TMA-OPENSHIFT-VIRT-1.2

Enable nonRoot feature gate in OCPvirt prior to 4.18

ÉlevéeNiveau 1Automatiséeopenshift-virt

Description

Root is a default account with elevated privileges, including full administrative access to both security and non - security related functions. The "nonRoot" feature gate in OpenShift environments ensures virtual machine access is restricted to resources and functionality required to operate. Audit: Passes when .spec.featureGates.nonRoot of the HyperConverged resource is true, or when the cluster is OpenShift 4.18 or newer where the setting is ignored and always enabled. Requires oc logged in to the cluster with read access.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v oc >/dev/null 2>&1 || exit 1; v=$(oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.spec.featureGates.nonRoot}') || exit 1; mi=$(oc get clusterversion version -o jsonpath='{.status.desired.version}' 2>/dev/null | cut -d. -f2); if [ "$v" = true ] || { [ -n "$mi" ] && [ "$mi" -ge 18 ] 2>/dev/null; }; then echo compliant; else echo noncompliant; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Enable nonRoot and set its value to True . $ oc patch hyperconverged kubevirt-hyperconverged - n openshift - cnv --type='json' -p='[ {"op": "replace", "path": "/spec/featureGates/nonRoot", "value": true }, ]'

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: openshift-virtfeature-gates
Référence: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.2 Enable nonRoot feature gate in OCPvirt prior to 4.18

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target openshift-virt