5.5.1 Configure Image Provenance using image controller configuration parameters

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Configure Image Provenance for your deployment.

Rationale:

Kubernetes supports plugging in provenance rules to accept or reject the images in your deployments. You could configure such rules to ensure that only approved images are deployed in the cluster.

You can control which images can be imported, tagged, and run in a cluster using the image controller. For additional information on the image controller, see Image configuration resources

Impact:

You need to regularly maintain your provenance configuration based on container image updates.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Follow the OpenShift documentation: [Image configuration resources](https://docs.openshift.com/container-platform/4.5/openshift_images/image-configuration.html

Default Value:

By default, image provenance is not set.

See Also

https://workbench.cisecurity.org/files/3980