Restrict update access to the CDI CR

MediumLevel 1Manual reviewopenshift-virt

Description

The CDI object is not namespaced and contains sensitive configuration data for the Containerized Data Importer. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

How it is checked

Audit method: Manual review

This recommendation cannot be checked automatically. A scan lists it with these instructions when you pass --include-manual.

check who can update the cdi resources: $ oc adm policy who - can update cdi

How it is fixed

Fix method: Guidance or infrastructure patch

Assign update access only to approved cdi objects in the cluster.

Properties

Operating systems: Any
Tags: openshift-virtmanual-review
Reference: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.14 Restrict update access to the CDI CR