HSTS Missing From HTTPS Server (RFC 6797) for several ports in OpenShift
Issue
- HSTS (HTTP Strict Transport Security) is not being enforced on HTTPS servers running on RHOCP node.
- Security scanner reports vulnerability for OCP nodes on ports
10250,9637and5000. - Kubelet (ports
9637and10250) and internal Image Registry (port5000) are not enforcing HTTP Strict Transport Security Headers as defined by RFC 6797. - Is it possible to enforce HSTS for Kubelet or internal Image Registry?
Environment
- Red Hat OpenShift Container Platform (RHOCP)
- 4
- HTTP Strict Transport Security (HSTS)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.