mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-05 21:46:22 +01:00
32 lines
2.2 KiB
Plaintext
32 lines
2.2 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/compliance_operator/compliance-operator-remediation.adoc
|
|
|
|
[id="compliance-applying_{context}"]
|
|
= Applying a remediation
|
|
|
|
The boolean attribute `spec.apply` controls whether the remediation should be applied by the Compliance Operator. You can apply the remediation by setting the attribute to `true`:
|
|
|
|
[source,terminal]
|
|
----
|
|
$ oc -n openshift-compliance \
|
|
patch complianceremediations/<scan-name>-sysctl-net-ipv4-conf-all-accept-redirects \
|
|
--patch '{"spec":{"apply":true}}' --type=merge
|
|
----
|
|
|
|
After the Compliance Operator processes the applied remediation, the `status.ApplicationState` attribute would change to *Applied* or to *Error* if incorrect. When a machine config remediation is applied, that remediation along with all other applied remediations are rendered into a `MachineConfig` object named `75-$scan-name-$suite-name`. That `MachineConfig` object is subsequently rendered by the Machine Config Operator and finally applied to all the nodes in a machine config pool by an instance of the machine control daemon running on each node.
|
|
|
|
Note that when the Machine Config Operator applies a new `MachineConfig` object to nodes in a pool, all the nodes belonging to the pool are rebooted. This might be inconvenient when applying multiple remediations, each of which re-renders the composite `75-$scan-name-$suite-name` `MachineConfig` object. To prevent applying the remediation immediately, you can pause the machine config pool by setting the `.spec.paused` attribute of a `MachineConfigPool` object to `true`.
|
|
|
|
[NOTE]
|
|
====
|
|
Make sure the pools are unpaused when the CA certificate rotation happens. If the MCPs are paused, the MCO cannot push the newly rotated certificates to those nodes. This causes the cluster to become degraded and causes failure in multiple `oc` commands, including `oc debug`, `oc logs`, `oc exec`, and `oc attach`. You receive alerts in the Alerting UI of the {product-title} web console if an MCP is paused when the certificates are rotated.
|
|
====
|
|
|
|
The Compliance Operator can apply remediations automatically. Set `autoApplyRemediations: true` in the `ScanSetting` top-level object.
|
|
|
|
[WARNING]
|
|
====
|
|
Applying remediations automatically should only be done with careful consideration.
|
|
====
|