Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-16727

Rule ocp4-cis-kubelet-configure-event-creation will fail by default for 4.14

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done-Errata
    • Icon: Major Major
    • None
    • 4.14.0
    • Compliance Operator
    • None
    • No
    • CMP Sprint 68, CMP Sprint 69
    • 2
    • False
    • Hide

      None

      Show
      None

      Description of problem:

       

      Rule ocp4-cis-kubelet-configure-event-creation will fail by default for 4.14. The reason is the default value of  eventRecordQPS was updated to 50. Not sure if we can support different default values on different versions to make the rule PASS by default.
      $ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep eventRecordQPS; done
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
      

      Version-Release number of selected component (if applicable):

      4.14.0-0.nightly-2023-07-20-215234 + compliance-operator.v1.2.0

      How reproducible:

      Always

      Steps to Reproduce:

      1. Install compliance-operator.v1.2.0;
      2. Create a ssb:
      $ oc compliance bind -N test profile/ocp4-cis profile/ocp4-cis-node 
      3.
      

      Actual results:

       

      Rule ocp4-cis-kubelet-configure-event-creation will fail by default.
      $  oc get ccr ocp4-cis-kubelet-configure-event-creation
      NAME                                        STATUS   SEVERITY
      ocp4-cis-kubelet-configure-event-creation   FAIL     medium
      $ for NODE_NAME in $(oc get nodes -ojsonpath='{.items[*].metadata.name}'); do oc get --raw /api/v1/nodes/$NODE_NAME/proxy/configz | jq '.kubeletconfig|.kind="KubeletConfiguration"|.apiVersion="kubelet.config.k8s.io/v1beta1"' | grep eventRecordQPS; done
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
        "eventRecordQPS": 50,
      

      Expected results:

      Rule ocp4-cis-kubelet-configure-event-creation should PASS by default.

      Additional info:

       

              wsato@redhat.com Watson Sato
              xiyuan@redhat.com Xiaojie Yuan
              Xiaojie Yuan Xiaojie Yuan
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: