Skip to content

Bump OCP4 STIG from V2R2/V2R3 to V2R6 #15042

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
yuumasato wants to merge 6 commits into
base: master
Choose a base branch
from
Open

Bump OCP4 STIG from V2R2/V2R3 to V2R6 #15042

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
5adcb5f
Bump OCP4 STIG from V2R2/V2R3 to V2R6
yuumasato Aug 24, 2026
f87872b
Map alert_receiver_configured to STIG control CNTR-OS-000690
yuumasato Aug 25, 2026
570c0cc
Map routes_protected_by_tls to STIG control CNTR-OS-000820
yuumasato Aug 25, 2026
f90323b
Bump RHCOS4 STIG profiles and reference symlink to V2R6
yuumasato Aug 25, 2026
66461ac
Filter kubevirt rules from pre-V2R6, RHCOS, and V2R6 platform STIG pr…
yuumasato Aug 25, 2026
de52a3c
Remove deprecated V2R2 STIG profile snapshots
yuumasato Aug 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 11 additions & 11 deletions controls/stig_ocp4.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
policy: Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
title: Red Hat OpenShift Container Platform 4.12 Security Technical Implementation Guide
id: stig_ocp4
version: V2R2
version: V2R6
source: https://www.cyber.mil/stigs/downloads/
reference_type: stigid

Expand Down Expand Up @@ -117,7 +117,7 @@ controls:
- id: CNTR-OS-000090
levels:
- high
title: OpenShift RBAC access controls must be enforced.
title: OpenShift role-based access controls (RBAC) must be enforced.
rules:
- rbac_least_privilege
status: automated
Expand Down Expand Up @@ -644,7 +644,7 @@ controls:
- id: CNTR-OS-000630
levels:
- medium
title: OpenShift must restrict individuals the ability to launch organizational-defined Denial-of-Service
title: OpenShift must restrict individuals' ability to launch organization-defined denial-of-service
(DOS) attacks against other information systems by rate-limiting.
rules:
- project_config_and_template_resource_quota
Expand Down Expand Up @@ -693,10 +693,9 @@ controls:
- medium
title: OpenShift must configure Alert Manger Receivers to notify SA and ISSO of all audit failure
events requiring real-time alerts.
rules: []
notes: |-
This needs further investigation: CMP-2437
status: pending
rules:
- alert_receiver_configured
status: manual

- id: CNTR-OS-000720
levels:
Expand Down Expand Up @@ -772,11 +771,12 @@ controls:
levels:
- medium
title: OpenShift must protect the confidentiality and integrity of transmitted information.
rules: []
rules:
- routes_protected_by_tls
notes: |-
This item is manual and kindof vague by design as e.g. with passthrough TLS, the TLS settings
must be checked in the app anyway.
status: manual
The rule covers edge-terminated routes. Passthrough TLS must still be checked at the
application level.
status: partial

- id: CNTR-OS-000860
levels:
Expand Down
6 changes: 4 additions & 2 deletions products/ocp4/profiles/stig-node-v2r3.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
documentation_complete: true

platform: ocp4-node
status: deprecated

metadata:
version: V2R3
Expand All @@ -18,8 +19,9 @@ description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat OpenShift Container Platform 4.

filter_rules: '"ocp4-node" in platform or "ocp4-master-node" in platform or "ocp4-node-on-sdn" in platform
or "ocp4-node-on-ovn" in platform'
# Kubevirt rules were added to STIG control in V2R6 and are scanned by the stig-vm-extension CEL profile
filter_rules: '("ocp4-node" in platform or "ocp4-master-node" in platform or "ocp4-node-on-sdn" in platform
or "ocp4-node-on-ovn" in platform) and "kubevirt" not in id_'

selections:
- stig_ocp4:all
5 changes: 2 additions & 3 deletions ...ucts/ocp4/profiles/stig-node-v2r2.profile → ...ucts/ocp4/profiles/stig-node-v2r6.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,16 +2,15 @@
documentation_complete: true

platform: ocp4-node
status: deprecated

metadata:
version: V2R2
version: V2R6
SMEs:
- Vincent056
- rhmdnd
- yuumasato

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R2_STIG.zip
reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip

title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Node level'

Expand Down
6 changes: 3 additions & 3 deletions products/ocp4/profiles/stig-node.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,18 @@ documentation_complete: true
platform: ocp4-node

metadata:
version: V2R3
version: V2R6
SMEs:
- Vincent056
- rhmdnd
- yuumasato

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R3_STIG.zip
reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip

title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Node level'

description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat OpenShift Container Platform 4.

extends: stig-node-v2r3
extends: stig-node-v2r6
4 changes: 3 additions & 1 deletion products/ocp4/profiles/stig-v2r3.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@
documentation_complete: true

platform: ocp4
status: deprecated

metadata:
version: V2R3
Expand All @@ -18,8 +19,9 @@ description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat OpenShift Container Platform 4.

# Kubevirt rules were added to STIG control in V2R6 and are scanned by the stig-vm-extension CEL profile
filter_rules: '"ocp4-node" not in platform and "ocp4-master-node" not in platform and "ocp4-node-on-sdn"
not in platform and "ocp4-node-on-ovn" not in platform'
not in platform and "ocp4-node-on-ovn" not in platform and "kubevirt" not in id_'

selections:
- stig_ocp4:all
Expand Down
8 changes: 4 additions & 4 deletions products/ocp4/profiles/stig-v2r2.profile → products/ocp4/profiles/stig-v2r6.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,25 +2,25 @@
documentation_complete: true

platform: ocp4
status: deprecated

metadata:
version: V2R2
version: V2R6
SMEs:
- Vincent056
- rhmdnd
- yuumasato

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R2_STIG.zip
reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip

title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level'

description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat OpenShift Container Platform 4.

# Kubevirt rules are scanned by the stig-vm-extension CEL profile
filter_rules: '"ocp4-node" not in platform and "ocp4-master-node" not in platform and "ocp4-node-on-sdn"
not in platform and "ocp4-node-on-ovn" not in platform'
not in platform and "ocp4-node-on-ovn" not in platform and "kubevirt" not in id_'

selections:
- stig_ocp4:all
Expand Down
6 changes: 3 additions & 3 deletions products/ocp4/profiles/stig.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,18 +4,18 @@ documentation_complete: true
platform: ocp4

metadata:
version: V2R3
version: V2R6
SMEs:
- Vincent056
- rhmdnd
- yuumasato

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R3_STIG.zip
reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip

title: 'DISA STIG for Red Hat OpenShift Container Platform 4 - Platform level'

description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat OpenShift Container Platform 4.

extends: stig-v2r3
extends: stig-v2r6
5 changes: 5 additions & 0 deletions products/rhcos4/profiles/stig-v2r3.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,8 @@ metadata:
- rhmdnd
- yuumasato

status: deprecated

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R3_STIG.zip

title: 'DISA STIG for Red Hat Enterprise Linux CoreOS'
Expand All @@ -15,6 +17,9 @@ description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat Enterprise Linux CoreOS 4.

# Kubevirt rules are not applicable to RHCOS
filter_rules: '"kubevirt" not in id_'

selections:
- stig_ocp4:all
- var_sshd_set_keepalive=0
Expand Down
9 changes: 5 additions & 4 deletions products/rhcos4/profiles/stig-v2r2.profile → products/rhcos4/profiles/stig-v2r6.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,23 @@
documentation_complete: true

metadata:
version: V2R2
version: V2R6
SMEs:
- Vincent056
- rhmdnd
- yuumasato

status: deprecated

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-12_V2R2_STIG.zip
reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip

title: 'DISA STIG for Red Hat Enterprise Linux CoreOS'

description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat Enterprise Linux CoreOS 4.

# Kubevirt rules are not applicable to RHCOS
filter_rules: '"kubevirt" not in id_'

selections:
- stig_ocp4:all
- var_sshd_set_keepalive=0
Expand Down
6 changes: 3 additions & 3 deletions products/rhcos4/profiles/stig.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,18 @@
documentation_complete: true

metadata:
version: V2R3
version: V2R6
SMEs:
- Vincent056
- rhmdnd
- yuumasato

reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R3_STIG.zip
reference: https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RH_OpenShift_Container_Platform_4-x_V2R6_STIG.zip

title: 'DISA STIG for Red Hat Enterprise Linux CoreOS'

description: |-
This profile contains configuration checks that align to the DISA STIG for
Red Hat Enterprise Linux CoreOS 4.

extends: stig-v2r3
extends: stig-v2r6
561 changes: 402 additions & 159 deletions ...nces/disa-stig-ocp4-v2r3-xccdf-manual.xml → ...nces/disa-stig-ocp4-v2r6-xccdf-manual.xml
View file
Open in desktop

Large diffs are not rendered by default.

1 change: 0 additions & 1 deletion shared/references/disa-stig-rhcos4-v2r3-xccdf-manual.xml
View file
Open in desktop

This file was deleted.

1 change: 1 addition & 0 deletions shared/references/disa-stig-rhcos4-v2r6-xccdf-manual.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
./disa-stig-ocp4-v2r6-xccdf-manual.xml
Loading