diff --git a/applications/openshift-virtualization/kubevirt-vcpu-metrics-enabled/rule.yml b/applications/openshift-virtualization/kubevirt-vcpu-metrics-enabled/rule.yml new file mode 100644 index 00000000000..15892859118 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-vcpu-metrics-enabled/rule.yml @@ -0,0 +1,29 @@ +documentation_complete: true + +platform: '{{{ product }}}-node' + +title: 'Ensure vCPU metrics are enabled' + +description: |- + OpenShift Virtualization provides metrics that you can use to monitor the + consumption of cluster infrastructure resources, including virtual CPU + (vCPU). In order to use the vCPU metric, the schedstats=enable + kernel argument must be applied. + +rationale: |- + Metrics are a fundamental mechanism for understanding if the guest is + behaving in an anomalous or otherwise suspicious manner. + +severity: medium + +ocil_clause: 'schedstats is not enabled in the kernel command line' + +ocil: |- + Verify if the option is enabled in the kernel command line: +
$ cat /proc/cmdline | grep schedstats=enable+ +template: + name: coreos_kernel_option + vars: + arg_name: schedstats + arg_value: enable diff --git a/products/ocp4/profiles/cis-vm-extension-node.profile b/products/ocp4/profiles/cis-vm-extension-node.profile index 7ba00c27d1a..b31edd3c51f 100644 --- a/products/ocp4/profiles/cis-vm-extension-node.profile +++ b/products/ocp4/profiles/cis-vm-extension-node.profile @@ -29,4 +29,5 @@ description: |- selections: - kubevirt-nested-virtualization-disabled + - kubevirt-vcpu-metrics-enabled - kubevirt-seccomp-profile-permissions