Kubernetes STIG Checklist

24 items · Security · Hard difficulty · 1 day

Practical checklist to apply DISA Kubernetes STIG controls and harden your cluster.

• Inventory cluster components

  List control plane, API server, controller-manager, scheduler, etcd, kubelets, runtime, and CNI plugins.

• Download Kubernetes STIG resources

  Fetch SCAP/XCCDF and automated content from DISA (cyber.mil) for your version.

• Review vendor-specific STIGs for runtimes and CNIs

  Check vendor or SRG guidance for Docker, containerd, Flannel, Calico, etc.

• Harden API server
• Enforce TLS and secure ciphers for API server

  Require TLS, strong ciphers, and valid certs for all API connections.

• Enable recommended admission controllers

  Enable controllers like NodeRestriction, PodSecurity, and NamespaceLifecycle.

• Restrict API server network access to management plane

  Limit API access to trusted management networks and bastion hosts.

• Encrypt etcd data at rest

  Enable encryption-provider for secrets and sensitive resources in etcd.

• Configure automated etcd backups

  Schedule regular, encrypted backups and verify backup integrity and retention.

• Enable audit logging on API server

  Configure audit policy, retention, and secure storage for audit logs.

• Configure RBAC and apply least privilege

  Create roles, rolebindings, and service accounts with minimal permissions.

• Restrict anonymous access and disable insecure ports

  Disable anonymous requests and close insecure kubelet/API ports.

• Harden kubelet on worker nodes
• Enable kubelet auth, authorization, and certificate rotation

  Require client certs, enable authz, and enable rotation where supported.

• Disable kubelet read-only port and restrict access

  Close read-only ports and firewall kubelet to management networks.

• Apply Pod Security Standards or Pod Security Admission

  Enforce baseline/privileged restrictions per namespaces or workloads.

• Implement network policies via CNI

  Define ingress/egress rules to isolate workloads and limit lateral movement.

• Ensure TLS for all cluster component communication

  Use mutual TLS for etcd, kubelet, kube-controller-manager, scheduler, etc.

• Scan container images and nodes for vulnerabilities

  Integrate image scanners and run regular node vulnerability scans.

• Enforce signed images and image provenance

  Use image signing tools (e.g., cosign, Notary) and enforce policies.

• Disable unused APIs and cluster features

  Remove/disable admission plugins and deprecated API groups not in use.

• Apply regular updates and patching schedule

  Define and follow a patch cycle for Kubernetes components and OS images.

• Document configurations and change control

  Record settings, baselines, and change approvals for STIG compliance.

• Test recovery and incident response procedures

  Perform restore drills and tabletop exercises to validate backups and IR.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.