Overview#

The Red Hat OpenShift Security Hardening Tool is a professional-grade API designed to generate security-hardened configuration files for OpenShift Container Platform deployments. Built for DevSecOps teams and platform engineers, this tool automates the creation of security baselines that align with industry best practices and compliance frameworks.

The tool enables organizations to rapidly deploy secure OpenShift clusters by generating pre-configured security policies, network policies, RBAC configurations, and pod security standards. Rather than manually crafting security controls, users specify their hardening requirements and receive production-ready configuration files that enforce security controls across their containerized infrastructure.

Ideal users include DevSecOps engineers, Kubernetes platform administrators, security architects, and organizations undergoing compliance audits (SOC 2, PCI-DSS, HIPAA) who need to demonstrate and maintain security posture across OpenShift deployments.

Usage#

Sample Request#

json

{
  "sessionId": "sess_8f3c4a2b9e1d7f5k",
  "userId": 12345,
  "timestamp": "2024-01-15T10:30:00Z",
  "hardeningOptions": {
    "networkPolicy": ["deny-all-ingress", "allow-dns", "allow-api-server"],
    "rbac": ["least-privilege", "service-account-restriction"],
    "podSecurity": ["restricted", "audit-logging"],
    "imageSecurity": ["image-scanning", "registry-whitelist"],
    "encryption": ["etcd-encryption", "tls-everywhere"]
  }
}

Sample Response#

json

{
  "status": "success",
  "sessionId": "sess_8f3c4a2b9e1d7f5k",
  "timestamp": "2024-01-15T10:30:05Z",
  "hardeningConfig": {
    "networkPolicies": [
      {
        "apiVersion": "networking.k8s.io/v1",
        "kind": "NetworkPolicy",
        "metadata": {
          "name": "default-deny-ingress",
          "namespace": "default"
        },
        "spec": {
          "podSelector": {},
          "policyTypes": ["Ingress"]
        }
      }
    ],
    "rbacConfigurations": [
      {
        "apiVersion": "rbac.authorization.k8s.io/v1",
        "kind": "ClusterRole",
        "metadata": {
          "name": "pod-reader"
        },
        "rules": [
          {
            "apiGroups": [""],
            "resources": ["pods"],
            "verbs": ["get", "list"]
          }
        ]
      }
    ],
    "podSecurityStandards": {
      "enforce": "restricted",
      "audit": "restricted",
      "warn": "restricted"
    },
    "securityPolicies": {
      "imagePullPolicy": "Always",
      "allowPrivilegedEscalation": false,
      "runAsNonRoot": true,
      "readOnlyRootFilesystem": true
    }
  },
  "configFiles": {
    "count": 12,
    "formats": ["yaml", "json"],
    "downloadUrl": "https://api.mkkpro.com/hardening/openshift/download/sess_8f3c4a2b9e1d7f5k"
  },
  "complianceMapping": {
    "frameworks": ["CIS Kubernetes Benchmark", "NIST Cybersecurity Framework", "PCI-DSS"],
    "coveragePercentage": 94
  }
}

Endpoints#

GET /#

Health check endpoint to verify API availability.

Method: GET

Path: /

Description: Returns service health status and basic API information.

Parameters: None

Response Schema:

text

Status: 200 OK
Content-Type: application/json
Body: {} (empty object or service status metadata)

---

POST /api/hardening/generate#

Generate OpenShift security hardening configuration files based on specified security requirements.

Method: POST

Path: /api/hardening/generate

Description: Accepts hardening options and generates complete, production-ready OpenShift security configuration files including network policies, RBAC rules, pod security standards, and encryption settings.

Request Parameters:

ParameterTypeRequiredDescriptionsessionIdstringYesUnique session identifier for tracking and audit purposesuserIdintegerNoOptional user identifier for multi-tenant trackingtimestampstringYesISO 8601 formatted timestamp of the requesthardeningOptionsobjectYesDictionary mapping hardening categories to arrays of specific options (e.g., {"networkPolicy": ["deny-all-ingress"], "rbac": ["least-privilege"]})

Response Schema:

text

Status: 200 OK
Content-Type: application/json
Body: {
  "status": "success",
  "sessionId": "string",
  "timestamp": "string",
  "hardeningConfig": {
    "networkPolicies": [...],
    "rbacConfigurations": [...],
    "podSecurityStandards": {...},
    "securityPolicies": {...}
  },
  "configFiles": {
    "count": integer,
    "formats": ["yaml", "json"],
    "downloadUrl": "string"
  },
  "complianceMapping": {
    "frameworks": [...],
    "coveragePercentage": integer
  }
}

Error Response (422):

text

Status: 422 Unprocessable Entity
Content-Type: application/json
Body: {
  "detail": [
    {
      "loc": ["body", "hardeningOptions"],
      "msg": "field required",
      "type": "value_error.missing"
    }
  ]
}

---

GET /api/hardening/options#

Retrieve all available hardening options and categories supported by the tool.

Method: GET

Path: /api/hardening/options

Description: Returns a comprehensive list of all available hardening options organized by category, including descriptions and compatibility information for different OpenShift versions.

Parameters: None

Response Schema:

text

Status: 200 OK
Content-Type: application/json
Body: {
  "categories": {
    "networkPolicy": {
      "options": [
        {"id": "deny-all-ingress", "description": "...", "versions": ["4.10+"]},
        {"id": "allow-dns", "description": "...", "versions": ["4.10+"]}
      ]
    },
    "rbac": {
      "options": [
        {"id": "least-privilege", "description": "...", "versions": ["4.10+"]},
        {"id": "service-account-restriction", "description": "...", "versions": ["4.10+"]}
      ]
    },
    "podSecurity": {...},
    "imageSecurity": {...},
    "encryption": {...}
  },
  "metadata": {
    "totalOptions": integer,
    "lastUpdated": "string"
  }
}

Pricing#

PlanCalls/DayCalls/MonthPriceFree550FreeDeveloper20500$39/moProfessional2005,000$99/moEnterprise100,0001,000,000$299/mo

About#

ToolWeb.in - 200+ security APIs, CISSP & CISM, platforms: Pay-per-run, API Gateway, MCP Server, OpenClaw, RapidAPI, YouTube.

• toolweb.in
• portal.toolweb.in
• hub.toolweb.in
• toolweb.in/openclaw/
• rapidapi.com/user/mkrishna477
• youtube.com/@toolweb-009

References#

• Kong Route: https://api.mkkpro.com/hardening/openshift
• API Documentation: https://api.mkkpro.com:8144/docs