Restrict namespace administrator access to migration tools

MediaNivel 1Revisión manualopenshift-virt

Descripción

Namespace administrators have the capability to perform live migrations, which can potentially impact other users of the system. Live migration is a process where virtual machines can be moved from one physical host to another without any downtime, making it a valuable tool for managing clusters and ensuring high availability. However, since live migration involves moving data between hosts, it can have an impact on other users who may have applications running on the same hosts. As such, it is important to exercise caution when granting access to namespace administrators and ensure that appropriate safeguards are in place to minimize any potential disruptions. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Cómo se verifica

Método de auditoría: Revisión manual

Esta recomendación no se puede verificar automáticamente. Un escaneo la lista con estas instrucciones cuando se pasa --include-manual.

Use the following command to find users, service accounts and groups who are allowed to create VirtualMachineInterfaceMigration and MigrationPolicy resources: $ oc adm policy who - can create vmim $ oc adm policy who - can create migrationpolicy Ensure users are authorized to perform those actions.

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Remove access to virtualmachineinstancemigration and migrationpolicy objects create in the cluster. Example: Remove create access given by the clusterRoleBinding for the I migrationpolicy for the test user # Get all the users and service accounts who can create migrationpolicies $ oc adm policy who-can create migrationpolicy Users: system:admin .. Test # Verify that the test user can create the migrationpolicy $ oc auth can-i create migrationpolicies --as test Warning: resource 'migrationpolicies' is not namespace scoped in group 'migrations.kubevirt.io' yes # Find out which rolebinding or clusterrolbinding associated to the test user $ oc get rolebindings,clusterrolebindings --all-namespaces -o custom-columns='KIND:kind,NAMESPACE:metadata.namespace,NAME:metadata.n ...

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: openshift-virtmanual-review
Referencia: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.10 Restrict namespace administrator access to migration tools