Disable nested virtualization

MoyenneNiveau 1Revue manuelleopenshift-virt

Description

Enabling nested virtualization in OpenShift Virtualization allows virtual machines to run within a hypervisor that is itself running on top of an existing operating system. This setup, known as nested virtualization, enables the VMs to access the full range of virtualization features provided by the underlying host, including access to the virtualization stack. In this case, Openshift Virtualization uses nested virtualization to provide its VMs with access to the entire virtualization stack, allowing them to take advantage of advanced virtualization capabilities such as live migration, resource pooling, and cloning. ... The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Méthode de vérification

Méthode d'audit: Revue manuelle

Cette recommandation ne peut pas être vérifiée automatiquement. Une analyse la liste avec ces instructions lorsque vous passez --include-manual.

To check the state of nested virtualization on nodes running on Intel CPUs: $ cat /sys/module/kvm_intel/parameters/nested Disabled is denoted by 0 , and enable is denoted with 1 . If you’re using AMD CPUs, replace kvm_intel with kvm_amd .

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Add the appropriate kernel arguments to the MachineConfigPools of the workers nodes and reboot them. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/instal lation _configuration/installing - customizing#installation - special - config - kargs_installing - customizing

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: openshift-virtmanual-review
Référence: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 6.1 Disable nested virtualization