Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-13589

Rule upstream-ocp4-kubelet-enable-protect-kernel-sysctl-file-exist fail for rhel9 based RHCOS systems

XMLWordPrintable

      Description of problem:

      Rule upstream-ocp4-kubelet-enable-protect-kernel-sysctl-file-exist fail for rhel9 based RHCOS systems

      Version-Release number of selected component (if applicable):

      4.13.0-0.nightly-2023-05-11-225357 

      How reproducible:

      Always

      Steps to Reproduce:

      1. Install Compliance Operator
      2. Deploy content with upstream repo git@github.com:ComplianceAsCode/content.git 
      3. Create a ssb:
      $ oc compliance bind -N test profile/upstream-ocp4-stig profile/upstream-ocp4-stig-node
      Creating ScanSettingBinding test
      

      Actual results:

       

      The rule upstream-ocp4-kubelet-enable-protect-kernel-sysctl-file-exist will FAIL by default. Per the instructions, the rule was trying to check whether file /etc/sysctl.d/90-kubelet.conf exists or not on nodes. 
      $ oc get ccr | grep kubelet-enable-protect-kernel-sysctl-file-exist
      upstream-ocp4-stig-node-master-kubelet-enable-protect-kernel-sysctl-file-exist                  FAIL     medium
      upstream-ocp4-stig-node-worker-kubelet-enable-protect-kernel-sysctl-file-exist                  FAIL     medium
      
      
      $ oc get ccr upstream-ocp4-stig-node-master-kubelet-enable-protect-kernel-sysctl-file-exist -o=jsonpath={.instructions}
      Run the following command on the kubelet node(s):
      $ sudo [ -f /etc/sysctl.d/90-kubelet.conf ] && echo "Exists" || echo "Not Exists"
      The output should return Exists.
      

      Expected results:

      The rule upstream-ocp4-kubelet-enable-protect-kernel-sysctl-file-exist will PASS for rhel9 based RHCOS systems. For rhel8, the file exists(after auto remediation applied); for rhel9, it doesn't exist. 

      Additional info:

       

              lbragsta@redhat.com Lance Bragstad
              xiyuan@redhat.com Xiaojie Yuan
              Xiaojie Yuan Xiaojie Yuan
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

                Created:
                Updated:
                Resolved: