-file configuration
            - 5.2 Verify the default OpenShift setting for the client-cert-auth argument
            - 5.3 Verify the OpenShift default values for etcd_auto_tls
            - 5.4 Verify the OpenShift default peer-cert-file and peer-key-file arguments for etcd
            - 5.5 Verify the OpenShift default configuration for the peer-client-cert-auth
            - 5.6 Verify the OpenShift default configuration for the peer-auto-tls argument
            - 5.7 Optionally modify the wal-dir argument
            - 5.8 Optionally modify the max-wals argument
            - 5.9 Verify the OpenShift default configuration for the etcd Certificate Authority
            - 6.1 Ensure that the cluster-admin role is only used where required
            - 6.2 Verify Security Context Constraints as in use
            - 6.3 Use OpenShift projects to maintain boundaries between resources
            - 6.4 Create network segmentation using the Multi-tenant plugin or Network Policies
            - 6.5 Enable seccomp and configure custom Security Context Constraints
            - 6.7 Manage Image Provenance using ImagePolicyWebhook admission controller
            - 6.8 Configure Network policies as appropriate
            - 6.9 Use Security Context Constraints as compensating controls for privileged containers
            workerNodeExcludeRules:
            - 7.1 Use Security Context Constraints to manage privileged containers as needed
            - 7.2 Ensure anonymous-auth is not disabled
            - 7.7 Verify the OpenShift defaults for the protect-kernel-defaults argument
            - 7.9 Verify that the --keep-terminated-pod-volumes argument is set to false
            - 7.10 Verify the OpenShift defaults for the hostname-override argument
            - 7.12 Verify the OpenShift cert-dir flag for HTTPS traffic
            - 8.2 Verify the kubeconfig file ownership of root:root
            - 8.4 Verify the kubelet service file ownership of root:root
            - 8.6 Verify the proxy kubeconfig file ownership of root:root
            - 8.8 Verify the client certificate authorities file ownership of root:root