cis-ocp-vm-v100-1-10

name	cis-ocp-vm-v100-1-10
description	Restrict namespace administrator access to migration tools (Manual)
category	cis-openshift-virtualization
version	1.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","openshift-virtualization","kubevirt","vm","platform-configuration","rbac","migration","namespace-admin"]
cis_id	1.10
cis_benchmark	CIS Redhat OpenShift Virtual Machine Extension Benchmark v1.0.0
tech_stack	["kubernetes","openshift","openshift-virtualization","kubevirt"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS 1.10 — Restrict namespace administrator access to migration tools

Profile Applicability

• Level 1

Description

Namespace administrators have the capability to perform live migrations, which can potentially impact other users of the system. Live migration is a process where virtual machines can be moved from one physical host to another without any downtime, making it a valuable tool for managing clusters and ensuring high availability. However, since live migration involves moving data between hosts, it can have an impact on other users who may have applications running on the same hosts. As such, it is important to exercise caution when granting access to namespace administrators and ensure that appropriate safeguards are in place to minimize any potential disruptions.

Rationale

Limiting the number of virtual machine migrations occurring simultaneously can help to ensure that the system remains stable and performs optimally during periods of high migration activity. If too many migrations are occurring at once, it can lead to increased resource usage, reduced processing power, and potential network congestion, all of which can impact system performance and availability.

The KubeVirt community is working towards removing migration functionality from namespace administrators in order to make it safer and more manageable. Live migration, on the other hand, will be reserved for cluster administrators. This separation of duties helps ensure that live migrations can be performed safely and without impacting other users of the system.

Please refer to the upstream proposal for more information.

Impact

Using VirtualMachineInterfaceMigrations can introduce additional overhead to the system, particularly if a large number of migrations are occurring simultaneously. This can lead to increased resource usage and potential performance degradation, as the migration process requires significant processing power and network bandwidth. Additionally, if a migration fails or encounters errors during the migration process, it can cause downtime for the associated VM and potentially impact system availability.

Audit Procedure

Use the following command to find users, service accounts and groups who are allowed to create VirtualMachineInterfaceMigration and MigrationPolicy resources:

$ oc adm policy who-can create vmim
$ oc adm policy who-can create migrationpolicy

Ensure users are authorized to perform those actions.

Remediation

Remove create access to virtualmachineinstancemigration and migrationpolicy objects in the cluster. Example: Remove create access given by the clusterRoleBinding for the l for the user.