Security and Compliance

Select Operators and then Installed Operators from the left side navigation menu, confirm that you have selected All Projects and select the Compliance Operator.

Figure 2. Compliance Operator

This takes you to the Operator details page, use the horizontal scrollbar to move across and locate the ScanSetting tab.

Figure 3. Compliance Details

Click the Create ScanSetting button.

Figure 4. Create ScanSetting Button

On the Create ScanSetting page, set the name of the scan to scan01. Then click the YAML view radio button.

Figure 5. Create Scansetting

In the ScanSetting YAML details, make note of the following values that are set by default:

Delete the entry for master to ensure we don’t scan or remediate control plane nodes.

Click the Create button to create this simple scansetting definition that will only scan worker nodes.

Figure 6. ScanSetting Details

Now click on the Profile tab where there are a number of pre-defined scanning profiles.

In the search box, type rhcos4 and locate the FedRamp moderate profile rhcos4-moderate in the list.

Figure 7. Profiles Detail

Click on rhcos4-moderate and then on the YAML. Scroll down the output to browse the rules that are enforced as a part of this scan. A quick glimpse at the side panel shows that there are quite a few of them.

Figure 8. RHCOS4-Moderate Rules

When you are done reviewing the rules, return to the Operator details page by clicking your browser’s back button twice.

Next we want to create a ScanSettingBinding, pairing a Profile with our ScanSetting definition we created. We do this by navigating to the Scan Setting Binding tab, and clicking the Create ScanSettingBinding button.

Figure 9. Create ScanSettingBinding

In the ScanSettingBinding YAML details, let us make a few changes:

Click the Create button.

Figure 10. ScanSettingBinding Details

After the ScanSettingBinding is created, the fedramp01 scan will be run automatically. You can view this on the Compliance Suite tab.

Figure 11. Compliance Suite

This Compliance Suite runs the defined scans against the specified nodes, in our case the worker nodes defined in scan01.

For more detailed information you can click on the Compliance Scan tab. There you can watch as the scan proceeds through the steps of RUNNING, AGGREGATING, and DONE.

Figure 12. Compliance Scan

Once the scan completes (3-5 minutes on average) you can check your results by clicking on the ComplianceCheckResult tab. It will list all of the scans that were a part of the compliance suite we chose and their results.

Change the search bar to Label and apply the following labels:

Six high severity checks have a failed status:

Starting from the list above we are going to choose to remediate the following scan result: rhcos4-moderate-worker-coreos-pti-kernel-arguments as required by our audit.

Figure 14. Compliance Remediation

This will launch the ComplianceRemediation details page with a YAML block describing the current status.

Under the spec section you will see that the current apply state is false, and the kernelArugument that will be applied is that pti=on. Under the status section we see that the remediation state is NotApplied.

Figure 15. Compliance Remediation Details

Under the spec section change the apply field to true and click the Save button.

Figure 16. Compliance Remediation True

You will be prompted with a message that lets you know that this is a managed resource, click the Save button to sart the remediation process.

Figure 17. Managed Resource Prompt

Once applied, a MachineConfig will be generated to provide the remediation, and each node in the cluster will be cordoned, drained, and remediated in sequence.

On the left side menu, click on Compute and Nodes to observe the process.

Figure 18. Node 3 Cordoned

You will see a node enter the SchedulingDisabled state to begin its remediation. Click on that node for its Node details page, and notice that the event log shows the node was cordoned to apply the update, and you can also see CPU and Memory utilization drop off as the node was successfully drained.

Figure 19. Node 3 Updating

After several minutes the MachineConfig will be applied to each of the worker nodes in our cluster, and we can recheck our Compliance Scan results.

Return to the Compliance Operator configuration by clicking on Operators and Installed Operators in the left side menu.

Figure 20. OpenShift Compliance Operator

Click on the Compliance Scan tab, where you will see the scan we completed earlier. Click the three-dot menu, and select the option to delete the current scan.

Figure 21. Delete Compliance Scan

You will be prompted to be sure that you want to delete the current compliance scan. Click the Delete button.

Figure 22. Delete Scan Prompt

The Compliance Suite object defined earlier will automatically kick off a new scan which you will see appear on your screen.

Figure 23. New Compliance Scan

As before this can will take a few minutes to complete, but once it is complete the results can be viewed by clicking on the ComplianceCheckResult tab, and searching for the rhcos4-moderate-worker-coreos-pti-kernel-argument and noticing that its label is now check-status=PASS instead of FAIL

Figure 24. Check Status Pass

Start by clicking on User Management and Users in the left side menu.

You will see the current admin user that you are logged in as listed, and you will see that the identity is provided by the htpasswd_provider:admin authenticator.

Figure 25. User List