Disable Shareable disks

보통레벨 1자동openshift-virt

설명

Sharable disks are shared between VMs, and they can be used only if a filesystem installed on top of it is a cluster - file system or the application using the device is distributed and cloud aware. Their wrong usage might cause data corruption. Audit: Passes when no VirtualMachine in any namespace has a disk with shareable set to true (needs jq). Requires oc logged in to the cluster with read access.

점검 방법

감사 방식: 셸 명령

shell

command -v oc >/dev/null 2>&1 || exit 1; command -v jq >/dev/null 2>&1 || exit 1; out=$(oc get vm -A -o json) || exit 1; printf '%s' "$out" | jq -e '[.items[]|select(.spec.template.spec.domain.devices.disks[]?.shareable == true)]|length == 0' >/dev/null && echo compliant || echo noncompliant

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Remove the shareable flag from any diskwhere it is found. For example, to remove the shareable flag on the first disk (index 0) of a given VM, this command can be used: $ oc patch vm <vm-name> --type='json' -p='[ {"op": "remove", "path": "/spec/template/spec/domain/devices/disks/0/shareable"}, ]' To set a shareable flag to false on every disk, this (experimental) command can be used: $ oc get vm <vm - name> - o json | jq '.spec.template.spec.domain.devices.disks[] += {"shareable":false}' | oc apply -f -

속성

운영 체제: 모두
태그: openshift-virtstoragedisks
참고 자료: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 3.2 Disable Shareable disks

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target openshift-virt