APP.4.4.A17

[ermeratos]

Nodes SHOULD send a cryptographically secured (and, if possible, TPM-verified) status message to the control plane.

This is already achieved natively by using RHCOS.

The control plane SHOULD ONLY accept nodes into a cluster that have successfully proven their integrity

Nodes need to authenticate with a certificate.

[benruland]

Fore sentence 1, we could verify security on the relevant components, that are associated to that process (relevant config files on nodes and control plane, TLS config on both sides:

• file_owner_kubelet
• file_owner_kubelet_conf
• file_owner_worker_ca
• file_owner_worker_kubeconfig
• file_groupowner_kubelet_conf
• file_groupowner_worker_ca
• file_groupowner_worker_kubeconfig
• file_permissions_kubelet
• file_permissions_kubelet_conf
• file_permissions_worker_ca
• file_permissions_worker_kubeconfig
• kubelet_configure_client_ca
• kubelet_configure_tls_cert
• kubelet_configure_tls_key
• kubelet_configure_tls_cipher_suites
• kubelet_configure_tls_min_version
• api_server_https_for_kubelet_conn
• api_server_tls_cert
• api_server_tls_private_key
• api_server_tls_cipher_suites
• api_server_tls_security_profile
• ... maybe more?

For sentence 2, we could check, if the File Integrity Operator is installed, rule:

• file_integrity_exists
• file_integrity_notification_enabled

[benruland]

Implementation completed in https://github.com/ComplianceAsCode/content/pull/11659

[benruland]

During rebasing, I accidentially closed the previous PR. For better reviewability, I created a new PR: https://github.com/ComplianceAsCode/content/pull/12153

[sluetze]

/close as upstream is merged