Enable nonRoot feature gate in OCPvirt prior to 4.18

HochStufe 1Automatisiertopenshift-virt

Beschreibung

Root is a default account with elevated privileges, including full administrative access to both security and non - security related functions. The "nonRoot" feature gate in OpenShift environments ensures virtual machine access is restricted to resources and functionality required to operate. Audit: Passes when .spec.featureGates.nonRoot of the HyperConverged resource is true, or when the cluster is OpenShift 4.18 or newer where the setting is ignored and always enabled. Requires oc logged in to the cluster with read access.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

command -v oc >/dev/null 2>&1 || exit 1; v=$(oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.spec.featureGates.nonRoot}') || exit 1; mi=$(oc get clusterversion version -o jsonpath='{.status.desired.version}' 2>/dev/null | cut -d. -f2); if [ "$v" = true ] || { [ -n "$mi" ] && [ "$mi" -ge 18 ] 2>/dev/null; }; then echo compliant; else echo noncompliant; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Enable nonRoot and set its value to True . $ oc patch hyperconverged kubevirt-hyperconverged - n openshift - cnv --type='json' -p='[ {"op": "replace", "path": "/spec/featureGates/nonRoot", "value": true }, ]'

Eigenschaften

Betriebssysteme: Beliebig
Tags: openshift-virtfeature-gates
Referenz: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.2 Enable nonRoot feature gate in OCPvirt prior to 4.18

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target openshift-virt