search

ranchergovernment / carbide

Rancher Government Carbide
https://ranchergovernment.com/carbide
2 stars 0 forks source link

[BUG] RHEL8 FIPS Enabled Scans fail to run #11

Open pjmckee opened 2 weeks ago

pjmckee commented 2 weeks ago

Describe the bug When running a scan with STIGATRON 0.3.0 installed on any profile, the scans will fail when the underlying RKE2 1.26 nodes are RHEL8 with FIPS enabled. Attached are the logs of the sonobuoy-rancher-kube-bench-daemon-set that spins up to perform the scan.

To Reproduce Steps to reproduce the behavior:

  1. Install STIGATRON and CIS-Operator via Rancher Apps
  2. Click on Create SCAN
  3. Select the applicable profile
  4. Go to pod logs for sonobuoy-rancher-kube-bench-daemon-set and watch for errors.

Expected behavior Scans will complete and show pass/fail.

Screenshots CIS Scan Error

Desktop (please complete the following information):

Additional context Underlying OS is running the RHEL8 STIG'd with FIPS and SELINUX turned on with RKE2 version 1.26.15+rke2r1 cis logs.txt

HoustonDad commented 1 week ago

I can replicate this, but it only occurs on worker nodes. The scans work fine on control plane nodes.

This may be due to incompatibilities with RKE2 1.26 and RHEL 8.10. Will test RKE2 1.29 and report back

HoustonDad commented 1 week ago

This does not occur on RKE2 v1.29, RHEL 8.10 STIG and FIPS enabled and Rancher MCM v2.9.2.

This does occur on RKE2 v1.26, RHEL 8.10 STIG and FIPS enabled and Rancher MCM v2.8.6, but it is NOT fatal. I have three clusters up, reach out to dig