Restrict patching operations in the annotations for Hyperconverged

中レベル 1手動レビューopenshift-virt

説明

The kubevirt - hyperconverged (HCO) object provides a mechanism to customize OpenShift Virtualization components through the control of patching operations. Although this approach itself does not inherently introduce security risks, enabling experimental features may have unintended consequences and might not be officially supported. It is essential to weigh the benefits of using these options against any potential security implications before proceeding. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

Ensure there are no patching operations for the Openshift Virtualization component $ oc get hyperconverged kubevirt - hyperconverged - n openshift - cnv - o jsonpath='{.metadata.annotations}'| jq '.|has("kubevirt.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq '.|has("containerizeddataimporter.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq '.|has("networkaddonsconfigs.kubevirt.io/jsonpatch")' $ oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.metadata.annotations}'| jq ...

修正方法

修正方法: ガイダンスまたは IaC パッチ

The annotations should be removed from the Hyperconverged. For example, by directly editing the object with oc edit hyperconverged kubevirt - hyperconverged -n openshift-cnv or by removing the annotation with the annotate command. Example: $ oc annotate --overwrite -n openshift-cnv hco kubevirt-hyperconverged 'containerizeddataimporter.kubevirt.io/jsonpatch-'

プロパティ

オペレーティングシステム: すべて
タグ: openshift-virtmanual-review
参照: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.6 Restrict patching operations in the annotations for Hyperconverged