5.6. Compliance Operator 扫描管理

流程

1. 运行以下命令检查 ScanSetting 对象：

   $ oc describe scansettings default -n openshift-compliance

   输出示例

   Name:                  default
   Namespace:             openshift-compliance
   Labels:                <none>
   Annotations:           <none>
   API Version:           compliance.openshift.io/v1alpha1
   Kind:                  ScanSetting
   Max Retry On Timeout:  3
   Metadata:
     Creation Timestamp:  2024-07-16T14:56:42Z
     Generation:          2
     Resource Version:    91655682
     UID:                 50358cf1-57a8-4f69-ac50-5c7a5938e402
   Raw Result Storage:
     Node Selector:
       node-role.kubernetes.io/master:
     Pv Access Modes:
       ReadWriteOnce 1
     Rotation:            3 2
     Size:                1Gi 3
     Storage Class Name:  standard 4
     Tolerations:
       Effect:              NoSchedule
       Key:                 node-role.kubernetes.io/master
       Operator:            Exists
       Effect:              NoExecute
       Key:                 node.kubernetes.io/not-ready
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoExecute
       Key:                 node.kubernetes.io/unreachable
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoSchedule
       Key:                 node.kubernetes.io/memory-pressure
       Operator:            Exists
   Roles:
     master 5
     worker 6
   Scan Tolerations: 7
     Operator:           Exists
   Schedule:             0 1 * * * 8
   Show Not Applicable:  false
   Strict Node Scan:     true
   Suspend:              false
   Timeout:              30m
   Events:               <none>

   1

   Compliance Operator 创建一个包含扫描结果的持久性卷（PV）。默认情况下，PV 将使用访问模式 ReadWriteOnce，因为 Compliance Operator 无法假定集群中配置的存储类。另外，多数集群中可以使用 ReadWriteOnce 访问模式。如果需要获取扫描结果，可以使用一个 helper pod 来完成此操作，该 pod 也绑定卷。使用 ReadWriteOnce 访问模式的卷只能由一个 pod 挂载，因此请记住删除帮助程序 pod。否则，Compliance Operator 将无法重复使用卷进行后续扫描。

   2

   Compliance Operator 在卷中保留三个后续扫描的结果，旧的扫描会被轮转。

   3

   Compliance Operator 将为扫描结果分配一个 GB 存储。

   4

   scansetting.rawResultStorage. storageClassName 字段指定创建 PersistentVolumeClaim 对象以存储原始结果时要使用的 storageClassName 值。默认值为 null，它将尝试使用集群中配置的默认存储类。如果没有指定默认类，则必须设置默认存储类。

   5 6

   如果扫描设置使用扫描集群节点的任何配置集，请扫描这些节点角色。

   7

   默认扫描设置对象扫描所有节点。

   8

   默认扫描设置对象每天 01:00 运行扫描。

   作为默认扫描设置的替代，您可以使用 default-auto-apply，它有以下设置：

   Name:                      default-auto-apply
   Namespace:                 openshift-compliance
   Labels:                    <none>
   Annotations:               <none>
   API Version:               compliance.openshift.io/v1alpha1
   Auto Apply Remediations:   true 1
   Auto Update Remediations:  true 2
   Kind:                      ScanSetting
   Metadata:
     Creation Timestamp:  2022-10-18T20:21:00Z
     Generation:          1
     Managed Fields:
       API Version:  compliance.openshift.io/v1alpha1
       Fields Type:  FieldsV1
       fieldsV1:
         f:autoApplyRemediations:
         f:autoUpdateRemediations:
         f:rawResultStorage:
           .:
           f:nodeSelector:
             .:
             f:node-role.kubernetes.io/master:
           f:pvAccessModes:
           f:rotation:
           f:size:
           f:tolerations:
         f:roles:
         f:scanTolerations:
         f:schedule:
         f:showNotApplicable:
         f:strictNodeScan:
       Manager:         compliance-operator
       Operation:       Update
       Time:            2022-10-18T20:21:00Z
     Resource Version:  38840
     UID:               8cb0967d-05e0-4d7a-ac1c-08a7f7e89e84
   Raw Result Storage:
     Node Selector:
       node-role.kubernetes.io/master:
     Pv Access Modes:
       ReadWriteOnce
     Rotation:  3
     Size:      1Gi
     Tolerations:
       Effect:              NoSchedule
       Key:                 node-role.kubernetes.io/master
       Operator:            Exists
       Effect:              NoExecute
       Key:                 node.kubernetes.io/not-ready
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoExecute
       Key:                 node.kubernetes.io/unreachable
       Operator:            Exists
       Toleration Seconds:  300
       Effect:              NoSchedule
       Key:                 node.kubernetes.io/memory-pressure
       Operator:            Exists
   Roles:
     master
     worker
   Scan Tolerations:
     Operator:           Exists
   Schedule:             0 1 * * *
   Show Not Applicable:  false
   Strict Node Scan:     true
   Events:               <none>

   1 2

   通过将 autoUpdateRemediations 和 autoApplyRemediations 标记设置为 true，您可以轻松地创建无需额外步骤自动修复的 ScanSetting 对象。

2. 创建一个 ScanSettingBinding 对，,它绑定到默认的 ScanSetting 对象，并使用 cis 和 cis-node 配置集扫描集群。例如：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSettingBinding
   metadata:
     name: cis-compliance
     namespace: openshift-compliance
   profiles:
     - name: ocp4-cis-node
       kind: Profile
       apiGroup: compliance.openshift.io/v1alpha1
     - name: ocp4-cis
       kind: Profile
       apiGroup: compliance.openshift.io/v1alpha1
   settingsRef:
     name: default
     kind: ScanSetting
     apiGroup: compliance.openshift.io/v1alpha1

3. 运行以下命令来创建 ScanSettingBinding 对象：

   $ oc create -f <file-name>.yaml -n openshift-compliance

   此时，ScanSettingBinding 对象已协调，并以 Binding 和 Bound 设置为基础。Compliance Operator 会创建一个 ComplianceSuite 对象和关联的 ComplianceScan 对象。

4. 运行以下命令跟踪合规性扫描进度：

   $ oc get compliancescan -w -n openshift-compliance

   扫描过程通过扫描阶段进行，最终完成后到达 DONE 阶段。在大多数情况下，扫描的结果是 NON-COMPLIANT。您可以检查扫描结果，并开始应用补救使集群兼容。如需更多信息，请参阅管理 Compliance Operator 补救。

流程

1. 运行以下命令，获取要扫描的托管集群的名称和命名空间 ：

   $ oc get hostedcluster -A

   输出示例

   NAMESPACE       NAME                   VERSION   KUBECONFIG                              PROGRESS    AVAILABLE   PROGRESSING   MESSAGE
   local-cluster   79136a1bdb84b3c13217   4.13.5    79136a1bdb84b3c13217-admin-kubeconfig   Completed   True        False         The hosted control plane is available

2. 在管理集群中，创建一个 TailoredProfile 扩展扫描配置集，并定义要扫描的 Hosted Cluster 的名称和命名空间：

   management-tailoredprofile.yaml 示例

   apiVersion: compliance.openshift.io/v1alpha1
   kind: TailoredProfile
   metadata:
     name: hypershift-cisk57aw88gry
     namespace: openshift-compliance
   spec:
     description: This profile test required rules
     extends: ocp4-cis 1
     title: Management namespace profile
     setValues:
     - name: ocp4-hypershift-cluster
       rationale: This value is used for HyperShift version detection
       value: 79136a1bdb84b3c13217 2
     - name: ocp4-hypershift-namespace-prefix
       rationale: This value is used for HyperShift control plane namespace detection
       value: local-cluster 3

   1

   变量。托管的控制平面管理集群只支持 ocp4-cis 和 ocp4-pci-dss 配置集。

   2

   value 是在前面步骤中输出的 NAME。

   3

   value 是在前面步骤中输出的 NAMESPACE。

3. 创建 TailoredProfile：

   $ oc create -n openshift-compliance -f mgmt-tp.yaml

流程

1. 浏览 Red Hat Enterprise Linux CoreOS (RHCOS) ProfileBundle 的可用规则：

   $ oc get rules.compliance -n openshift-compliance -l compliance.openshift.io/profile-bundle=rhcos4

2. 浏览同一 ProfileBundle 中的可用变量：

   $ oc get variables.compliance -n openshift-compliance -l compliance.openshift.io/profile-bundle=rhcos4

3. 创建名为 nist-moderate-modified 的定制配置集：

   1. 选择您要添加到 nist-moderate-modified 定制配置集中的规则。这个示例通过禁用两个规则并更改一个值来扩展 rhcos4-moderate 配置集。使用 rationale 值描述进行这些更改的原因：

      new-profile-node.yaml示例

      apiVersion: compliance.openshift.io/v1alpha1
      kind: TailoredProfile
      metadata:
        name: nist-moderate-modified
      spec:
        extends: rhcos4-moderate
        description: NIST moderate profile
        title: My modified NIST moderate profile
        disableRules:
        - name: rhcos4-file-permissions-var-log-messages
          rationale: The file contains logs of error messages in the system
        - name: rhcos4-account-disable-post-pw-expiration
          rationale: No need to check this as it comes from the IdP
        setValues:
        - name: rhcos4-var-selinux-state
          rationale: Organizational requirements
          value: permissive

      表 5.9. spec 变量的属性

      属性	描述
      extends	构建此 TailoredProfile 的 Profile 对象的名称。
      title	TailoredProfile 的人类可读标题.
      disableRules	名称和理由对列表。每个名称引用要禁用的规则对象的名称。合理值是人类可读的文本，描述禁用规则的原因。
      manualRules	名称和理由对列表。添加手动规则时，检查结果状态始终是 manual，且不会生成补救。此属性是自动的，在默认情况下，设置手动规则时没有值。
      enableRules	名称和理由对列表。每个名称引用要启用的规则对象的名称。合理值是人类可读的文本，描述启用规则的原因。
      description	描述 TailoredProfile 的人类可读文本.
      setValues	名称、理由和值分组列表。每个名称都引用值集的名称。理由是人类可读的文本描述该集合。值是实际设置。

   2. 添加 tailoredProfile.spec.manualRules 属性：

      示例 tailoredProfile.spec.manualRules.yaml

      apiVersion: compliance.openshift.io/v1alpha1
      kind: TailoredProfile
      metadata:
        name: ocp4-manual-scc-check
      spec:
        extends: ocp4-cis
        description: This profile extends ocp4-cis by forcing the SCC check to always return MANUAL
        title: OCP4 CIS profile with manual SCC check
        manualRules:
          - name: ocp4-scc-limit-container-allowed-capabilities
            rationale: We use third party software that installs its own SCC with extra privileges

   3. 创建 TailoredProfile 对象：

      $ oc create -n openshift-compliance -f new-profile-node.yaml 1

      1

      TailoredProfile 对象在默认的 openshift-compliance 命名空间中创建。

      输出示例

      tailoredprofile.compliance.openshift.io/nist-moderate-modified created

4. 定义 ScanSettingBinding 对象，将新的 nist-moderate-modified 定制配置集绑定到默认的 ScanSetting 对象。

   new-scansettingbinding.yaml示例

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSettingBinding
   metadata:
     name: nist-moderate-modified
   profiles:
     - apiGroup: compliance.openshift.io/v1alpha1
       kind: Profile
       name: ocp4-moderate
     - apiGroup: compliance.openshift.io/v1alpha1
       kind: TailoredProfile
       name: nist-moderate-modified
   settingsRef:
     apiGroup: compliance.openshift.io/v1alpha1
     kind: ScanSetting
     name: default

5. 创建 ScanSettingBinding 对象：

   $ oc create -n openshift-compliance -f new-scansettingbinding.yaml

   输出示例

   scansettingbinding.compliance.openshift.io/nist-moderate-modified created

1. 探索 ComplianceSuite 对象：

   $ oc get compliancesuites nist-moderate-modified \
   -o json -n openshift-compliance | jq '.status.scanStatuses[].resultsStorage'

   输出示例

   {
        "name": "ocp4-moderate",
        "namespace": "openshift-compliance"
   }
   {
        "name": "nist-moderate-modified-master",
        "namespace": "openshift-compliance"
   }
   {
        "name": "nist-moderate-modified-worker",
        "namespace": "openshift-compliance"
   }

   这显示了可以访问原始结果的持久性卷声明。

2. 使用其中一个结果的名称和命名空间来验证原始数据位置：

   $ oc get pvc -n openshift-compliance rhcos4-moderate-worker

   输出示例

   NAME                 	STATUS   VOLUME                                 	CAPACITY   ACCESS MODES   STORAGECLASS   AGE
   rhcos4-moderate-worker   Bound	pvc-548f6cfe-164b-42fe-ba13-a07cfbc77f3a   1Gi    	RWO        	gp2        	92m

3. 通过生成挂载卷并复制结果的 Pod 来获取原始结果：

   $ oc create -n openshift-compliance -f pod.yaml

   pod.yaml 示例

   apiVersion: "v1"
   kind: Pod
   metadata:
     name: pv-extract
   spec:
     securityContext:
       runAsNonRoot: true
       seccompProfile:
         type: RuntimeDefault
     containers:
       - name: pv-extract-pod
         image: registry.access.redhat.com/ubi9/ubi
         command: ["sleep", "3000"]
         volumeMounts:
         - mountPath: "/workers-scan-results"
           name: workers-scan-vol
         securityContext:
           allowPrivilegeEscalation: false
           capabilities:
             drop: [ALL]
     volumes:
       - name: workers-scan-vol
         persistentVolumeClaim:
           claimName: rhcos4-moderate-worker

4. Pod 运行后，下载结果：

   $ oc cp pv-extract:/workers-scan-results -n openshift-compliance .

   重要

   生成挂载持久性卷的 Pod 会将声明保留为 Bound。如果使用中的卷存储类的权限设置为 ReadWriteOnce，则该卷每次只能被一个 Pod 挂载。您必须在完成后删除 Pod，否则 Operator 将无法调度 Pod 并继续在此位置存储结果。

5. 提取完成后，可以删除 Pod：

   $ oc delete pod pv-extract -n openshift-compliance

流程

1. 列出节点。

   $ oc get nodes -n openshift-compliance

   输出示例

   NAME                                       STATUS  ROLES  AGE    VERSION
   ip-10-0-128-92.us-east-2.compute.internal  Ready   master 5h21m  v1.29.4
   ip-10-0-158-32.us-east-2.compute.internal  Ready   worker 5h17m  v1.29.4
   ip-10-0-166-81.us-east-2.compute.internal  Ready   worker 5h17m  v1.29.4
   ip-10-0-171-170.us-east-2.compute.internal Ready   master 5h21m  v1.29.4
   ip-10-0-197-35.us-east-2.compute.internal  Ready   master 5h22m  v1.29.4

2. 为节点添加标签。

   $ oc -n openshift-compliance \
   label node ip-10-0-166-81.us-east-2.compute.internal \
   node-role.kubernetes.io/<machine_config_pool_name>=

   输出示例

   node/ip-10-0-166-81.us-east-2.compute.internal labeled

3. 创建自定义 MachineConfigPool CR。

   apiVersion: machineconfiguration.openshift.io/v1
   kind: MachineConfigPool
   metadata:
     name: <machine_config_pool_name>
     labels:
       pools.operator.machineconfiguration.openshift.io/<machine_config_pool_name>: '' 1
   spec:
     machineConfigSelector:
     matchExpressions:
     - {key: machineconfiguration.openshift.io/role, operator: In, values: [worker,<machine_config_pool_name>]}
     nodeSelector:
     matchLabels:
       node-role.kubernetes.io/<machine_config_pool_name>: ""

   1

   labels 字段定义要为机器配置池(MCP)添加的标签名称。

4. 验证 MCP 是否已成功创建。

   $ oc get mcp -w

流程

1. 将 example 角色添加到要存储在 ScanSettingBinding CR 中的 ScanSetting 对象中：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSetting
   metadata:
     name: default
     namespace: openshift-compliance
   rawResultStorage:
     rotation: 3
     size: 1Gi
   roles:
   - worker
   - master
   - example
   scanTolerations:
   - effect: NoSchedule
     key: node-role.kubernetes.io/master
     operator: Exists
   schedule: '0 1 * * *'

2. 创建使用 ScanSettingBinding CR 的扫描：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSettingBinding
   metadata:
     name: cis
     namespace: openshift-compliance
   profiles:
   - apiGroup: compliance.openshift.io/v1alpha1
     kind: Profile
     name: ocp4-cis
   - apiGroup: compliance.openshift.io/v1alpha1
     kind: Profile
     name: ocp4-cis-node
   settingsRef:
     apiGroup: compliance.openshift.io/v1alpha1
     kind: ScanSetting
     name: default

流程

1. 以下示例使用 ocp4-ocp-allowed-registries-for-import 规则，这在默认 OpenShift Container Platform 安装中会失败。检查规则 oc get rule. compliance/ocp4-ocp-allowed-registries-for-import -oyaml，该规则通过设置 allowedRegistriesForImport 属性来限制允许用户从中导入镜像的 registry，该规则的 warning 属性还会显示已检查的 API 对象，因此可以修改它并修复问题：

   $ oc edit image.config.openshift.io/cluster

   输出示例

   apiVersion: config.openshift.io/v1
   kind: Image
   metadata:
     annotations:
       release.openshift.io/create-only: "true"
     creationTimestamp: "2020-09-10T10:12:54Z"
     generation: 2
     name: cluster
     resourceVersion: "363096"
     selfLink: /apis/config.openshift.io/v1/images/cluster
     uid: 2dcb614e-2f8a-4a23-ba9a-8e33cd0ff77e
   spec:
     allowedRegistriesForImport:
     - domainName: registry.redhat.io
   status:
     externalRegistryHostnames:
     - default-route-openshift-image-registry.apps.user-cluster-09-10-12-07.devcluster.openshift.com
     internalRegistryHostname: image-registry.openshift-image-registry.svc:5000

2. 重新运行扫描：

   $ oc -n openshift-compliance \
   annotate compliancescans/rhcos4-e8-worker compliance.openshift.io/rescan=

流程

1. 搜索任何过时的补救：

   $ oc -n openshift-compliance get complianceremediations \
   -l complianceoperator.openshift.io/outdated-remediation=

   输出示例

   NAME                              STATE
   workers-scan-no-empty-passwords   Outdated

   当前应用的补救存储在 Outdated 属性中，未应用的新补救存储在 Current 属性中。如果您对新版本满意，可删除 Outdated 字段。如果要保留更新的内容，可删除 Current 和 Outdated 属性。

2. 应用更新的补救版本：

   $ oc -n openshift-compliance patch complianceremediations workers-scan-no-empty-passwords \
   --type json -p '[{"op":"remove", "path":/spec/outdated}]'

3. 补救状态将从 Outdated 切换为 Applied：

   $ oc get -n openshift-compliance complianceremediations workers-scan-no-empty-passwords

   输出示例

   NAME                              STATE
   workers-scan-no-empty-passwords   Applied

4. 节点将应用更新的补救版本并重新引导。

流程

1. 将 apply 标志设置为 false ：

   $ oc -n openshift-compliance \
   patch complianceremediations/rhcos4-moderate-worker-sysctl-net-ipv4-conf-all-accept-redirects \
   --patch '{"spec":{"apply":false}}' --type=merge

2. 补救状态将更改为 NotApplied，组合 MachineConfig 对象会被重新渲染，不包含补救。

   重要

   所有包含补救的受影响节点都将被重新引导。

流程

1. 找到 one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available 补救的 scan-name 和合规检查：

   $ oc -n openshift-compliance get remediation \ one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available -o yaml

   输出示例

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ComplianceRemediation
   metadata:
     annotations:
       compliance.openshift.io/xccdf-value-used: var-kubelet-evictionhard-imagefs-available
     creationTimestamp: "2022-01-05T19:52:27Z"
     generation: 1
     labels:
       compliance.openshift.io/scan-name: one-rule-tp-node-master 1
       compliance.openshift.io/suite: one-rule-ssb-node
     name: one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available
     namespace: openshift-compliance
     ownerReferences:
     - apiVersion: compliance.openshift.io/v1alpha1
       blockOwnerDeletion: true
       controller: true
       kind: ComplianceCheckResult
       name: one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available
       uid: fe8e1577-9060-4c59-95b2-3e2c51709adc
     resourceVersion: "84820"
     uid: 5339d21a-24d7-40cb-84d2-7a2ebb015355
   spec:
     apply: true
     current:
       object:
         apiVersion: machineconfiguration.openshift.io/v1
         kind: KubeletConfig
         spec:
           kubeletConfig:
             evictionHard:
               imagefs.available: 10% 2
     outdated: {}
     type: Configuration
   status:
     applicationState: Applied

   1

   补救的扫描名称。

   2

   添加到 KubeletConfig 对象的补救。

   注意

   如果补救调用 evictionHard kubelet 配置，您必须指定所有 evictionHard 参数： memory.available、nodefs.available、nodefs.inodesFree、imagefs.available 和 imagefs.inodesFree。如果没有指定所有参数，则只应用指定的参数，补救无法正常工作。

2. 删除补救：

   1. 为补救对象将 apply 设置为 false：

      $ oc -n openshift-compliance patch \
      complianceremediations/one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available \
      -p '{"spec":{"apply":false}}' --type=merge

   2. 使用 scan-name，找到补救应用到的 KubeletConfig 对象：

      $ oc -n openshift-compliance get kubeletconfig \
      --selector compliance.openshift.io/scan-name=one-rule-tp-node-master

      输出示例

      NAME                                 AGE
      compliance-operator-kubelet-master   2m34s

   3. 从 KubeletConfig 对象手动删除补救 imagefs.available: 10% ：

      $ oc edit -n openshift-compliance KubeletConfig compliance-operator-kubelet-master

      重要

      所有包含补救的受影响节点都将被重新引导。

流程

1. 从一个文件创建 ConfigMap 对象：

   $ oc -n openshift-compliance \
   create configmap nist-moderate-modified \
   --from-file=tailoring.xml=/path/to/the/tailoringFile.xml

2. 在属于 Suite 的 Scan 中引用定制文件：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ComplianceSuite
   metadata:
     name: workers-compliancesuite
   spec:
     debug: true
     scans:
       - name: workers-scan
         profile: xccdf_org.ssgproject.content_profile_moderate
         content: ssg-rhcos4-ds.xml
         contentImage: registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:45dc...
         debug: true
     tailoringConfigMap:
         name: nist-moderate-modified
     nodeSelector:
       node-role.kubernetes.io/worker: ""

流程

1. 在名为 restricted-adjusted-compliance.yaml 的 YAML 文件中定义 SCC：

   SecurityContextConstraints 对象定义

     allowHostDirVolumePlugin: false
     allowHostIPC: false
     allowHostNetwork: false
     allowHostPID: false
     allowHostPorts: false
     allowPrivilegeEscalation: true
     allowPrivilegedContainer: false
     allowedCapabilities: null
     apiVersion: security.openshift.io/v1
     defaultAddCapabilities: null
     fsGroup:
       type: MustRunAs
     kind: SecurityContextConstraints
     metadata:
       name: restricted-adjusted-compliance
     priority: 30 1
     readOnlyRootFilesystem: false
     requiredDropCapabilities:
     - KILL
     - SETUID
     - SETGID
     - MKNOD
     runAsUser:
       type: MustRunAsRange
     seLinuxContext:
       type: MustRunAs
     supplementalGroups:
       type: RunAsAny
     users:
     - system:serviceaccount:openshift-compliance:api-resource-collector 2
     volumes:
     - configMap
     - downwardAPI
     - emptyDir
     - persistentVolumeClaim
     - projected
     - secret

   1

   SCC 的优先级必须高于适用于 system:authenticated 组的任何其他 SCC。

   2

   Compliance Operator Scanner pod 使用的服务帐户。

2. 创建 SCC：

   $ oc create -n openshift-compliance  -f restricted-adjusted-compliance.yaml

   输出示例

   securitycontextconstraints.security.openshift.io/restricted-adjusted-compliance created

验证

1. 验证是否已创建 SCC：

   $ oc get -n openshift-compliance scc restricted-adjusted-compliance

   输出示例

   NAME                             PRIV    CAPS         SELINUX     RUNASUSER        FSGROUP     SUPGROUP   PRIORITY   READONLYROOTFS   VOLUMES
   restricted-adjusted-compliance   false   <no value>   MustRunAs   MustRunAsRange   MustRunAs   RunAsAny   30         false            ["configMap","downwardAPI","emptyDir","persistentVolumeClaim","projected","secret"]

流程

1. 要将 Operator 的内存限值增加到 500 Mi，请创建名为 co-memlimit-patch.yaml 的以下补丁文件：

   spec:
     config:
       resources:
         limits:
           memory: 500Mi

2. 应用补丁文件：

   $ oc patch sub compliance-operator -nopenshift-compliance --patch-file co-memlimit-patch.yaml --type=merge

流程

1. 确认 ocp4-pci-dss-api-checks-pod pod 处于 Init:OOMKilled 状态：

   $ oc get pod ocp4-pci-dss-api-checks-pod -w

   输出示例

   NAME                          READY   STATUS     RESTARTS        AGE
   ocp4-pci-dss-api-checks-pod   0/2     Init:1/2   8 (5m56s ago)   25m
   ocp4-pci-dss-api-checks-pod   0/2     Init:OOMKilled   8 (6m19s ago)   26m

2. 编辑 ScanSetting CR 中的 scanLimits 属性，以增加 ocp4-pci-dss-api-checks-pod pod 的可用内存：

   timeout: 30m
   strictNodeScan: true
   metadata:
     name: default
     namespace: openshift-compliance
   kind: ScanSetting
   showNotApplicable: false
   rawResultStorage:
     nodeSelector:
       node-role.kubernetes.io/master: ''
     pvAccessModes:
       - ReadWriteOnce
     rotation: 3
     size: 1Gi
     tolerations:
       - effect: NoSchedule
         key: node-role.kubernetes.io/master
         operator: Exists
       - effect: NoExecute
         key: node.kubernetes.io/not-ready
         operator: Exists
         tolerationSeconds: 300
       - effect: NoExecute
         key: node.kubernetes.io/unreachable
         operator: Exists
         tolerationSeconds: 300
       - effect: NoSchedule
         key: node.kubernetes.io/memory-pressure
         operator: Exists
   schedule: 0 1 * * *
   roles:
     - master
     - worker
   apiVersion: compliance.openshift.io/v1alpha1
   maxRetryOnTimeout: 3
   scanTolerations:
     - operator: Exists
   scanLimits:
     memory: 1024Mi 1

   1

   默认设置为 500Mi。

3. 将 ScanSetting CR 应用到集群：

   $ oc apply -f scansetting.yaml

流程

1. 提取 oc-compliance 镜像以获取 oc-compliance 二进制文件：

   $ podman run --rm -v ~/.local/bin:/mnt/out:Z registry.redhat.io/compliance/oc-compliance-rhel8:stable /bin/cp /usr/bin/oc-compliance /mnt/out/

   输出示例

   W0611 20:35:46.486903   11354 manifest.go:440] Chose linux/amd64 manifest from the manifest list.

   现在，您可以运行 oc-compliance。

流程

1. 运行：

   $ oc compliance bind [--dry-run] -N <binding name> [-S <scansetting name>] <objtype/objname> [..<objtype/objname>]

   • 如果省略 -S 标志，则使用 Compliance Operator 提供的 default 扫描设置。
   • 对象类型是 Kubernetes 对象类型，可以是 profile 或 tailorprofile。可以提供多个对象。
   • 对象名称是 Kubernetes 资源的名称，如 .metadata.name。

   • 添加 --dry-run 选项，以显示所创建对象的 YAML 文件。

     例如，给定以下配置集和扫描设置：

     $ oc get profile.compliance -n openshift-compliance

     输出示例

     NAME                       AGE     VERSION
     ocp4-cis                   3h49m   1.5.0
     ocp4-cis-1-4               3h49m   1.4.0
     ocp4-cis-1-5               3h49m   1.5.0
     ocp4-cis-node              3h49m   1.5.0
     ocp4-cis-node-1-4          3h49m   1.4.0
     ocp4-cis-node-1-5          3h49m   1.5.0
     ocp4-e8                    3h49m
     ocp4-high                  3h49m   Revision 4
     ocp4-high-node             3h49m   Revision 4
     ocp4-high-node-rev-4       3h49m   Revision 4
     ocp4-high-rev-4            3h49m   Revision 4
     ocp4-moderate              3h49m   Revision 4
     ocp4-moderate-node         3h49m   Revision 4
     ocp4-moderate-node-rev-4   3h49m   Revision 4
     ocp4-moderate-rev-4        3h49m   Revision 4
     ocp4-nerc-cip              3h49m
     ocp4-nerc-cip-node         3h49m
     ocp4-pci-dss               3h49m   3.2.1
     ocp4-pci-dss-3-2           3h49m   3.2.1
     ocp4-pci-dss-4-0           3h49m   4.0.0
     ocp4-pci-dss-node          3h49m   3.2.1
     ocp4-pci-dss-node-3-2      3h49m   3.2.1
     ocp4-pci-dss-node-4-0      3h49m   4.0.0
     ocp4-stig                  3h49m   V2R1
     ocp4-stig-node             3h49m   V2R1
     ocp4-stig-node-v1r1        3h49m   V1R1
     ocp4-stig-node-v2r1        3h49m   V2R1
     ocp4-stig-v1r1             3h49m   V1R1
     ocp4-stig-v2r1             3h49m   V2R1
     rhcos4-e8                  3h49m
     rhcos4-high                3h49m   Revision 4
     rhcos4-high-rev-4          3h49m   Revision 4
     rhcos4-moderate            3h49m   Revision 4
     rhcos4-moderate-rev-4      3h49m   Revision 4
     rhcos4-nerc-cip            3h49m
     rhcos4-stig                3h49m   V2R1
     rhcos4-stig-v1r1           3h49m   V1R1
     rhcos4-stig-v2r1           3h49m   V2R1

     $ oc get scansettings -n openshift-compliance

     输出示例

     NAME                 AGE
     default              10m
     default-auto-apply   10m

2. 要将 default 设置应用到 ocp4-cis 和 ocp4-cis-node 配置集，请运行：

   $ oc compliance bind -N my-binding profile/ocp4-cis profile/ocp4-cis-node

   输出示例

   Creating ScanSettingBinding my-binding

   创建 ScanSettingBinding CR 后，绑定配置集开始使用相关设置扫描这两个配置集。总体而言，这是开始使用 Compliance Operator 扫描的最快方法。

流程

1. 查看配置集的补救：

   $ oc compliance fetch-fixes profile ocp4-cis -o /tmp

   输出示例

   No fixes to persist for rule 'ocp4-api-server-api-priority-flowschema-catch-all' 1
   No fixes to persist for rule 'ocp4-api-server-api-priority-gate-enabled'
   No fixes to persist for rule 'ocp4-api-server-audit-log-maxbackup'
   Persisted rule fix to /tmp/ocp4-api-server-audit-log-maxsize.yaml
   No fixes to persist for rule 'ocp4-api-server-audit-log-path'
   No fixes to persist for rule 'ocp4-api-server-auth-mode-no-aa'
   No fixes to persist for rule 'ocp4-api-server-auth-mode-node'
   No fixes to persist for rule 'ocp4-api-server-auth-mode-rbac'
   No fixes to persist for rule 'ocp4-api-server-basic-auth'
   No fixes to persist for rule 'ocp4-api-server-bind-address'
   No fixes to persist for rule 'ocp4-api-server-client-ca'
   Persisted rule fix to /tmp/ocp4-api-server-encryption-provider-cipher.yaml
   Persisted rule fix to /tmp/ocp4-api-server-encryption-provider-config.yaml

   1

   当配置集中没有对应的修复规则时会出现 No fixes to persist警告，因为规则无法自动修复，或者没有提供相应的补救。

2. 您可以查看 YAML 文件示例。head 命令将显示前 10 行：

   $ head /tmp/ocp4-api-server-audit-log-maxsize.yaml

   输出示例

   apiVersion: config.openshift.io/v1
   kind: APIServer
   metadata:
     name: cluster
   spec:
     maximumFileSizeMegabytes: 100

3. 查看扫描后创建的 ComplianceRemediation 对象的补救：

   $ oc get complianceremediations -n openshift-compliance

   输出示例

   NAME                                             STATE
   ocp4-cis-api-server-encryption-provider-cipher   NotApplied
   ocp4-cis-api-server-encryption-provider-config   NotApplied

   $ oc compliance fetch-fixes complianceremediations ocp4-cis-api-server-encryption-provider-cipher -o /tmp

   输出示例

   Persisted compliance remediation fix to /tmp/ocp4-cis-api-server-encryption-provider-cipher.yaml

4. 您可以查看 YAML 文件示例。head 命令将显示前 10 行：

   $ head /tmp/ocp4-cis-api-server-encryption-provider-cipher.yaml

   输出示例

   apiVersion: config.openshift.io/v1
   kind: APIServer
   metadata:
     name: cluster
   spec:
     encryption:
       type: aescbc