Chapter 6. File Integrity Operator

Procedure

1. In the OpenShift Container Platform web console, navigate to Operators OperatorHub.
2. Search for the File Integrity Operator, then click Install.
3. Keep the default selection of Installation mode and namespace to ensure that the Operator will be installed to the

   openshift-file-integrity

   namespace.
4. Click Install.

1. Navigate to the Operators Installed Operators page.
2. Check that the Operator is installed in the

   openshift-file-integrity

   namespace and its status is

   Succeeded

   .

1. Navigate to the Operators Installed Operators page and inspect the

   Status

   column for any errors or failures.
2. Navigate to the Workloads Pods page and check the logs in any pods in the

   openshift-file-integrity

   project that are reporting issues.

Procedure

1. Create a

   Namespace

   object YAML file by running:

   $ oc create -f <file-name>.yaml

   Example output

   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
     name: openshift-file-integrity

2. Create the

   OperatorGroup

   object YAML file:

   $ oc create -f <file-name>.yaml

   Example output

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: file-integrity-operator
     namespace: openshift-file-integrity
   spec:
     targetNamespaces:
     - openshift-file-integrity

3. Create the

   Subscription

   object YAML file:

   $ oc create -f <file-name>.yaml

   Example output

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: file-integrity-operator
     namespace: openshift-file-integrity
   spec:
     channel: "stable"
     installPlanApproval: Automatic
     name: file-integrity-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace

Verification

1. Verify the installation succeeded by inspecting the CSV file:

   $ oc get csv -n openshift-file-integrity

2. Verify that the File Integrity Operator is up and running:

   $ oc get deploy -n openshift-file-integrity

Procedure

1. In the Administrator perspective of the web console, navigate to Operators Installed Operators.
2. Click the name of the Operator you want to change the update channel for.
3. Click the Subscription tab.
4. Click the name of the update channel under Channel.
5. Click the newer update channel that you want to change to, then click Save.

6. For subscriptions with an Automatic approval strategy, the update begins automatically. Navigate back to the Operators Installed Operators page to monitor the progress of the update. When complete, the status changes to Succeeded and Up to date.

   For subscriptions with a Manual approval strategy, you can manually approve the update from the Subscription tab.

Procedure

1. In the Administrator perspective of the OpenShift Container Platform web console, navigate to Operators Installed Operators.
2. Operators that have a pending update display a status with Upgrade available. Click the name of the Operator you want to update.
3. Click the Subscription tab. Any update requiring approval are displayed next to Upgrade Status. For example, it might display 1 requires approval.
4. Click 1 requires approval, then click Preview Install Plan.
5. Review the resources that are listed as available for update. When satisfied, click Approve.
6. Navigate back to the Operators Installed Operators page to monitor the progress of the update. When complete, the status changes to Succeeded and Up to date.

Procedure

1. Create the following example

   FileIntegrity

   CR named

   worker-fileintegrity.yaml

   to enable scans on worker nodes:

   Example FileIntegrity CR

   apiVersion: fileintegrity.openshift.io/v1alpha1
   kind: FileIntegrity
   metadata:
     name: worker-fileintegrity
     namespace: openshift-file-integrity
   spec:
     nodeSelector: 

   1

   
         node-role.kubernetes.io/worker: ""
     tolerations: 

   2

   
     - key: "myNode"
       operator: "Exists"
       effect: "NoSchedule"
     config: 

   3

   
       name: "myconfig"
       namespace: "openshift-file-integrity"
       key: "config"
       gracePeriod: 20 

   4

   
       maxBackups: 5 

   5

   
       initialDelay: 60 

   6

   
     debug: false
   status:
     phase: Active 

   7

   1

   Defines the selector for scheduling node scans.

   2

   Specify tolerations to schedule on nodes with custom taints. When not specified, a default toleration allowing running on main and infra nodes is applied.

   3

   Define a ConfigMap containing an AIDE configuration to use.

   4

   The number of seconds to pause in between AIDE integrity checks. Frequent AIDE checks on a node might be resource intensive, so it can be useful to specify a longer interval. Default is 900 seconds (15 minutes).

   5

   The maximum number of AIDE database and log backups (leftover from the re-init process) to keep on a node. Older backups beyond this number are automatically pruned by the daemon. Default is set to 5.

   6

   The number of seconds to wait before starting the first AIDE integrity check. Default is set to 0.

   7

   The running status of the FileIntegrity instance. Statuses are Initializing, Pending, or Active.

   Initializing	The FileIntegrity object is currently initializing or re-initializing the AIDE database.
   Pending	The FileIntegrity deployment is still being created.
   Active	The scans are active and ongoing.

2. Apply the YAML file to the

   openshift-file-integrity

   namespace:

   $ oc apply -f worker-fileintegrity.yaml -n openshift-file-integrity

Procedure

1. Make a copy of the default configuration.
2. Edit the default configuration with the files that must be watched or excluded.
3. Store the edited contents in a new config map.
4. Point the

   FileIntegrity

   object to the new config map through the attributes in

   spec.config

   .

5. Extract the default configuration:

   $ oc extract cm/worker-fileintegrity --keys=aide.conf

   This creates a file named

   aide.conf

   that you can edit. To illustrate how the Operator post-processes the paths, this example adds an exclude directory without the prefix:

   $ vim aide.conf

   Example output

   /hostroot/etc/kubernetes/static-pod-resources
   !/hostroot/etc/kubernetes/aide.*
   !/hostroot/etc/kubernetes/manifests
   !/hostroot/etc/docker/certs.d
   !/hostroot/etc/selinux/targeted
   !/hostroot/etc/openvswitch/conf.db

   Exclude a path specific to control plane nodes:

   !/opt/mydaemon/

   Store the other content in

   /etc

   :

   /hostroot/etc/	CONTENT_EX

6. Create a config map based on this file:

   $ oc create cm master-aide-conf --from-file=aide.conf

7. Define a

   FileIntegrity

   CR manifest that references the config map:

   apiVersion: fileintegrity.openshift.io/v1alpha1
   kind: FileIntegrity
   metadata:
     name: master-fileintegrity
     namespace: openshift-file-integrity
   spec:
     nodeSelector:
         node-role.kubernetes.io/master: ""
     config:
         name: master-aide-conf
         namespace: openshift-file-integrity

   The Operator processes the provided config map file and stores the result in a config map with the same name as the

   FileIntegrity

   object:

   $ oc describe cm/master-fileintegrity | grep /opt/mydaemon

   Example output

   !/hostroot/opt/mydaemon