mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 12:46:18 +01:00
67 lines
1.8 KiB
Plaintext
67 lines
1.8 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/compliance_operator/co-scans/compliance-operator-remediation.adoc
|
|
|
|
:_mod-docs-content-type: PROCEDURE
|
|
[id="compliance-custom-node-pools_{context}"]
|
|
= Scanning custom node pools
|
|
|
|
The Compliance Operator does not maintain a copy of each node pool configuration. The Compliance Operator aggregates consistent configuration options for all nodes within a single node pool into one copy of the configuration file. The Compliance Operator then uses the configuration file for a particular node pool to evaluate rules against nodes within that pool.
|
|
|
|
.Procedure
|
|
|
|
. Add the `example` role to the `ScanSetting` object that will be stored in the `ScanSettingBinding` CR:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
apiVersion: compliance.openshift.io/v1alpha1
|
|
kind: ScanSetting
|
|
metadata:
|
|
name: default
|
|
namespace: openshift-compliance
|
|
rawResultStorage:
|
|
rotation: 3
|
|
size: 1Gi
|
|
roles:
|
|
- worker
|
|
- master
|
|
- example
|
|
scanTolerations:
|
|
- effect: NoSchedule
|
|
key: node-role.kubernetes.io/master
|
|
operator: Exists
|
|
schedule: '0 1 * * *'
|
|
----
|
|
|
|
. Create a scan that uses the `ScanSettingBinding` CR:
|
|
+
|
|
[source,yaml]
|
|
----
|
|
apiVersion: compliance.openshift.io/v1alpha1
|
|
kind: ScanSettingBinding
|
|
metadata:
|
|
name: cis
|
|
namespace: openshift-compliance
|
|
profiles:
|
|
- apiGroup: compliance.openshift.io/v1alpha1
|
|
kind: Profile
|
|
name: ocp4-cis
|
|
- apiGroup: compliance.openshift.io/v1alpha1
|
|
kind: Profile
|
|
name: ocp4-cis-node
|
|
settingsRef:
|
|
apiGroup: compliance.openshift.io/v1alpha1
|
|
kind: ScanSetting
|
|
name: default
|
|
----
|
|
|
|
.Verification
|
|
|
|
* The Platform KubeletConfig rules are checked through the `Node/Proxy` object. You can find those rules by running the following command:
|
|
+
|
|
[source,terminal]
|
|
----
|
|
$ oc get rules -o json | jq '.items[] | select(.checkType == "Platform") | select(.metadata.name | contains("ocp4-kubelet-")) | .metadata.name'
|
|
----
|
|
|