Skip to content

Commit cf50f14

Browse files
ahardin-rhahardin-rh
authored
Merge pull request #31196 from ahardin-rh/file-integrity-operator-updates
Updating the File Integrity Operator content
2 parents afc50a7 + 40f7bff commit cf50f14

16 files changed

+212
-65
lines changed

‎_topic_map.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -611,6 +611,8 @@ Topics:
611611
- Name: File Integrity Operator
612612
Dir: file_integrity_operator
613613
Topics:
614+
- Name: Installing the File Integrity Operator
615+
File: file-integrity-operator-installation
614616
- Name: Understanding the File Integrity Operator
615617
File: file-integrity-operator-understanding
616618
- Name: Configuring the File Integrity Operator

‎modules/checking-file-intergrity-cr-status.adoc‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,13 @@
33
// * security/file_integrity_operator/file-integrity-operator-understanding.adoc
44

55
[id="checking-the-file-integrity-CR-status_{context}"]
6-
= Checking the `FileIntegrity` custom resource status
6+
= Checking the FileIntegrity custom resource status
77

8-
The `FileIntegrity` custom resource (CR) reports its status through the
9-
.`status.phase` subresource.
8+
The `FileIntegrity` custom resource (CR) reports its status through the .`status.phase` subresource.
109

1110
.Procedure
1211

13-
. To query the `FileIntegrity` CR status, run:
12+
* To query the `FileIntegrity` CR status, run:
1413
+
1514
[source,terminal]
1615
----

‎modules/file-integrity-CR-phases.adoc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
// * security/file_integrity_operator/file-integrity-operator-understanding.adoc
44

55
[id="file-integrity-CR-phases_{context}"]
6-
= `FileIntegrity` custom resource phases
6+
= FileIntegrity custom resource phases
77

88
* `Pending` - The phase after the custom resource (CR) is created.
99
* `Active` - The phase when the backing daemon set is up and running.

‎modules/file-integrity-node-status-failure.adoc‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@
33
// * security/file_integrity_operator/file-integrity-operator-understanding.adoc
44

55
[id="file-integrity-node-status-failure_{context}"]
6-
= `FileIntegrityNodeStatus` failure status example
6+
= FileIntegrityNodeStatus CR failure status example
77

8-
To simulate a failure condition, modify one of the files AIDE tracks. For
9-
example, modify `/etc/resolv.conf` on one of the worker nodes:
8+
To simulate a failure condition, modify one of the files AIDE tracks. For example, modify `/etc/resolv.conf` on one of the worker nodes:
109

1110
[source,terminal]
1211
----
@@ -28,9 +27,7 @@ Removing debug pod ...
2827
Removing debug namespace/openshift-debug-node-ldfbj ...
2928
----
3029

31-
After some time, the `Failed` condition was reported in the results array of the
32-
corresponding `FileIntegrityNodeStatus`. The previous `Succeeded` condition is
33-
retained, which allows you to pinpoint the time the check failed.
30+
After some time, the `Failed` condition is reported in the results array of the corresponding `FileIntegrityNodeStatus` object. The previous `Succeeded` condition is retained, which allows you to pinpoint the time the check failed.
3431

3532
[source,terminal]
3633
----
@@ -62,8 +59,7 @@ $ oc get fileintegritynodestatuses.fileintegrity.openshift.io -ojsonpath='{.item
6259
]
6360
----
6461

65-
The `Failed` condition points to a config map that gives more details about what
66-
exactly failed and why:
62+
The `Failed` condition points to a config map that gives more details about what exactly failed and why:
6763

6864
[source,terminal]
6965
----
@@ -112,3 +108,5 @@ File: /hostroot/etc/resolv.conf
112108

113109
Events: <none>
114110
----
111+
112+
Due to the config map data size limit, AIDE logs over 1 MB are added to the failure config map as a base64-encoded gzip archive. In this case, you want to pipe the output of the above command to `base64 -d | gunzip`. Compressed logs are indicated by the presence of a `file-integrity.openshift.io/compressed` annotation key in the config map.

‎modules/file-integrity-node-status-success.adoc‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
// * security/file_integrity_operator/file-integrity-operator-understanding.adoc
44

55
[id="file-integrity-node-status-success_{context}"]
6-
= `FileIntegrityNodeStatus` success status example
6+
= FileIntegrityNodeStatus CR success example
77

88
.Example output of a condition with a success status
99

@@ -29,5 +29,4 @@
2929
]
3030
----
3131

32-
In this case, all three scans succeeded and so far there are no other
33-
conditions.
32+
In this case, all three scans succeeded and so far there are no other conditions.

‎modules/file-integrity-node-status.adoc‎

Lines changed: 5 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -3,17 +3,12 @@
33
// * security/file_integrity_operator/file-integrity-operator-understanding.adoc
44

55
[id="file-integrity-node-status-types_{context}"]
6-
= `FileIntegrityNodeStatus` status types
6+
= FileIntegrityNodeStatus CR status types
77

8-
These conditions are reported in the results array of the
9-
corresponding `FileIntegrityNodeStatus`:
8+
These conditions are reported in the results array of the corresponding `FileIntegrityNodeStatus` CR status:
109

11-
* `Succeeded` - The integrity check passed; the files and directories
12-
covered by the AIDE check have not been modified since the database was last
13-
initialized.
10+
* `Succeeded` - The integrity check passed; the files and directories covered by the AIDE check have not been modified since the database was last initialized.
1411

15-
* `Failed` - The integrity check failed; some files or directories
16-
covered by the AIDE check have been modified since the database was last
17-
initialized.
12+
* `Failed` - The integrity check failed; some files or directories covered by the AIDE check have been modified since the database was last initialized.
1813

19-
* `Error` - The AIDE scanner encountered an internal error.
14+
* `Errored` - The AIDE scanner encountered an internal error.

‎modules/file-integrity-operator-installing-cli.adoc‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/file_integrity_operator/file-integrity-operator-installation.adoc
4+
5+
[id="installing-file-integrity-operator-using-cli_{context}"]
6+
= Installing the File Integrity Operator using the CLI
7+
8+
.Prerequisites
9+
10+
* You must have `admin` privileges.
11+
12+
.Procedure
13+
14+
. Create a `Namespace` object YAML file by running:
15+
+
16+
[source,terminal]
17+
----
18+
$ oc create -f <file-name>.yaml
19+
----
20+
+
21+
.Example output
22+
[source,yaml]
23+
----
24+
apiVersion: v1
25+
kind: Namespace
26+
metadata:
27+
name: openshift-file-integrity
28+
----
29+
30+
. Create the `OperatorGroup` object YAML file:
31+
+
32+
[source,terminal]
33+
----
34+
$ oc create -f <file-name>.yaml
35+
----
36+
+
37+
.Example output
38+
[source,yaml]
39+
----
40+
apiVersion: operators.coreos.com/v1
41+
kind: OperatorGroup
42+
metadata:
43+
name: file-integrity-operator
44+
namespace: openshift-file-integrity
45+
spec:
46+
targetNamespaces:
47+
- openshift-file-integrity
48+
----
49+
50+
. Set the {product-title} major and minor version as an environment variable, which is used as the channel value in the next step:
51+
+
52+
[source,terminal]
53+
----
54+
$ OC_VERSION=$(oc version -o yaml | grep openshiftVersion | grep -o '[0-9]*[.][0-9]*' | head -1)
55+
----
56+
57+
. Create the `Subscription` object YAML file:
58+
+
59+
[source,terminal]
60+
----
61+
$ oc create -f <file-name>.yaml
62+
----
63+
+
64+
.Example output
65+
[source,yaml]
66+
----
67+
apiVersion: operators.coreos.com/v1alpha1
68+
kind: Subscription
69+
metadata:
70+
name: file-integrity-operator
71+
namespace: openshift-file-integrity
72+
spec:
73+
channel: "${OC_VERSION}"
74+
installPlanApproval: Automatic
75+
name: file-integrity-operator
76+
source: redhat-operators
77+
sourceNamespace: openshift-marketplace
78+
----
79+
80+
.Verification
81+
82+
. Verify the installation succeeded by inspecting the CSV file:
83+
+
84+
[source,terminal]
85+
----
86+
$ oc get csv -n openshift-file-integrity
87+
----
88+
89+
. Verify that the File Integrity Operator is up and running:
90+
+
91+
[source,terminal]
92+
----
93+
$ oc get deploy -n openshift-file-integrity
94+
----

‎modules/file-integrity-operator-installing-web-console.adoc‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/file_integrity_operator/file-integrity-operator-installation.adoc
4+
5+
[id="installing-file-integrity-operator-using-web-console_{context}"]
6+
= Installing the File Integrity Operator using the web console
7+
8+
.Prerequisites
9+
10+
* You must have `admin` privileges.
11+
12+
.Procedure
13+
14+
. In the {product-title} web console, navigate to *Operators* -> *OperatorHub*.
15+
. Search for the File Integrity Operator, then click *Install*.
16+
. Keep the default selection of *Installation mode* and *namespace* to ensure that the Operator will be installed to the `openshift-file-integrity` namespace.
17+
. Click *Install*.
18+
19+
.Verification
20+
21+
To confirm that the installation is successful:
22+
23+
. Navigate to the *Operators* -> *Installed Operators* page.
24+
. Check that the Operator is installed in the `openshift-file-integrity` namespace and its status is `Succeeded`.
25+
26+
If the Operator is not installed successfully:
27+
28+
. Navigate to the *Operators* -> *Installed Operators* page and inspect the `Status` column for any errors or failures.
29+
. Navigate to the *Workloads* -> *Pods* page and check the logs in any pods in the `openshift-file-integrity` project that are reporting issues.

‎modules/file-integrity-operator-reinitializing-database.adoc‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,20 @@
55
[id="file-integrity-operator-reinitializing-database_{context}"]
66
= Reinitializing the database
77

8-
If the File Integrity Operator detects a change that was planned, it might be
9-
required to reinitialize the database. To do that, annotate the `FileIntegrity`
10-
custom resource (CR) with `file-integrity.openshift.io/re-init`:
8+
If the File Integrity Operator detects a change that was planned, it might be required to reinitialize the database.
119

10+
.Procedure
11+
12+
* Annotate the `FileIntegrity` custom resource (CR) with `file-integrity.openshift.io/re-init`:
13+
+
1214
[source,terminal]
1315
----
1416
$ oc annotate fileintegrities/worker-fileintegrity file-integrity.openshift.io/re-init=
1517
----
16-
17-
The old database and log files are backed up and a new database is initialized.
18-
The old database and logs are retained on the nodes under `/etc/kubernetes`, as
18+
+
19+
The old database and log files are backed up and a new database is initialized. The old database and logs are retained on the nodes under `/etc/kubernetes`, as
1920
seen in the following output from a pod spawned using `oc debug`:
20-
21+
+
2122
.Example output
2223
[source,terminal]
2324
----
@@ -29,8 +30,6 @@ seen in the following output from a pod spawned using `oc debug`:
2930
-rw-------. 1 root root 613 Sep 17 15:07 /host/etc/kubernetes/aide.log.backup-20200917T15_07_38
3031
-rw-r--r--. 1 root root 0 Sep 17 15:07 /host/etc/kubernetes/aide.log.backup-20200917T15_07_55
3132
----
32-
33-
To provide some permanence of record, the resulting config maps are not
34-
owned by the `FileIntegrity` object, so manual cleanup is necessary. As a
35-
result, any previous integrity failures would still be visible in the
36-
`FileIntegrityNodeStatus` object.
33+
+
34+
To provide some permanence of record, the resulting config maps are not owned by the `FileIntegrity` object, so manual cleanup is necessary. As a
35+
result, any previous integrity failures would still be visible in the `FileIntegrityNodeStatus` object.

‎modules/file-integrity-operator-viewing-attributes.adoc‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,10 +3,9 @@
33
// * security/file_integrity_operator/file-integrity-operator-configuring.adoc
44

55
[id="viewing-file-integrity-object-attributes_{context}"]
6-
= Viewing `FileIntegrity` object attributes
6+
= Viewing FileIntegrity object attributes
77

8-
As with any Kubernetes custom resources (CRs), you can run `oc explain
9-
fileintegrity`, and then look at the individual attributes using:
8+
As with any Kubernetes custom resources (CRs), you can run `oc explain fileintegrity`, and then look at the individual attributes using:
109

1110
[source,terminal]
1211
----

0 commit comments

Comments
 (0)