Disable nested virtualization

SedangLevel 1Tinjauan manualopenshift-virt

Deskripsi

Enabling nested virtualization in OpenShift Virtualization allows virtual machines to run within a hypervisor that is itself running on top of an existing operating system. This setup, known as nested virtualization, enables the VMs to access the full range of virtualization features provided by the underlying host, including access to the virtualization stack. In this case, Openshift Virtualization uses nested virtualization to provide its VMs with access to the entire virtualization stack, allowing them to take advantage of advanced virtualization capabilities such as live migration, resource pooling, and cloning. ... The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Cara pemeriksaan

Metode audit: Tinjauan manual

Rekomendasi ini tidak dapat diperiksa secara otomatis. Pemindaian akan menampilkannya beserta petunjuk ini saat Anda memberikan opsi --include-manual.

To check the state of nested virtualization on nodes running on Intel CPUs: $ cat /sys/module/kvm_intel/parameters/nested Disabled is denoted by 0 , and enable is denoted with 1 . If you’re using AMD CPUs, replace kvm_intel with kvm_amd .

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Add the appropriate kernel arguments to the MachineConfigPools of the workers nodes and reboot them. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/instal lation _configuration/installing - customizing#installation - special - config - kargs_installing - customizing

Properti

Sistem operasi: Apa saja
Tag: openshift-virtmanual-review
Referensi: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 6.1 Disable nested virtualization