Ensure that the etcd pod specification file permissions are set to 600 or more restrictive

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

In OpenShift 4, starting with OpenShift 4.4, the etcd pod specification file is generated by the cluster etcd operator. The default etcd pod specification file is available here: openshift/cluster-etcd-operator Run the following command. for i in $(oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd ) do echo "check pod $i" oc rsh -n openshift-etcd $i \ stat -c %a /etc/kubernetes/manifests/etcd-pod.yaml done Verify that the permissions are 600 or more restrictive.

조치 방법

조치 방식: 가이드 또는 인프라 패치

There is no remediation for updating the permissions of etcd-pod.yaml. The file is owned by an OpenShift operator and any changes to the file will result in a degraded cluster state. Please do not attempt to remediate the permissions of this file.