Ensure that the etcd pod specification file ownership is set to root:root

HochStufe 1Manuelle Prüfungopenshift

Beschreibung

Ensure that the /etc/kubernetes/manifests/etcd.yaml file ownership is set to root:root. The benchmark marks this recommendation Manual.

So wird geprüft

Prüfmethode: Manuelle Prüfung

Diese Empfehlung kann nicht automatisch geprüft werden. Ein Scan führt sie mit diesen Anweisungen auf, wenn Sie --include-manual übergeben.

In OpenShift 4, starting with OpenShift 4.4, the etcd pod specification file is generated by the cluster etcd operator. The pod specification file is created on control plane nodes at /etc/kubernetes/manifests/etcd-member.yaml with ownership root:root. The default etcd pod specification file is available here: openshift/cluster-etcd-operator Run the following command : #Verify openshift-etcd ownership for i in $(oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd ) do echo "check pod $i" oc rsh -n openshift-etcd $i \ stat -c %U:%G /etc/kubernetes/manifests/etcd-pod.yaml ...

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Execute the chown command to remediate ownership and set it file ownership to root:root.

Eigenschaften

Betriebssysteme: Beliebig
Tags: openshiftcontrol-planeetcdfile-permissions
Referenz: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root