From 5edd48d9b5ed388bd5da34cea532ed1b331b39b0 Mon Sep 17 00:00:00 2001 From: Benjamin Ruland Date: Wed, 6 Mar 2024 15:47:42 +0100 Subject: [PATCH] Defined notes and rules for BSI APP.4.4.A18 --- .../project_template_network_policy/rule.yml | 1 + controls/bsi_app_4_4.yml | 40 +++++++++++++++---- 2 files changed, 33 insertions(+), 8 deletions(-) diff --git a/applications/openshift/networking/project_template_network_policy/rule.yml b/applications/openshift/networking/project_template_network_policy/rule.yml index 7e219405259..cbda8e66cea 100644 --- a/applications/openshift/networking/project_template_network_policy/rule.yml +++ b/applications/openshift/networking/project_template_network_policy/rule.yml @@ -34,6 +34,7 @@ ocil: |- return true. references: + bsi: APP.4.4.A18 srg: SRG-APP-000039-CTR-000110 identifiers: diff --git a/controls/bsi_app_4_4.yml b/controls/bsi_app_4_4.yml index 98e4e9b9075..76144bb12c6 100644 --- a/controls/bsi_app_4_4.yml +++ b/controls/bsi_app_4_4.yml @@ -427,18 +427,42 @@ controls: levels: - elevated description: >- - Pods SHOULD ONLY be able to communicate with each other through the necessary network - ports, even within a Kubernetes namespace. There SHOULD be rules within the CNI that - disallow all but the necessary network connections within the Kubernetes namespace. These + (1) Pods SHOULD ONLY be able to communicate with each other through the necessary network + ports, even within a Kubernetes namespace. (2) There SHOULD be rules within the CNI that + disallow all but the necessary network connections within the Kubernetes namespace. (3) These rules SHOULD precisely define the source and destination of the allowed connections using at least one of the following criteria: service name, metadata (“labels”), Kubernetes service accounts, or certificate-based authentication. - All the criteria used as labels for a connection SHOULD be secured in such a way that they can - only be changed by authorised persons and management services. + (4) All the criteria used as labels for a connection SHOULD be secured in such a way that they + can only be changed by authorised persons and management services. notes: >- - TBD - status: pending - rules: [] + In a cluster using a network plugin that supports Kubernetes network policy, network isolation + is controlled entirely by NetworkPolicy objects. In OpenShift, the default plugins (OpenShift SDN, + OVN Kubernetes) supports using network policy. Support for NetworkPolicy objects is verified + using rules. + + Section 1-3: By default, all pods in a project are accessible from other pods and network endpoints. + To isolate one or more pods in a project, you need to create NetworkPolicy objects in that project + to indicate the allowed incoming connections. If a pod is matched by selectors in one or more + NetworkPolicy objects, then the pod will accept only connections that are allowed by at least + one of those NetworkPolicy objects. A pod that is not selected by any NetworkPolicy objects + is fully accessible. + + It is useful to create default policies for each application namespace e.g. to deny all ingress + traffic by default. The existance of at least one network policy and the automatic creation + as part of a namespace template is checked using rules. The creation of suitable NetworkPolicy + objects that satisfy the requirements from sections 1 to 3, however, needs to be ensured by the + application owner. + + Section 4: It needs to be ensured organizationally, that only required subjects are granted + RBAC to change the relevant Kubernetes objects. + status: partial + rules: + # General support of network policies + - configure_network_policies + # Section 1-2 + - configure_network_policies_namespaces + - project_config_and_template_network_policy - id: APP.4.4.A19 title: High Availability of Kubernetes