Installation Manual - 75 Hub CIS API/config hardening

Hub-dc-v7 CIS API/config remediation gate: APIServer encryption, audit profile, image registry allow lists, ingress TLS, kubeadmin removal, and post-change Compliance Operator evidence.

This chapter records the hub-dc-v7 CIS API/config hardening gate.

The gate remediated the hub-only controls that do not require worker drain: APIServer encryption, APIServer audit profile, image registry allow lists, IngressController TLS profile, and kubeadmin removal.

Governance

Safety Checkpoint

Before APIServer encryption was applied, an etcd rollback checkpoint was taken from hub-dc-v7-master-0:

/home/core/cluster-backups/20260519-084914-op-gf-compliance-4

That directory contains the etcd snapshot and static Kubernetes resource archive created by OpenShift’s cluster-backup.sh. Do not copy or publish the backup artifacts as documentation; they contain sensitive cluster state.

GitOps Desired State

The hub security layer was added under:

clusters/hub-dc-v7/security/

The root hub kustomization now points at security instead of only security/rhacs, so RHACS and the hub API/config security resources share one entry point.

The committed resources set:

apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
  name: cluster
spec:
  encryption:
    type: aesgcm
  audit:
    profile: WriteRequestBodies

Image runtime and import allow lists include the platform mirror, internal OpenShift image registry service names, Red Hat registries, and approved external registries:

quay.v7.comptech-lab.com
image-registry.openshift-image-registry.svc:5000
image-registry.openshift-image-registry.svc.cluster.local:5000
registry.redhat.io
registry.connect.redhat.com
registry.access.redhat.com
quay.io
ghcr.io
docker.io
icr.io

The default IngressController now uses a custom TLS profile:

tlsSecurityProfile:
  type: Custom
  custom:
    minTLSVersion: VersionTLS12
defaultCertificate:
  name: router-certs-default

Apply Flow

The bootstrap clone on gf-ocp-bootstrap-01 was fast-forwarded to 92198cc, then Application/hub-dc-v7-bootstrap was hard-refreshed.

Argo CD reconciled the new revision:

APIServer encryption took several minutes. During the rollout, the API-related ClusterOperators temporarily reported non-steady conditions. The gate waited until both API encryption conditions completed before removing kubeadmin.

Final API state:

Kubeadmin Removal

Before deletion, the durable admin path was revalidated:

oc auth can-i '*' '*' --as=ze
yes

After validation, Secret/kubeadmin was deleted from kube-system. A post-delete check confirmed:

Final Validation

Final hub health:

The hub ocp4-cis ComplianceScan was rescanned after the changes:

Post-rescan counts:

Target checks remediated by this gate:

Remaining hub CIS failures:

Result

The hub CIS API/config hardening gate is complete.

The six direct hub API/config findings now pass. The hub remains healthy, the desired state is in GitOps, kubeadmin is removed, and the remaining hub CIS failures are explicitly separated into future logging and NetworkPolicy gates.