OpenShift Virtualization
TMA-OPENSHIFT-VIRT-1.12
Restrict VNC access to cluster workloads
MediumLevel 1Manual reviewopenshift-virt
Description
Access to each workload’s virtual screen is provided via VNC. Permission to use VNC is granted via a role, which means users with role assigned can access the VNC console of all workloads in a namespace. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.
How it is checked
Audit method: Manual review
This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.
Verify to which users have the necessary permissions to create tokens: $ oc get rolebinding - ojson | jq - c '.items[] | select(.roleRef.name | contains("token.kubevirt.io:generate"))'
How it is fixed
Fix method: Guidance or infrastructure patch
Assign this RoleBinding only to users with approval to use it, otherwise remove unapproved users.
Properties
- Operating systems
- Any
- Tags
- openshift-virtmanual-review
- Reference
- CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.12 Restrict VNC access to cluster workloads