V-285759

Discussion

PPS within Harvester Government platform runtime must be controlled and conform to the PPSM CAL. Those ports, protocols, and services that fall outside the PPSM CAL must be blocked by the runtime. Instructions on the PPSM can be found in DOD Instruction 8551.01 Policy. Satisfies: SRG-APP-000142-CTR-000325, SRG-APP-000383-CTR-000910

Check Content

Verify that all PPS configured and in use by the Harvester/RKE2 control plane and hosted workloads comply with the current PPSM CAL and are documented and approved.

1. Review the control plane manifest configuration. Access the terminal on a control plane node with appropriate privileges and navigate to "cd /var/lib/rancher/rke2/agent/pod-manifests".

2. Inspect the Kubernetes API server manifest for configured ports and services and execute:

grep -iE 'secure-port|insecure-port|etcd-servers' kube-apiserver.yaml

3. Review runtime configuration of control plane components. Execute the following commands to identify runtime arguments and configured PPS. Review the output to identify all configured PPS endpoints.

/var/lib/rancher/rke2/bin/kubectl get po -n kube-system -l component=kube-apiserver -o=jsonpath="{.items[].spec.containers[].args}"

/var/lib/rancher/rke2/bin/kubectl get po -n kube-system -l component=kube-controller-manager -o=jsonpath="{.items[].spec.containers[].args}"

/var/lib/rancher/rke2/bin/kubectl get po -n kube-system -l component=kube-scheduler -o=jsonpath="{.items[].spec.containers[].args}"

4. Review additional system configuration. Execute the following to inspect supporting configuration sources for PPS usage:

cat /var/lib/rancher/rke2/server/db/etcd/config

5. Review user-deployed pods and services to identify exposed ports and protocols. This must be performed on a case-by-case basis based on deployed workloads.

6. Validate against PPSM CAL and authorization. Compare all identified PPS (from manifests, runtime configuration, system configuration, and workloads) against the current PPSM CAL.

If any of the following are true, this is a finding: 
- Any PPS is not listed in the PPSM CAL and is not approved by the information system security officer (ISSO).
- Any PPS is implemented but not documented in system authorization artifacts.
- Any documented PPS does not align with the PPSM CAL or lacks ISSO approval.
- Any PPS does not meet applicable Assurance Category requirements.