5.10. 管理 Compliance Operator 结果和补救

流程

1. 列出节点。

   $ oc get nodes -n openshift-compliance

   输出示例

   NAME                                       STATUS  ROLES  AGE    VERSION
   ip-10-0-128-92.us-east-2.compute.internal  Ready   master 5h21m  v1.23.3+d99c04f
   ip-10-0-158-32.us-east-2.compute.internal  Ready   worker 5h17m  v1.23.3+d99c04f
   ip-10-0-166-81.us-east-2.compute.internal  Ready   worker 5h17m  v1.23.3+d99c04f
   ip-10-0-171-170.us-east-2.compute.internal Ready   master 5h21m  v1.23.3+d99c04f
   ip-10-0-197-35.us-east-2.compute.internal  Ready   master 5h22m  v1.23.3+d99c04f

2. 为节点添加标签。

   $ oc -n openshift-compliance \
   label node ip-10-0-166-81.us-east-2.compute.internal \
   node-role.kubernetes.io/<machine_config_pool_name>=

   输出示例

   node/ip-10-0-166-81.us-east-2.compute.internal labeled

3. 创建自定义 MachineConfigPool CR。

   apiVersion: machineconfiguration.openshift.io/v1
   kind: MachineConfigPool
   metadata:
     name: <machine_config_pool_name>
     labels:
       pools.operator.machineconfiguration.openshift.io/<machine_config_pool_name>: '' 1
   spec:
     machineConfigSelector:
     matchExpressions:
     - {key: machineconfiguration.openshift.io/role, operator: In, values: [worker,<machine_config_pool_name>]}
     nodeSelector:
     matchLabels:
       node-role.kubernetes.io/<machine_config_pool_name>: ""

   1

   labels 字段定义要为机器配置池(MCP)添加的标签名称。

4. 验证 MCP 是否已成功创建。

   $ oc get mcp -w

流程

1. 要针对包含 master、worker 和自定义示例节点池的 example 集群中的所有池检查配置，将 TailoredProfile 对象中的 ocp-var-role-master 和 opc-var-role-worker 字段的值设置为 example：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: TailoredProfile
   metadata:
     name: cis-example-tp
   spec:
     extends: ocp4-cis
     title: My modified NIST profile to scan example nodes
     setValues:
     - name: ocp4-var-role-master
       value: example
       rationale: test for example nodes
     - name: ocp4-var-role-worker
       value: example
       rationale: test for example nodes
     description: cis-example-scan

2. 将 example 角色添加到要存储在 ScanSettingBinding CR 中的 ScanSetting 对象中：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSetting
   metadata:
     name: default
     namespace: openshift-compliance
   rawResultStorage:
     rotation: 3
     size: 1Gi
   roles:
   - worker
   - master
   - example
   scanTolerations:
   - effect: NoSchedule
     key: node-role.kubernetes.io/master
     operator: Exists
   schedule: '0 1 * * *'

3. 创建使用 ScanSettingBinding CR 的扫描：

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ScanSettingBinding
   metadata:
     name: cis
     namespace: openshift-compliance
   profiles:
   - apiGroup: compliance.openshift.io/v1alpha1
     kind: Profile
     name: ocp4-cis
   - apiGroup: compliance.openshift.io/v1alpha1
     kind: Profile
     name: ocp4-cis-node
   - apiGroup: compliance.openshift.io/v1alpha1
     kind: TailoredProfile
     name: cis-example-tp
   settingsRef:
     apiGroup: compliance.openshift.io/v1alpha1
     kind: ScanSetting
     name: default

流程

1. 以下示例使用 ocp4-ocp-allowed-registries-for-import 规则，这在默认 OpenShift Container Platform 安装中会失败。检查规则 oc get rule. compliance/ocp4-ocp-allowed-registries-for-import -oyaml，该规则通过设置 allowedRegistriesForImport 属性来限制允许用户从中导入镜像的 registry，该规则的 warning 属性还会显示已检查的 API 对象，因此可以修改它并修复问题：

   $ oc edit image.config.openshift.io/cluster

   输出示例

   apiVersion: config.openshift.io/v1
   kind: Image
   metadata:
     annotations:
       release.openshift.io/create-only: "true"
     creationTimestamp: "2020-09-10T10:12:54Z"
     generation: 2
     name: cluster
     resourceVersion: "363096"
     selfLink: /apis/config.openshift.io/v1/images/cluster
     uid: 2dcb614e-2f8a-4a23-ba9a-8e33cd0ff77e
   spec:
     allowedRegistriesForImport:
     - domainName: registry.redhat.io
   status:
     externalRegistryHostnames:
     - default-route-openshift-image-registry.apps.user-cluster-09-10-12-07.devcluster.openshift.com
     internalRegistryHostname: image-registry.openshift-image-registry.svc:5000

2. 重新运行扫描：

   $ oc -n openshift-compliance \
   annotate compliancescans/rhcos4-e8-worker compliance.openshift.io/rescan=

流程

1. 搜索任何过时的补救：

   $ oc -n openshift-compliance get complianceremediations \
   -l complianceoperator.openshift.io/outdated-remediation=

   输出示例

   NAME                              STATE
   workers-scan-no-empty-passwords   Outdated

   当前应用的补救存储在 Outdated 属性中，未应用的新补救存储在 Current 属性中。如果您对新版本满意，可删除 Outdated 字段。如果要保留更新的内容，可删除 Current 和 Outdated 属性。

2. 应用更新的补救版本：

   $ oc -n openshift-compliance patch complianceremediations workers-scan-no-empty-passwords \
   --type json -p '[{"op":"remove", "path":/spec/outdated}]'

3. 补救状态将从 Outdated 切换为 Applied：

   $ oc get -n openshift-compliance complianceremediations workers-scan-no-empty-passwords

   输出示例

   NAME                              STATE
   workers-scan-no-empty-passwords   Applied

4. 节点将应用更新的补救版本并重新引导。

流程

1. 将 apply 标志设置为 false ：

   $ oc -n openshift-compliance \
   patch complianceremediations/rhcos4-moderate-worker-sysctl-net-ipv4-conf-all-accept-redirects \
   --patch '{"spec":{"apply":false}}' --type=merge

2. 补救状态将更改为 NotApplied，组合 MachineConfig 对象会被重新渲染，不包含补救。

   重要

   所有包含补救的受影响节点都将被重新引导。

流程

1. 找到 one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available 补救的 scan-name 和合规检查：

   $ oc -n openshift-compliance get remediation \ one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available -o yaml

   输出示例

   apiVersion: compliance.openshift.io/v1alpha1
   kind: ComplianceRemediation
   metadata:
     annotations:
       compliance.openshift.io/xccdf-value-used: var-kubelet-evictionhard-imagefs-available
     creationTimestamp: "2022-01-05T19:52:27Z"
     generation: 1
     labels:
       compliance.openshift.io/scan-name: one-rule-tp-node-master 1
       compliance.openshift.io/suite: one-rule-ssb-node
     name: one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available
     namespace: openshift-compliance
     ownerReferences:
     - apiVersion: compliance.openshift.io/v1alpha1
       blockOwnerDeletion: true
       controller: true
       kind: ComplianceCheckResult
       name: one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available
       uid: fe8e1577-9060-4c59-95b2-3e2c51709adc
     resourceVersion: "84820"
     uid: 5339d21a-24d7-40cb-84d2-7a2ebb015355
   spec:
     apply: true
     current:
       object:
         apiVersion: machineconfiguration.openshift.io/v1
         kind: KubeletConfig
         spec:
           kubeletConfig:
             evictionHard:
               imagefs.available: 10% 2
     outdated: {}
     type: Configuration
   status:
     applicationState: Applied

   1

   补救的扫描名称。

   2

   添加到 KubeletConfig 对象的补救。

   注意

   如果补救调用 evictionHard kubelet 配置，您必须指定所有 evictionHard 参数： memory.available、nodefs.available、nodefs.inodesFree、imagefs.available 和 imagefs.inodesFree。如果没有指定所有参数，则只应用指定的参数，补救无法正常工作。

2. 删除补救：

   1. 为补救对象将 apply 设置为 false：

      $ oc -n openshift-compliance patch \
      complianceremediations/one-rule-tp-node-master-kubelet-eviction-thresholds-set-hard-imagefs-available \
      -p '{"spec":{"apply":false}}' --type=merge

   2. 使用 scan-name，找到补救应用到的 KubeletConfig 对象：

      $ oc -n openshift-compliance get kubeletconfig \
      --selector compliance.openshift.io/scan-name=one-rule-tp-node-master

      输出示例

      NAME                                 AGE
      compliance-operator-kubelet-master   2m34s

   3. 从 KubeletConfig 对象手动删除补救 imagefs.available: 10% ：

      $ oc edit -n openshift-compliance KubeletConfig compliance-operator-kubelet-master

      重要

      所有包含补救的受影响节点都将被重新引导。