OpenShift must prevent the installation of patches, service packs, device drivers, or operating system components without verification they have been digitally signed using a certificate that is recognized and approved by the organization.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-257561	SRG-APP-000384-CTR-000915	CNTR-OS-000740	SV-257561r1156740_rule	2025-12-04	2

Description
Integrity of the OpenShift platform is handled by the cluster version operator. The cluster version operator will by default GPG verify the integrity of the release image before applying it. The release image contains a sha256 digest of machine-os-content which is used by the machine config operators for updates. On the host, the container runtime (podman) verifies the integrity of that sha256 when pulling the image before the machine config operator reads its content. Hence, there is end-to-end GPG-verified integrity for the operating system updates (as well as the rest of the cluster components, which run as regular containers).

Description

Integrity of the OpenShift platform is handled by the cluster version operator. The cluster version operator will by default GPG verify the integrity of the release image before applying it. The release image contains a sha256 digest of machine-os-content which is used by the machine config operators for updates. On the host, the container runtime (podman) verifies the integrity of that sha256 when pulling the image before the machine config operator reads its content. Hence, there is end-to-end GPG-verified integrity for the operating system updates (as well as the rest of the cluster components, which run as regular containers).

ℹ️ Check
To verify integrity of the cluster version, execute the following: oc get clusterversion version If the Cluster Version Operator is not installed or the AVAILABLE is not set to "True", this is a finding. Run the following command to retrieve the Cluster Version objects in the system: oc get clusterversion version -o yaml If 'verified: true', under status history for each item is not present, this is a finding. Where OpenShift Virtualization is enabled: $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'\| jq '.\|has("kubevirt.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'\| jq '.\|has("containerizeddataimporter.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'\| jq '.\|has("networkaddonsconfigs.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'\| jq '.\|has("ssp.kubevirt.io/jsonpatch")' If any results are returned aside from empty strings, this is a finding.

ℹ️ Check

To verify integrity of the cluster version, execute the following: oc get clusterversion version If the Cluster Version Operator is not installed or the AVAILABLE is not set to "True", this is a finding. Run the following command to retrieve the Cluster Version objects in the system: oc get clusterversion version -o yaml If 'verified: true', under status history for each item is not present, this is a finding. Where OpenShift Virtualization is enabled: $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq '.|has("kubevirt.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq '.|has("containerizeddataimporter.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq '.|has("networkaddonsconfigs.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq '.|has("ssp.kubevirt.io/jsonpatch")' If any results are returned aside from empty strings, this is a finding.

✔️ Fix
By default, the integrity of RH CoreOS is checked by cluster version operator on OpenShift platform. If the integrity is not verified, reinstall of the cluster is necessary. Refer to instructions: https://docs.openshift.com/container-platform/4.10/installing/index.html Where OpenShift Virtualization is enabled: Annotations must be removed from the Hyperconverged by directly editing the object with oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv or by removing the annotation with the annotate command. Example: $ oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged 'containerizeddataimporter.kubevirt.io/jsonpatch-'

✔️ Fix

By default, the integrity of RH CoreOS is checked by cluster version operator on OpenShift platform. If the integrity is not verified, reinstall of the cluster is necessary. Refer to instructions: https://docs.openshift.com/container-platform/4.10/installing/index.html Where OpenShift Virtualization is enabled: Annotations must be removed from the Hyperconverged by directly editing the object with oc edit hyperconverged kubevirt-hyperconverged -n openshift-cnv or by removing the annotation with the annotate command. Example: $ oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged 'containerizeddataimporter.kubevirt.io/jsonpatch-'