Restrict GPU and USB pass through to approved devices

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

List the host devices available to virtualization workloads and verify the host devices returned are necessary for workload execution. $ oc get hyperconverged kubevirt - hyperconverged - n openshift - cnv -ojsonpath='{.spec.permittedHostDevices}'

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Enforcing limitations to the passthroughof approved devices protects against the introduction of a malicious or unknown device to the system. The system administrator can remove the unwanted devices by patching the HCO object. { "mediatedDevices": [ { "mdevNameSelector": "DEVICE_A", "resourceName": "vendor.com/DEVICE_A" } ], "pciHostDevices": [ { "externalResourceProvider": true, "pciDeviceSelector": "XXX:YYY", "resourceName": "vendor.com/DEVICE_B" }, { "pciDeviceSelector": "NNN:MMM", "resourceName": "vendor.com/DEVICE_C" } ], "usbHostDevices": [ { "resourceName": "kubevirt.io/storage", "selectors": [ { "product": "0001", "vendor": "46f4" } ] } ] If the first PCI device (the DEVICE_A at index 0, in bold) should not be permitted to be passed through to a VM, here’s how to remove it: $ oc ...