TMA-OPENSHIFT-VIRT-1.2

Enable nonRoot feature gate in OCPvirt prior to 4.18

HighLevel 1Automatedopenshift-virt

Description

Root is a default account with elevated privileges, including full administrative access to both security and non - security related functions. The "nonRoot" feature gate in OpenShift environments ensures virtual machine access is restricted to resources and functionality required to operate. Audit: Passes when .spec.featureGates.nonRoot of the HyperConverged resource is true, or when the cluster is OpenShift 4.18 or newer where the setting is ignored and always enabled. Requires oc logged in to the cluster with read access.

How it is checked

Audit method: Shell command

shell

command -v oc >/dev/null 2>&1 || exit 1; v=$(oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.spec.featureGates.nonRoot}') || exit 1; mi=$(oc get clusterversion version -o jsonpath='{.status.desired.version}' 2>/dev/null | cut -d. -f2); if [ "$v" = true ] || { [ -n "$mi" ] && [ "$mi" -ge 18 ] 2>/dev/null; }; then echo compliant; else echo noncompliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Enable nonRoot and set its value to True . $ oc patch hyperconverged kubevirt-hyperconverged - n openshift - cnv --type='json' -p='[ {"op": "replace", "path": "/spec/featureGates/nonRoot", "value": true }, ]'

Properties

Operating systems: Any
Tags: openshift-virtfeature-gates
Reference: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.2 Enable nonRoot feature gate in OCPvirt prior to 4.18

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target openshift-virt