CMP-4444: Add rule kubevirt-vcpu-metrics-enabled (CIS OCP-Virt 6.2) - #14961
CMP-4444: Add rule kubevirt-vcpu-metrics-enabled (CIS OCP-Virt 6.2)#14961abushkin-redhat wants to merge 1 commit into
Conversation
OpenSCAP node rule using the coreos_kernel_option template to check that schedstats=enable is present in the kernel command line (/proc/cmdline) and boot loader entries. Enables vCPU metrics for monitoring virtual CPU consumption on OpenShift Virtualization nodes. Validated on a live cluster: schedstats=enable absent = FAIL, schedstats=enable present (via MachineConfig) = PASS.
0285159 to
8b19a50
Compare
|
@abushkin-redhat: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
Closing: superseded by #14980 (merged), which carries the identical rule content - validated with a datastream build + oscap-chroot truth table and live-cluster runs in both stock and schedstats-enabled states. Thanks for the original work here - CMP-4444 is delivered. |
3 participants
Summary
kubevirt-vcpu-metrics-enabledchecking thatschedstats=enableis present in the kernel command line and boot loader entriescoreos_kernel_optiontemplate which checks both/proc/cmdlineand
/boot/loader/entries/ostree-*.confcis-vm-extension-nodeprofile selectionsDepends on
cis-vm-extension-nodeprofile andkubevirt-nested-virtualization-disabledrule)Test plan
Validated on a live OCP cluster (OCP 4.22, RHEL 10, TechPreviewNoUpgrade):
schedstats=enableabsent → FAILschedstats=enablepresent (via MachineConfig) → PASS