Uploaded image for project: 'Cloud Infrastructure Security & Compliance'
  1. Cloud Infrastructure Security & Compliance
  2. CMP-3623

[Compliance Operator] Remediations via MachineConfig can conflict with existing MachineConfigs

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • False

      USER PROBLEM
      What is the user experiencing as a result of the bug? Include steps to reproduce.

      • User creates a MachineConfig with Butane to modify /etc/chrony.conf and gives it a name such as "50-chrony-config" .  Importantly, Butane sets "compression: gzip" in the MachineConfig.
      • Then, the Compliance Operator is run and recommends remediations, one of which is for /etc/chrony.conf. It creates a MachineConfig called something like "75-rhcos4-high-master-chronyd-no-chronyc-network" with non-gzip data. However, the "compression: gzip" is maintained from the lower-numbered MachineConfig.
      • This causes the MachineConfig to not apply correctly.

      CONDITIONS
      What conditions need to exist for a user to be affected? Is it everyone? Is it only those with a specific integration? Is it specific to someone with particular database content? etc.

      • There must be a MachineConfig with a lower number that effects changes to a file that the Compliance Operator also wants to modify.

      ROOT CAUSE
      What is the root cause of the bug?

      • Unknown.

      FIX
      How was the bug fixed (this is more important if a workaround was implemented rather than an actual fix)?

      • Manually remove "compression: gzip" from the defective MachineConfig created by the Compliance Operator.

              Unassigned Unassigned
              rhn-support-msecaur Matthew Secaur
              Xiaojie Yuan Xiaojie Yuan
              Maria Simon Marcos Maria Simon Marcos
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: