Red Hat Summit 红帽全球峰会支持控制台（Console）开发人员开始试用联系人

4.6. Using process baselines

You can minimize risk by using process baselining for infrastructure security. With this approach, Red Hat Advanced Cluster Security for Kubernetes first discovers existing processes and creates a baseline. Then it operates in the default deny-all mode and only allows processes listed in the baseline to run.

Process baselines
When you install Red Hat Advanced Cluster Security for Kubernetes, there is no default process baseline. As Red Hat Advanced Cluster Security for Kubernetes discovers deployments, it creates a process baseline for every container type in a deployment. Then it adds all discovered processes to their own process baselines.
Process baseline states
During the process discovery phase, all baselines are in an unlocked state.

In an unlocked state:

  • When Red Hat Advanced Cluster Security for Kubernetes discovers a new process, it adds that process to the process baseline.
  • Processes do not show up as risks and do not trigger any violations.

After an hour from when Red Hat Advanced Cluster Security for Kubernetes receives the first process indicator from a container in a deployment, it finishes the process discovery phase. For information about how to configure the duration of the discovery phase, see "Configuring the observation period for the process baseline".

At this point:

  • Red Hat Advanced Cluster Security for Kubernetes stops adding processes to the process baselines.
  • New processes that are not in the process baseline show up as risks, but they do not trigger any violations.

To generate violations, you must manually lock the process baseline.

In a locked state:

  • Red Hat Advanced Cluster Security for Kubernetes stops adding processes to the process baselines.
  • New processes that are not in the process baseline trigger violations.

Independent of the locked or unlocked baseline state, you can always add or remove processes from the baseline.

注意

For a deployment, if each pod has multiple containers in it, Red Hat Advanced Cluster Security for Kubernetes creates a process baseline for each container type. For such a deployment, if some baselines are locked and some are unlocked, the baseline status for that deployment shows up as Mixed.

You can configure the observation period for the process baseline by setting the ROX_BASELINE_GENERATION_DURATION environment variable.

Procedure

  • Set the ROX_BASELINE_GENERATION_DURATION environment variable by running the following command: 

    $ oc -n stackrox set env deploy/central \
  ROX_BASELINE_GENERATION_DURATION=<value>
    • oc: If you use Kubernetes, enter kubectl.

    • <value>: Use time units, for example: 300ms, -1.5h, or 2h45m. Valid time units are:

      • ns
      • us or µs
      • ms
      • s
      • m
      • h

4.6.2. Viewing the process baselines
复制链接

You can view process baselines from the Risk view.

Procedure

  1. In the RHACS portal, select Risk from the navigation menu.
  2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
  3. In the Deployment details panel, select the Process Discovery tab.
  4. The process baselines are visible under the Spec Container Baselines section.

4.6.3. Adding a process to the baseline
复制链接

You can add a process to the baseline.

Procedure

  1. In the RHACS portal, select Risk from the navigation menu.
  2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
  3. In the Deployment details panel, select the Process Discovery tab.
  4. Under the Running Processes section, click the Add icon for the process you want to add to the process baseline.
注意

The Add icon is available only for the processes that are not in the process baseline.

4.6.4. Removing a process from the baseline
复制链接

You can remove a process from the baseline.

Procedure

  1. In the RHACS portal, select Risk from the navigation menu.
  2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
  3. In the Deployment details panel, select the Process Discovery tab.
  4. Under the Spec Container baselines section, click the Remove icon for the process you want to remove from the process baseline.

4.6.5. Locking and unlocking the process baselines
复制链接

You can Lock the baseline to trigger violations for all processes not listed in the baseline and Unlock the baseline to stop triggering violations.

Procedure

  1. In the RHACS portal, select Risk from the navigation menu.
  2. Select a deployment from the list of deployments in the default Risk view. Deployment details open in a panel on the right.
  3. In the Deployment details panel, select the Process Discovery tab.

  4. Under the Spec Container baselines section:

    • Click the Lock icon to trigger violations for processes that are not in the baseline.
    • Click the Unlock icon to stop triggering violations for processes that are not in the baseline.

4.6.6. Configuring auto-lock for process baselines
复制链接

You can configure RHACS to automatically lock process baselines when they leave the observation period. The auto-lock feature must be enabled in both Central and in the secured cluster.

Note the following guidelines when using this feature:

  • The feature is enabled in Central by default and disabled in the secured clusters by default. Therefore, enabling the feature does not require restarting Central. However, changing the state of the feature in Central does require a restart of Central.
  • The feature is only enabled for process baselines for secured clusters where the feature is enabled.
  • Disabling the feature after it has been enabled does not unlock process baselines that have been locked by the feature.
  • Enabling the feature does not lock process baselines that left the observation period before the feature was enabled.

Procedure

  1. In the OpenShift Container Platform web console, go to the RHACS Operator page.
  2. In the top navigation menu, select Secured Cluster.
  3. Click the instance name, for example, stackrox-secured-cluster-services.

  4. Use one of the following methods to change the setting:

    • In the Form view, under Process baselines settings Auto Lock, select Enabled or Disabled.
    • Click YAML to open the YAML editor and locate the spec.processBaselines.autoLock attribute. Change to Enabled or Disabled.
  5. Click Save.
  6. To enable or disable the feature in Central, set the ROX_AUTO_LOCK_PROCESS_BASELINES environment variable. The default value is true.

4.6.6.1. Auto-lock process baselines known limitations
复制链接

Central, Central DB, and Sensor consume more CPU and memory resources when process baseline auto-lock is enabled. This can lead to CPU throttling and pods crashing due to running out of memory.

The following results were obtained from tests with 1,000 deployments in which 5,000 process were spawned every 30 seconds (166.67 processes per second). The test was run with the feature enabled and disabled. Resource usage was compared between the two tests. For the tests the process baseline generation duration was set to three minutes and the rate of process creation did not change after the baseline generation period ended.

  • Sensor used 24 Mb more memory.
  • The difference in Sensor memory usage did not appear to increase with time.
  • Sensor CPU usage increased by 0.14 CPUs.
  • Central used 175 Mb more memory.
  • The rate of increase of Central memory usage was 65 Kb per second greater with auto-lock enabled.
  • Central CPU usage increased by 0.12 CPUs.
  • Central DB used 296 Mb more memory with auto-lock enabled.
  • The difference in Central DB memory usage did not appear to increase over time.
  • Central DB CPU usage was low and increased by 0.03 CPUs.

4.6.6.2. Bulk locking and unlocking process baselines
复制链接

You can lock or unlock all process baselines in a cluster by using API endpoints. You can specify an optional set of namespaces to limit the action to just those namespaces. The API endpoints are as follows:

  • /v1/processbaselines/bulk/lock
  • /v1/processbaselines/bulk/unlock

The following example shows the input for the endpoints: 

{
        "cluster_id": "aeaaaaaa-0000-0000-0000-000000000000",
        "namespaces": [
                        "stackrox",
                        "gmp-system"
                      ]
}

These endpoints return success or an error.

Red Hat logoGithubredditYoutubeTwitter

学习

尝试、购买和销售

社区

關於紅帽

我们提供强化的解决方案，使企业能够更轻松地跨平台和环境（从核心数据中心到网络边缘）工作。

让开源更具包容性

红帽致力于替换我们的代码、文档和 Web 属性中存在问题的语言。欲了解更多详情，请参阅红帽博客.

关于红帽文档

通过我们的产品和服务，以及可以信赖的内容，帮助红帽用户创新并实现他们的目标。 了解我们当前的更新.

Legal Notice

Theme

© 2026 Red Hat返回顶部