Disable nested virtualization

SrednjaNivo 1Ručni pregledopenshift-virt

Opis

Enabling nested virtualization in OpenShift Virtualization allows virtual machines to run within a hypervisor that is itself running on top of an existing operating system. This setup, known as nested virtualization, enables the VMs to access the full range of virtualization features provided by the underlying host, including access to the virtualization stack. In this case, Openshift Virtualization uses nested virtualization to provide its VMs with access to the entire virtualization stack, allowing them to take advantage of advanced virtualization capabilities such as live migration, resource pooling, and cloning. ... The benchmark marks this recommendation Manual; TMAegis reports it as a manual review item with the audit steps.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

To check the state of nested virtualization on nodes running on Intel CPUs: $ cat /sys/module/kvm_intel/parameters/nested Disabled is denoted by 0 , and enable is denoted with 1 . If you’re using AMD CPUs, replace kvm_intel with kvm_amd .

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Add the appropriate kernel arguments to the MachineConfigPools of the workers nodes and reboot them. See https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/instal lation _configuration/installing - customizing#installation - special - config - kargs_installing - customizing

Svojstva

Operativni sistemi: Bilo koji
Oznake: openshift-virtmanual-review
Referenca: CIS Red Hat OpenShift Virtual Machine Extension Benchmark v1.0.0 - 6.1 Disable nested virtualization