Enable nonRoot feature gate in OCPvirt prior to 4.18

AltaNivel 1Automatizadaopenshift-virt

Descripción

Root is a default account with elevated privileges, including full administrative access to both security and non - security related functions. The "nonRoot" feature gate in OpenShift environments ensures virtual machine access is restricted to resources and functionality required to operate. Audit: Passes when .spec.featureGates.nonRoot of the HyperConverged resource is true, or when the cluster is OpenShift 4.18 or newer where the setting is ignored and always enabled. Requires oc logged in to the cluster with read access.

Cómo se verifica

Método de auditoría: Comando de shell

shell

command -v oc >/dev/null 2>&1 || exit 1; v=$(oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.spec.featureGates.nonRoot}') || exit 1; mi=$(oc get clusterversion version -o jsonpath='{.status.desired.version}' 2>/dev/null | cut -d. -f2); if [ "$v" = true ] || { [ -n "$mi" ] && [ "$mi" -ge 18 ] 2>/dev/null; }; then echo compliant; else echo noncompliant; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Enable nonRoot and set its value to True . $ oc patch hyperconverged kubevirt-hyperconverged - n openshift - cnv --type='json' -p='[ {"op": "replace", "path": "/spec/featureGates/nonRoot", "value": true }, ]'

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: openshift-virtfeature-gates
Referencia: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.2 Enable nonRoot feature gate in OCPvirt prior to 4.18

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target openshift-virt