mirror of
https://github.com/openshift/openshift-docs.git
synced 2026-02-07 00:48:01 +01:00
113 lines
3.6 KiB
Plaintext
113 lines
3.6 KiB
Plaintext
// Module included in the following assemblies:
|
|
//
|
|
// * security/file_integrity_operator/file-integrity-operator-understanding.adoc
|
|
|
|
[id="file-integrity-node-status-failure_{context}"]
|
|
= FileIntegrityNodeStatus CR failure status example
|
|
|
|
To simulate a failure condition, modify one of the files AIDE tracks. For example, modify `/etc/resolv.conf` on one of the worker nodes:
|
|
|
|
[source,terminal]
|
|
----
|
|
$ oc debug node/ip-10-0-130-192.ec2.internal
|
|
----
|
|
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
Creating debug namespace/openshift-debug-node-ldfbj ...
|
|
Starting pod/ip-10-0-130-192ec2internal-debug ...
|
|
To use host binaries, run `chroot /host`
|
|
Pod IP: 10.0.130.192
|
|
If you don't see a command prompt, try pressing enter.
|
|
sh-4.2# echo "# integrity test" >> /host/etc/resolv.conf
|
|
sh-4.2# exit
|
|
|
|
Removing debug pod ...
|
|
Removing debug namespace/openshift-debug-node-ldfbj ...
|
|
----
|
|
|
|
After some time, the `Failed` condition is reported in the results array of the corresponding `FileIntegrityNodeStatus` object. The previous `Succeeded` condition is retained, which allows you to pinpoint the time the check failed.
|
|
|
|
[source,terminal]
|
|
----
|
|
$ oc get fileintegritynodestatuses.fileintegrity.openshift.io/worker-fileintegrity-ip-10-0-130-192.ec2.internal -ojsonpath='{.results}' | jq -r
|
|
----
|
|
|
|
Alternatively, if you are not mentioning the object name, run:
|
|
|
|
[source,terminal]
|
|
----
|
|
$ oc get fileintegritynodestatuses.fileintegrity.openshift.io -ojsonpath='{.items[*].results}' | jq
|
|
----
|
|
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
[
|
|
{
|
|
"condition": "Succeeded",
|
|
"lastProbeTime": "2020-09-15T12:54:14Z"
|
|
},
|
|
{
|
|
"condition": "Failed",
|
|
"filesChanged": 1,
|
|
"lastProbeTime": "2020-09-15T12:57:20Z",
|
|
"resultConfigMapName": "aide-ds-worker-fileintegrity-ip-10-0-130-192.ec2.internal-failed",
|
|
"resultConfigMapNamespace": "openshift-file-integrity"
|
|
}
|
|
]
|
|
----
|
|
|
|
The `Failed` condition points to a config map that gives more details about what exactly failed and why:
|
|
|
|
[source,terminal]
|
|
----
|
|
$ oc describe cm aide-ds-worker-fileintegrity-ip-10-0-130-192.ec2.internal-failed
|
|
----
|
|
|
|
.Example output
|
|
[source,terminal]
|
|
----
|
|
Name: aide-ds-worker-fileintegrity-ip-10-0-130-192.ec2.internal-failed
|
|
Namespace: openshift-file-integrity
|
|
Labels: file-integrity.openshift.io/node=ip-10-0-130-192.ec2.internal
|
|
file-integrity.openshift.io/owner=worker-fileintegrity
|
|
file-integrity.openshift.io/result-log=
|
|
Annotations: file-integrity.openshift.io/files-added: 0
|
|
file-integrity.openshift.io/files-changed: 1
|
|
file-integrity.openshift.io/files-removed: 0
|
|
|
|
Data
|
|
|
|
integritylog:
|
|
------
|
|
AIDE 0.15.1 found differences between database and filesystem!!
|
|
Start timestamp: 2020-09-15 12:58:15
|
|
|
|
Summary:
|
|
Total number of files: 31553
|
|
Added files: 0
|
|
Removed files: 0
|
|
Changed files: 1
|
|
|
|
|
|
---------------------------------------------------
|
|
Changed files:
|
|
---------------------------------------------------
|
|
|
|
changed: /hostroot/etc/resolv.conf
|
|
|
|
---------------------------------------------------
|
|
Detailed information about changes:
|
|
---------------------------------------------------
|
|
|
|
|
|
File: /hostroot/etc/resolv.conf
|
|
SHA512 : sTQYpB/AL7FeoGtu/1g7opv6C+KT1CBJ , qAeM+a8yTgHPnIHMaRlS+so61EN8VOpg
|
|
|
|
Events: <none>
|
|
----
|
|
|
|
Due to the config map data size limit, AIDE logs over 1 MB are added to the failure config map as a base64-encoded gzip archive. In this case, you want to pipe the output of the above command to `base64 --decode | gunzip`. Compressed logs are indicated by the presence of a `file-integrity.openshift.io/compressed` annotation key in the config map.
|