MEDIUM OCP (Platform) M10: API Server Encryption P2
Verified on OCP 5.0 (cnfdt16, RHCOS 10.2). API encryption not enabled by default (generation:2 confirms manual application). Default install uses identity encryption.
Overview
This remediation enables encryption at rest for etcd data in the OpenShift API server, protecting sensitive data stored in the cluster’s key-value store.
Settings
| Setting | Value | Description |
|---|---|---|
encryption.type |
aescbc |
Enable AES-CBC encryption at rest |
Implementation
This requires modifying the APIServer custom resource:
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
name: cluster
spec:
encryption:
type: aescbc
Apply with:
oc patch apiserver cluster --type merge -p '{"spec":{"encryption":{"type":"aescbc"}}}'
Compliance Checks Remediated
| Check | Profile | Docs |
|---|---|---|
ocp4-cis-api-server-encryption-provider-cipher |
CIS | 📖 |
ocp4-e8-api-server-encryption-provider-cipher |
E8 | 📖 |
Source Remediation Files
- medium/ocp4-cis-api-server-encryption-provider-cipher.yaml
- medium/ocp4-e8-api-server-encryption-provider-cipher.yaml
Verification
Check encryption status:
oc get apiserver cluster -o jsonpath='{.spec.encryption.type}'
# Expected: aescbc
# Verify encryption is active
oc get openshiftapiserver -o=jsonpath='{range .items[0].status.conditions[?(@.type=="Encrypted")]}{.type}{" "}{.status}{" "}{.reason}{"\n"}{end}'
Security Impact
Encryption at rest ensures:
- Secrets stored in etcd are encrypted
- Stolen etcd backups are protected
- Compliance with data protection requirements
- Defense in depth for sensitive configuration