Chapter 6. File Integrity Operator

Procedure

1. In the OpenShift Container Platform web console, navigate to Operators OperatorHub.
2. Search for the File Integrity Operator, then click Install.
3. Keep the default selection of Installation mode and namespace to ensure that the Operator will be installed to the

   openshift-file-integrity

   namespace.
4. Click Install.

1. Navigate to the Operators Installed Operators page.
2. Check that the Operator is installed in the

   openshift-file-integrity

   namespace and its status is

   Succeeded

   .

1. Navigate to the Operators Installed Operators page and inspect the

   Status

   column for any errors or failures.
2. Navigate to the Workloads Pods page and check the logs in any pods in the

   openshift-file-integrity

   project that are reporting issues.

Procedure

1. Create a

   Namespace

   object YAML file by running:

   $ oc create -f <file-name>.yaml

   Example output

   apiVersion: v1
   kind: Namespace
   metadata:
     labels:
       openshift.io/cluster-monitoring: "true"
     name: openshift-file-integrity

2. Create the

   OperatorGroup

   object YAML file:

   $ oc create -f <file-name>.yaml

   Example output

   apiVersion: operators.coreos.com/v1
   kind: OperatorGroup
   metadata:
     name: file-integrity-operator
     namespace: openshift-file-integrity
   spec:
     targetNamespaces:
     - openshift-file-integrity

3. Create the

   Subscription

   object YAML file:

   $ oc create -f <file-name>.yaml

   Example output

   apiVersion: operators.coreos.com/v1alpha1
   kind: Subscription
   metadata:
     name: file-integrity-operator
     namespace: openshift-file-integrity
   spec:
     channel: "v1"
     installPlanApproval: Automatic
     name: file-integrity-operator
     source: redhat-operators
     sourceNamespace: openshift-marketplace

Verification

1. Verify the installation succeeded by inspecting the CSV file:

   $ oc get csv -n openshift-file-integrity

2. Verify that the File Integrity Operator is up and running:

   $ oc get deploy -n openshift-file-integrity

Procedure

1. In the Administrator perspective of the web console, navigate to Operators Installed Operators.
2. Click the name of the Operator you want to change the update channel for.
3. Click the Subscription tab.
4. Click the name of the update channel under Channel.
5. Click the newer update channel that you want to change to, then click Save.

6. For subscriptions with an Automatic approval strategy, the update begins automatically. Navigate back to the Operators Installed Operators page to monitor the progress of the update. When complete, the status changes to Succeeded and Up to date.

   For subscriptions with a Manual approval strategy, you can manually approve the update from the Subscription tab.

Procedure

1. In the Administrator perspective of the OpenShift Container Platform web console, navigate to Operators Installed Operators.
2. Operators that have a pending update display a status with Upgrade available. Click the name of the Operator you want to update.
3. Click the Subscription tab. Any update requiring approval are displayed next to Upgrade Status. For example, it might display 1 requires approval.
4. Click 1 requires approval, then click Preview Install Plan.
5. Review the resources that are listed as available for update. When satisfied, click Approve.
6. Navigate back to the Operators Installed Operators page to monitor the progress of the update. When complete, the status changes to Succeeded and Up to date.

Procedure

1. Create the following example

   FileIntegrity

   CR named

   worker-fileintegrity.yaml

   to enable scans on worker nodes:

   Example FileIntegrity CR

   apiVersion: fileintegrity.openshift.io/v1alpha1
   kind: FileIntegrity
   metadata:
     name: worker-fileintegrity
     namespace: openshift-file-integrity
   spec:
     nodeSelector:
         node-role.kubernetes.io/worker: ""
     config: {}

2. Apply the YAML file to the

   openshift-file-integrity

   namespace:

   $ oc apply -f worker-fileintegrity.yaml -n openshift-file-integrity

Procedure

1. Make a copy of the default configuration.
2. Edit the default configuration with the files that must be watched or excluded.
3. Store the edited contents in a new config map.
4. Point the

   FileIntegrity

   object to the new config map through the attributes in

   spec.config

   .

5. Extract the default configuration:

   $ oc extract cm/worker-fileintegrity --keys=aide.conf

   This creates a file named

   aide.conf

   that you can edit. To illustrate how the Operator post-processes the paths, this example adds an exclude directory without the prefix:

   $ vim aide.conf

   Example output

   /hostroot/etc/kubernetes/static-pod-resources
   !/hostroot/etc/kubernetes/aide.*
   !/hostroot/etc/kubernetes/manifests
   !/hostroot/etc/docker/certs.d
   !/hostroot/etc/selinux/targeted
   !/hostroot/etc/openvswitch/conf.db

   Exclude a path specific to control plane nodes:

   !/opt/mydaemon/

   Store the other content in

   /etc

   :

   /hostroot/etc/	CONTENT_EX

6. Create a config map based on this file:

   $ oc create cm master-aide-conf --from-file=aide.conf

7. Define a

   FileIntegrity

   CR manifest that references the config map:

   apiVersion: fileintegrity.openshift.io/v1alpha1
   kind: FileIntegrity
   metadata:
     name: master-fileintegrity
     namespace: openshift-file-integrity
   spec:
     nodeSelector:
         node-role.kubernetes.io/master: ""
     config:
         name: master-aide-conf
         namespace: openshift-file-integrity

   The Operator processes the provided config map file and stores the result in a config map with the same name as the

   FileIntegrity

   object:

   $ oc describe cm/master-fileintegrity | grep /opt/mydaemon

   Example output

   !/hostroot/opt/mydaemon