Restrict VNC access to cluster workloads

SedangLevel 1Tinjauan manualopenshift-virt

Deskripsi

Access to each workload’s virtual screen is provided via VNC. Permission to use VNC is granted via a role, which means users with role assigned can access the VNC console of all workloads in a namespace. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

Verify to which users have the necessary permissions to create tokens: $ oc get rolebinding - ojson | jq - c '.items[] | select(.roleRef.name | contains("token.kubevirt.io:generate"))'

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Assign this RoleBinding only to users with approval to use it, otherwise remove unapproved users.

Properti

Sistem operasi: Apa saja
Tag: openshift-virtmanual-review
Referensi: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.12 Restrict VNC access to cluster workloads