Disable persistentReservations feature gate

СредњаНиво 1Аутоматскаopenshift-virt

Опис

Persistentreservations are used to reserve a shared LUN among multiple virtual machines. This feature is required when the Windows guest makes use of the Windows Shared Cluster Filesystem. Enabling persistent reservations introduces additional complexity and overhead, as it requires calculated management of resource allocation and monitoring to ensure that reservations are not overcommitted and do not impact the overall performance of the system. Enabling the persistent reservations feature introduces and relies upon an optional component with elevated privileges (qemu - pr - helper). ... Audit: Passes when .spec.featureGates.persistentReservation is false or unset (the default is disabled). Requires oc logged in to the cluster with read access.

Како се проверава

Метод провере: Команда љуске

shell

command -v oc >/dev/null 2>&1 || exit 1; v=$(oc get hyperconverged kubevirt-hyperconverged -n openshift-cnv -o jsonpath='{.spec.featureGates.persistentReservation}') || exit 1; [ "$v" = true ] && echo noncompliant || echo compliant

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

Disable the persistent reservations feature by setting to persistentReservations False for applicable hyperconverged resources. $ oc patch hyperconverged kubevirt - hyperconverged - n openshift - cnv -- type='json' -p='[ {"op": "replace", "path": "/spec/featureGates/persistentReservation", "value": false }, ]'

Својства

Оперативни системи: Било који
Ознаке: openshift-virtfeature-gates
Референца: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.3 Disable persistentReservations feature gate

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target openshift-virt