Restrict VNC access to cluster workloads

SrednjaNivo 1Ručni pregledopenshift-virt

Opis

Access to each workload’s virtual screen is provided via VNC. Permission to use VNC is granted via a role, which means users with role assigned can access the VNC console of all workloads in a namespace. The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Verify to which users have the necessary permissions to create tokens: $ oc get rolebinding - ojson | jq - c '.items[] | select(.roleRef.name | contains("token.kubevirt.io:generate"))'

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Assign this RoleBinding only to users with approval to use it, otherwise remove unapproved users.

Svojstva

Operativni sistemi: Bilo koji
Oznake: openshift-virtmanual-review
Referenca: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 1.12 Restrict VNC access to cluster workloads