5.5. Compliance Operator 扫描

流程

1. 运行以下命令检查 ScanSetting 对象：

   $ oc describe scansettings default -n openshift-compliance

   输出示例

   Name:         default
   Namespace:    openshift-compliance
   Labels:       <none>
   Annotations:  <none>
   API Version:  compliance.openshift.io/v1alpha1
   Kind:         ScanSetting
   Metadata:
     Creation Timestamp:  2022-10-10T14:07:29Z
     Generation:          1
     Managed Fields:
       API Version:  compliance.openshift.io/v1alpha1
       Fields Type:  FieldsV1
       fieldsV1:
         f:rawResultStorage:
           .:
           f:nodeSelector:
             .:
             f:node-role.kubernetes.io/master:
           f:pvAccessModes:
           f:rotation:
           f:size:
           f:tolerations:
         f:roles:
         f:scanTolerations:
         f:schedule:
         f:showNotApplicable:
         f:strictNodeScan:
       Manager:         compliance-operator
       Operation:       Update
       Time:            2022-10-10T14:07:29Z
     Resource Version:  56111
     UID:               c21d1d14-3472-47d7-a450-b924287aec90
   Raw Result Storage:
     Node Selector:
       node-role.kubernetes.io/master:
     Pv Access Modes:
       ReadWriteOnce 1
     Rotation:  3 2
     Size:      1Gi 3
     Tolerations:
       Effect:              NoSchedule
       Key:                 node-role.kubernetes.io/master
       Operator:            Exists
       Effect:              NoExecute
       Key:                 node.kubernetes.io/not-ready
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoExecute
       Key:                 node.kubernetes.io/unreachable
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoSchedule
       Key:                 node.kubernetes.io/memory-pressure
       Operator:            Exists
   Roles:
     master 4
     worker 5
   Scan Tolerations: 6
     Operator:           Exists
   Schedule:             0 1 * * * 7
   Show Not Applicable:  false
   Strict Node Scan:     true
   Events:               <none>

   1

   Compliance Operator 创建一个包含扫描结果的持久性卷（PV）。默认情况下，PV 将使用访问模式 ReadWriteOnce，因为 Compliance Operator 无法假定集群中配置的存储类。另外，多数集群中可以使用 ReadWriteOnce 访问模式。如果需要获取扫描结果，可以使用一个 helper pod 来完成此操作，该 pod 也绑定卷。使用 ReadWriteOnce 访问模式的卷只能由一个 pod 挂载，因此请记住删除帮助程序 pod。否则，Compliance Operator 将无法重复使用卷进行后续扫描。

   2

   Compliance Operator 在卷中保留三个后续扫描的结果，旧的扫描会被轮转。

   3

   Compliance Operator 将为扫描结果分配一个 GB 存储。

   4 5

   如果扫描设置使用扫描集群节点的任何配置集，请扫描这些节点角色。

   6

   默认扫描设置对象扫描所有节点。

   7

   默认扫描设置对象每天 01:00 运行扫描。

   作为默认扫描设置的替代，您可以使用 default-auto-apply，它有以下设置：

   Name:                      default-auto-apply
   Namespace:                 openshift-compliance
   Labels:                    <none>
   Annotations:               <none>
   API Version:               compliance.openshift.io/v1alpha1
   Auto Apply Remediations:   true 1
   Auto Update Remediations:  true 2
   Kind:                      ScanSetting
   Metadata:
     Creation Timestamp:  2022-10-18T20:21:00Z
     Generation:          1
     Managed Fields:
       API Version:  compliance.openshift.io/v1alpha1
       Fields Type:  FieldsV1
       fieldsV1:
         f:autoApplyRemediations:
         f:autoUpdateRemediations:
         f:rawResultStorage:
           .:
           f:nodeSelector:
             .:
             f:node-role.kubernetes.io/master:
           f:pvAccessModes:
           f:rotation:
           f:size:
           f:tolerations:
         f:roles:
         f:scanTolerations:
         f:schedule:
         f:showNotApplicable:
         f:strictNodeScan:
       Manager:         compliance-operator
       Operation:       Update
       Time:            2022-10-18T20:21:00Z
     Resource Version:  38840
     UID:               8cb0967d-05e0-4d7a-ac1c-08a7f7e89e84
   Raw Result Storage:
     Node Selector:
       node-role.kubernetes.io/master:
     Pv Access Modes:
       ReadWriteOnce
     Rotation:  3
     Size:      1Gi
     Tolerations:
       Effect:              NoSchedule
       Key:                 node-role.kubernetes.io/master
       Operator:            Exists
       Effect:              NoExecute
       Key:                 node.kubernetes.io/not-ready
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoExecute
       Key:                 node.kubernetes.io/unreachable
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoSchedule
       Key:                 node.kubernetes.io/memory-pressure
       Operator:            Exists
   Roles:
     master
     worker
   Scan Tolerations:
     Operator:           Exists
   Schedule:             0 1 * * *
   Show Not Applicable:  false
   Strict Node Scan:     true
   Events:               <none>

   1 2

   通过将 autoUpdateRemediations 和 autoApplyRemediations 标记设置为 true，您可以轻松地创建无需额外步骤自动修复的 ScanSetting 对象。

2. 创建一个 ScanSettingBinding 对，,它绑定到默认的 ScanSetting 对象，并使用 cis 和 cis-node 配置集扫描集群。例如：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSettingBinding
   metadata:
     name: cis-compliance
     namespace: openshift-compliance
   profiles:
     - name: ocp4-cis-node
       kind: Profile
       apiGroup: compliance.openshift.io/v1alpha1
     - name: ocp4-cis
       kind: Profile
       apiGroup: compliance.openshift.io/v1alpha1
   settingsRef:
     name: default
     kind: ScanSetting
     apiGroup: compliance.openshift.io/v1alpha1

3. 运行以下命令来创建 ScanSettingBinding 对象：

   $ oc create -f <file-name>.yaml -n openshift-compliance

   此时，ScanSettingBinding 对象已协调，并以 Binding 和 Bound 设置为基础。Compliance Operator 会创建一个 ComplianceSuite 对象和关联的 ComplianceScan 对象。

4. 运行以下命令跟踪合规性扫描进度：

   $ oc get compliancescan -w -n openshift-compliance

   扫描过程通过扫描阶段进行，最终完成后到达 DONE 阶段。在大多数情况下，扫描的结果是 NON-COMPLIANT。您可以检查扫描结果，并开始应用补救使集群兼容。如需更多信息，请参阅管理 Compliance Operator 补救。