Ensure that the healthz endpoints for the scheduler are protected by RBAC (RBAC) (Openshift)

Risk Level: High
Cloud Entity: Kubernetes Role
CloudGuard Rule ID: D9.K8S.CRY.33
Covered by Spectral: No
Category: Security, Identity, & Compliance

GSL LOGIC

KubernetesRole where name='cluster-debugger' and namespace='*' should have rules contain-any [nonResourceURLs contain ['/debug/pprof']]

REMEDIATION

None required. Profiling is protected by RBAC and cannot be disabled.

References

1. https://github.com/openshift/cluster-kube-scheduler-operator
2. https://github.com/openshift/cluster-kube-scheduler-operator/blob/release-4.5/bindata/v4.1.0/kube-scheduler/svc.yaml
3. https://github.com/openshift/cluster-kube-scheduler-operator/blob/release-4.5/bindata/v4.1.0/kube-scheduler/pod.yaml
4. https://github.com/openshift/cluster-kube-scheduler-operator/blob/release-4.5/bindata/v4.1.0/kube-scheduler/pod.yaml#L32-L37
5. https://kubernetes.io/docs/reference/command-line-tools-reference/kube-scheduler/
6. https://github.com/kubernetes/community/blob/master/contributors/devel/profiling.md

Kubernetes Role

An RBAC Role or ClusterRole contains rules that represent a set of permissions. Permissions are purely additive (there are no "deny" rules).

Compliance Frameworks

• CIS OpenShift Container Platform v4 Benchmark v1.1.0
• OpenShift Container Platform v3