Ensure that the etcd pod specification file ownership is set to root:root

高レベル 1手動レビューopenshift

説明

Ensure that the /etc/kubernetes/manifests/etcd.yaml file ownership is set to root:root. The benchmark marks this recommendation Manual.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

In OpenShift 4, starting with OpenShift 4.4, the etcd pod specification file is generated by the cluster etcd operator. The pod specification file is created on control plane nodes at /etc/kubernetes/manifests/etcd-member.yaml with ownership root:root. The default etcd pod specification file is available here: openshift/cluster-etcd-operator Run the following command : #Verify openshift-etcd ownership for i in $(oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd ) do echo "check pod $i" oc rsh -n openshift-etcd $i \ stat -c %U:%G /etc/kubernetes/manifests/etcd-pod.yaml ...

修正方法

修正方法: ガイダンスまたは IaC パッチ

Execute the chown command to remediate ownership and set it file ownership to root:root.

プロパティ

オペレーティングシステム: すべて
タグ: openshiftcontrol-planeetcdfile-permissions
参照: CIS Red Hat OpenShift Container Platform Benchmark v2.0.0 - 1.1.8 Ensure that the etcd pod specification file ownership is set to root:root