TMA-OPENSHIFT-VIRT-3.2
Disable Shareable disks
Descripción
Sharable disks are shared between VMs, and they can be used only if a filesystem installed on top of it is a cluster - file system or the application using the device is distributed and cloud aware. Their wrong usage might cause data corruption. Audit: Passes when no VirtualMachine in any namespace has a disk with shareable set to true (needs jq). Requires oc logged in to the cluster with read access.
Cómo se verifica
Método de auditoría: Comando de shell
command -v oc >/dev/null 2>&1 || exit 1; command -v jq >/dev/null 2>&1 || exit 1; out=$(oc get vm -A -o json) || exit 1; printf '%s' "$out" | jq -e '[.items[]|select(.spec.template.spec.domain.devices.disks[]?.shareable == true)]|length == 0' >/dev/null && echo compliant || echo noncompliant- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Remove the shareable flag from any diskwhere it is found. For example, to remove the shareable flag on the first disk (index 0) of a given VM, this command can be used: $ oc patch vm <vm-name> --type='json' -p='[ {"op": "remove", "path": "/spec/template/spec/domain/devices/disks/0/shareable"}, ]' To set a shareable flag to false on every disk, this (experimental) command can be used: $ oc get vm <vm - name> - o json | jq '.spec.template.spec.domain.devices.disks[] += {"shareable":false}' | oc apply -f -
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- openshift-virtstoragedisks
- Referencia
- CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 3.2 Disable Shareable disks
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target openshift-virt