セキュリティの対策は、できるだけ開発の初期から行う（シフト・レフト)

これらの情報を OpenShift と連携させるには、オプショナルの製品が必要です。

https://catalog.redhat.com/

https://catalog.redhat.com/software/containers/rhceph-beta/rhceph-4-dashboard-rhel8/5e965720d70cc54b02d1f413?container-tabs=security

OpenShiftでは、

• アップグレード可能なパスを自動的に提示します。
• 「ワン・クリック」でアップデートを実行します。

OpenShift だけではなく、CoreOS も同時にアップグレード(RHEL使用時は、RHELは手動で管理する必要がある)

※

CLIからのアップデートも可能

※

cluster-admin: cluster の全権限を持った管理者

Compliance 対応のスキャンの結果表示。スケジュールを行い、定期的にスキャンができる。

[root@bastion openshift]# oc get ComplianceCheckResults
NAME                                                                                STATUS   SEVERITY
ocp4-cis-accounts-restrict-service-account-tokens                                   MANUAL   medium
ocp4-cis-accounts-unique-service-account                                            MANUAL   medium
ocp4-cis-api-server-admission-control-plugin-alwaysadmit                            PASS     medium
ocp4-cis-api-server-admission-control-plugin-alwayspullimages                       PASS     high
ocp4-moderate-oauth-or-oauthclient-token-maxage                                     FAIL     medium
ocp4-moderate-ocp-allowed-registries                                                FAIL     medium
ocp4-moderate-ocp-allowed-registries-for-import                                     FAIL     medium
ocp4-moderate-ocp-api-server-audit-log-maxbackup                                    PASS     low
ocp4-moderate-ocp-api-server-audit-log-maxsize                                      PASS     medium
ocp4-moderate-ocp-idp-no-htpasswd                                                   PASS     medium
 
＜省略＞
 
ocp4-moderate-scc-limit-process-id-namespace                                        MANUAL   medium
ocp4-moderate-scc-limit-root-containers                                             MANUAL   medium
ocp4-moderate-scheduler-no-bind-address                                             PASS     medium
ocp4-moderate-secrets-consider-external-storage                                     MANUAL   medium
ocp4-moderate-secrets-no-environment-variables                                      MANUAL   medium
[root@bastion openshift]# oc get ComplianceCheckResults | grep FAIL | wc -l
94
[root@bastion openshift]#

スキャンの結果の詳細と、コンプライアンスに準拠するための対応策の表示

[root@bastion openshift]# oc get  ComplianceCheckResults ocp4-moderate-resource-requests-quota -oyaml
apiVersion: compliance.openshift.io/v1alpha1
description: "Ensure workloads use resource requests and limits\nResource quotas provide
  constraints that limit aggregate resource consumption \nper project. This helps
  prevent resource starvation. When deploying your \napplication, it is important
  to tune based on memory and CPU consumption, \nallocating enough resources for the
  application to function properly."
id: xccdf_org.ssgproject.content_rule_resource_requests_quota
instructions: "Run the following command to retrieve the ClusterResourceQuota objects
  in the system:\n$ oc get clusterquota --all-namespaces \nMake sure there exists
  at least one ClusterResourceQuota object in the cluster.\n\nOr\n\nVerify that the
  every non-control plane namespace has an appropriate ResourceQuota.\n\nTo get all
  the non-control plane namespaces, you can do the\nfollowing command oc get  namespaces
  -o json | jq '[.items[] | select((.metadata.name | startswith(\"openshift\") | not)
  and (.metadata.name | startswith(\"kube-\") | not) and .metadata.name != \"default\")
  | .metadata.name ]'\n\nTo get all the non-control plane namespaces with a ResourceQuota,
  you can do the\nfollowing command oc get --all-namespaces resourcequota -o json
  | jq '[.items[] | select((.metadata.namespace | startswith(\"openshift\") | not)
  and (.metadata.namespace | startswith(\"kube-\") | not) and .metadata.namespace
  != \"default\") | .metadata.namespace] | unique'\n\nMake sure that the namespaces
  displayed in the commands of the commands match."
kind: ComplianceCheckResult
<省略>
    kind: ComplianceScan
    name: ocp4-moderate
<省略>
severity: medium
status: FAIL
[root@bastion openshift]#

[1]

CIS RedHat OpenShift Container Platform v4 Benchmarkを探すには、CIS Benchmarksのサイトにアクセスし、検索ボックスに「Kubernetes」と入力します。Kubernetes」をクリックし、「Download Latest CIS Benchmark」をクリックすると、ベンチマークをダウンロードするための登録画面が表示されます。

スキャン後の概要

[root@bastion openshift]# oc get fileintegritynodestatuses
NAME                                             NODE                       STATUS
example-fileintegrity-ocp48-48xs5-master-0           ocp48-48xs5-master-0           Failed
example-fileintegrity-ocp48-48xs5-master-1           ocp48-48xs5-master-1          Succeeded
example-fileintegrity-ocp48-48xs5-master-2           ocp48-48xs5-master-2          Succeeded
＜省略＞
[root@bastion openshift]# 

Failed ( File Integrity が失われている) の理由

[root@bastion openshift]# oc describe cm aide-example-fileintegrity-ocp48-48xs5-master-0-failed
＜省略＞
Summary:
  Total number of entries:  35105
  Added entries:          　   1
  Removed entries:            0
  Changed entries:             0
---------------------------------------------------
Added entries:
---------------------------------------------------
f++++++++++++++++: /hostroot/root/.bash_history
---------------------------------------------------
The attributes of the (uncompressed) database(s):
---------------------------------------------------
/hostroot/etc/kubernetes/aide.db.gz
  MD5      : YtMdReUtYPff9bab2wciKg==
＜省略＞