-
Bug
-
Resolution: Done-Errata
-
Normal
-
4.11
-
+
-
No
-
MCO Sprint 237, MCO Sprint 238
-
2
-
False
-
Description of problem:
Machine-config operator is not compliant with CIS benchmark rule "Ensure Usage of Unique Service Accounts" [1] as part of "ocp4-cis" profile used in compliance operator [2]. Observed that machine-config operator is using the default service account where default SA comes into play if there is no other service account specified. OpenShift core operators should be compliant with the CIS benchmark, i.e. the operators should run with their own serviceaccount rather than using the "default" one. [1] https://static.open-scap.org/ssg-guides/ssg-ocp4-guide-cis.html#xccdf_org.ssgproject.content_group_accounts [2] https://docs.openshift.com/container-platform/4.11/security/compliance_operator/compliance-operator-supported-profiles.html
Version-Release number of selected component (if applicable):
How reproducible:
Steps to Reproduce:
1. 2. 3.
Actual results:
Core operators are using default service account
Expected results:
Core operators should run with their own service account
Additional info:
- is related to
-
OCPBUGS-11179 Network operator should be compliant with CIS benchmark rule
- Closed
- links to
-
RHEA-2023:5006 rpm