TMA-COCKROACHDB-2.2

Ensure Each CockroachDB Node Runs as a Dedicated Process on a Separate Host

中级别 1自动化cockroachdb

说明

For all self-hosted VM or bare-metal production deployments (on-premises or on cloud providers like AWS, GCP, Azure), each CockroachDB node must run as a single, dedicated cockroach start process on its own physical or virtual machine (VM). The benchmark rates this recommendation Manual; the automated check covers its objective pass criterion. Passes when exactly one cockroach start process runs on this host (FAIL when none runs). Also confirm the store directory is not shared with another node.

检查方式

审计方法: Shell 命令

shell

out=$(ps -eo args= | grep '[c]ockroach start') || exit 1; printf '%s\n' "$out" | awk 'END {print (NR == 1) ? "compliant" : NR " processes"}'

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Stop the extra cockroach start processes (systemctl stop ...), provision a dedicated VM/host with its own storage for each additional node and redeploy it there.

属性

操作系统: 任意
标签: cockroachdbarchitecture
参考: CIS CockroachDB v25.x Benchmark v1.0.0 - 2.2 Ensure Each CockroachDB Node Runs as a Dedicated Process on a Separate Host

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target cockroachdb