TMA-OPENSHIFT-VIRT-3.2

Disable Shareable disks

SrednjaNivo 1Automatskaopenshift-virt

Opis

Sharable disks are shared between VMs, and they can be used only if a filesystem installed on top of it is a cluster - file system or the application using the device is distributed and cloud aware. Their wrong usage might cause data corruption. Audit: Passes when no VirtualMachine in any namespace has a disk with shareable set to true (needs jq). Requires oc logged in to the cluster with read access.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v oc >/dev/null 2>&1 || exit 1; command -v jq >/dev/null 2>&1 || exit 1; out=$(oc get vm -A -o json) || exit 1; printf '%s' "$out" | jq -e '[.items[]|select(.spec.template.spec.domain.devices.disks[]?.shareable == true)]|length == 0' >/dev/null && echo compliant || echo noncompliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Remove the shareable flag from any diskwhere it is found. For example, to remove the shareable flag on the first disk (index 0) of a given VM, this command can be used: $ oc patch vm <vm-name> --type='json' -p='[ {"op": "remove", "path": "/spec/template/spec/domain/devices/disks/0/shareable"}, ]' To set a shareable flag to false on every disk, this (experimental) command can be used: $ oc get vm <vm - name> - o json | jq '.spec.template.spec.domain.devices.disks[] += {"shareable":false}' | oc apply -f -

Svojstva

Operativni sistemi: Bilo koji
Oznake: openshift-virtstoragedisks
Referenca: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 3.2 Disable Shareable disks

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target openshift-virt