Kubernetes STIG Compliance Checklist

25 items · Security · Hard difficulty · 1 day

Practical steps to secure Kubernetes clusters to DISA STIG standards.

• Download the official Kubernetes STIG (Ver 2, Rel 5)

  Get the DISA STIG from cyber.mil or public.cyber.mil for authoritative guidance.

• Inventory cluster components

  List API server, controller manager, scheduler, etcd, nodes, CNI, and runtimes.

• Verify Kubernetes version meets STIG baseline (>= 1.16.7)

  Confirm control plane and node kubelet versions match policy requirements.

• Harden API server configuration
• Enable RBAC and disable ABAC on the API server

  Use role-based access control for fine-grained permissions.

• Require TLS for all API server connections

  Enforce TLS certs and disable insecure ports (e.g., --insecure-port).

• Disable anonymous access and insecure API options

  Turn off anonymous auth and insecure-bind-address/ports.

• Secure etcd storage and access
• Enable encryption at rest for etcd

  Configure Kubernetes encryption providers for secrets stored in etcd.

• Restrict etcd network access and require TLS

  Limit etcd to control plane networks and enforce client/server TLS.

• Harden worker nodes
• Restrict kubelet access and disable unused services

  Require kubelet authentication/authorization and close unnecessary ports.

• Install OS-level security updates and disable root SSH login

  Apply patches and follow host-baseline hardening practices.

• Secure the container runtime
• Use a supported, patched runtime and minimize privileges

  Run containerd/docker versions with security fixes and drop capabilities.

• Implement network policies and review the CNI

  Ensure CNI supports required policies and apply namespace/pod rules.

• Configure logging and auditing
• Enable API server auditing with appropriate policy

  Capture relevant request data and store logs securely.

• Centralize logs and set retention and access controls

  Ship logs to a secure central store and enforce retention.

• Run automated SCAP/XCCDF scans and remediate findings

  Use provided SCAP 1.3/1.2 or XCCDF content to test compliance.

• Review and remediate known CVEs

  Track component CVEs and apply patches or mitigations promptly.

• Backup etcd and cluster configuration regularly

  Store encrypted backups offsite and test restores frequently.

• Rotate and manage TLS certificates

  Establish cert rotation schedules and automated renewal processes.

• Document configurations, deviations, and accepted exceptions

  Keep an audit trail for changes and authority waivers.

• Schedule periodic compliance reviews and subscribe to DISA updates

  Review STIG changes and update the cluster to stay compliant.

Printed from TickYouOff — the interactive version tracks your progress and can be shared with others.