cis-ocp-v170-1.2.11

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.11

Profile Applicability

• Level: 1

Description

Always pull images.

Rationale

Setting admission control policy to AlwaysPullImages forces every new pod to pull the required images every time. In a multi-tenant cluster users can be assured that their private images can only be used by those who have the credentials to pull them. Without this admission control policy, once an image has been pulled to a node, any pod from any user can use it simply by knowing the image's name, without any authorization check against the image ownership. When this plug-in is enabled, images are always pulled prior to starting containers, which means valid credentials are required.

However, turning on this admission plugin can introduce new kinds of cluster failure modes. OpenShift 4 master and infrastructure components are deployed as pods. Enabling this feature can result in cases where loss of contact to an image registry can cause a redeployed infrastructure pod (oauth-server for example) to fail on an image pull for an image that is currently present on the node. We use PullIfNotPresent so that a loss of image registry access does not prevent the pod from starting. If it becomes PullAlways, then an image registry access outage can cause key infrastructure components to fail.

This can be managed per container. When OpenShift Container Platform creates containers, it uses the container's imagePullPolicy to determine if the image should be pulled prior to starting the container. There are three possible values for imagePullPolicy: Always, IfNotPresent, Never. If a container's imagePullPolicy parameter is not specified, OpenShift Container Platform sets it based on the image's tag. If the tag is latest, OpenShift Container Platform defaults imagePullPolicy to Always. Otherwise, OpenShift Container Platform defaults imagePullPolicy to IfNotPresent.

Impact

Credentials would be required to pull the private images every time. Also, in trusted environments, this might increases load on network, registry, and decreases speed.

This setting could impact offline or isolated clusters, which have images pre-loaded and do not have access to a registry to pull in-use images. This setting is not appropriate for clusters which use this configuration.

Audit Procedure

Use the following command to obtain a list of configured admission controllers:

oc -n openshift-kube-apiserver get configmap config -o json | jq -r '.data."config.yaml"' | jq '.apiServerArguments."enable-admission-plugins"'

Verify the list does not include AlwaysPullImages.

Remediation

None.

Default Value

When OpenShift Container Platform creates containers, it uses the container's imagePullPolicy to determine if the image should be pulled prior to starting the container.

References

1. https://docs.openshift.com/container-platform/latest/openshift_images/managing_images/image-pull-policy.html
2. https://docs.openshift.com/container-platform/latest/architecture/admission-plug-ins.html
3. https://github.com/openshift/cluster-kube-apiserver-operator/blob/release-4.6/bindata/v4.1.0/config/defaultconfig.yaml#L34-L78
4. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
5. https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#alwayspullimages

CIS Controls

MITRE ATT&CK Mappings

Profile

Level 1 (Manual)