Red Hat OpenShift Container Platform

Defining a custom File Integrity Operator configuration

This example focuses on defining a custom configuration for a scanner that runs on the control plane nodes based on the default configuration provided for the worker-fileintegrity CR. This workflow might be useful if you are planning to deploy a custom software running as a daemon set and storing its data under /opt/mydaemon on the control plane nodes.

Procedure

Make a copy of the default configuration.
Edit the default configuration with the files that must be watched or excluded.
Store the edited contents in a new config map.
Point the FileIntegrity object to the new config map through the attributes in spec.config.

Extract the default configuration:

$ oc extract cm/worker-fileintegrity --keys=aide.conf

This creates a file named aide.conf that you can edit. To illustrate how the Operator post-processes the paths, this example adds an exclude directory without the prefix:

$ vim aide.conf

Example output

/hostroot/etc/kubernetes/static-pod-resources
!/hostroot/etc/kubernetes/aide.*
!/hostroot/etc/kubernetes/manifests
!/hostroot/etc/docker/certs.d
!/hostroot/etc/selinux/targeted
!/hostroot/etc/openvswitch/conf.db

Exclude a path specific to control plane nodes:

!/opt/mydaemon/

Store the other content in /etc:

/hostroot/etc/	CONTENT_EX

Create a config map based on this file:

$ oc create cm master-aide-conf --from-file=aide.conf

Define a FileIntegrity CR manifest that references the config map:

apiVersion: fileintegrity.openshift.io/v1alpha1
kind: FileIntegrity
metadata:
  name: master-fileintegrity
  namespace: openshift-file-integrity
spec:
  nodeSelector:
      node-role.kubernetes.io/master: ""
  config:
      name: master-aide-conf
      namespace: openshift-file-integrity

The Operator processes the provided config map file and stores the result in a config map with the same name as the FileIntegrity object:

$ oc describe cm/master-fileintegrity | grep /opt/mydaemon

Example output

!/hostroot/opt/mydaemon