TMA-OPENSHIFT-VIRT-3.3
Ensure errorPolicy is not set to ignore
설명
Error policies for disks control how Input/Output (IO) errors are handled. If a read or write operation fails on the storage, an IO error occurs. Setting the error policy to ignore is not recommended because it makes it difficult to determine the root cause of any IO issues, which can lead to data loss if the data is not correctly written to the disk. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.
점검 방법
감사 방식: 수동 검토
이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.
Verify that no virtual machines are using the set to : errorPolicy ignore $ oc get vm - ojson - A | jq '.items[] | select(.spec.template.spec.domain.devices.disks[].errorPolicy == "ignore")| .metadata.namespace + "/" + .metadata.name'
조치 방법
조치 방식: 가이드 또는 인프라 패치
Remove the or set it to (default value) or (suggested option errorPolicy stop report for Windows Shared Cluster Filesystem). For example, to remove the errorPolicy flag on the first disk (index 0) of a given VM, this command can be used: $ oc patch vm <vm-name> --type='json' -p='[ {"op": "remove", "path": "/spec/template/spec/domain/devices/disks/0/errorPolicy"}, ]' To set an errorPolicy flag to stop on every disk, this (experimental) command can be used: $ oc get vm <vm - name> - o json | jq '.spec.template.spec.domain.devices.disks[] += {"errorPolicy":"stop"}' | oc apply -f -
속성
- 운영 체제
- 모두
- 태그
- openshift-virtmanual-review
- 참고 자료
- CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 3.3 Ensure errorPolicy is not set to ignore