Dan Clark dmc5179

Mitigation of CVE 2026-31431 for OpenShift

Based on this: https://access.redhat.com/solutions/7141979
https://access.redhat.com/security/cve/cve-2026-31431

Create a butane configuration file for worker nodes

variant: openshift
version: 4.20.0

Link Node to Bare Metal Host and Machine Object

Derived from the following access article

https://access.redhat.com/solutions/7130140#ocp_step_10

Set Variables needed to link

export NODE_NAME=""          # Node name from "oc get nodes"

Disconnected Cost Explorer

Dependencies

Things to bring with

Make sure to bring the following
Git Repo: https://github.com/insights-onprem/cost-onprem-chart
helm binary
jq and kubectl must be installed on host from which chart is deployed

Disabling signatures in oc mirror for the certified operator index

Certified operator index is complicated when it comes to image signatures. oc mirror 4.21 started to enforce signature pulls. Either use oc mirror 4.20.x binary or use the below workaround.

Create a registries.d config

mkdir registries.d
cat &lt; registries.d/redhat.yaml

oc mirror race condition workaround

Note: There is a race conditin in oc mirror during the mirror-to-disk process. If the index image changes, i.e a new one is published, between the time that oc mirror starts pulling images and the time oc mirror finishes, the resulting tar ball will be corrupted
HUGE WARNING: This process will has the index image listed by digest in your imageset-config.yaml. That works fine for mirror-to-disk run 1. When you want to update content you will want to do this again and get the digest of the latest version of the index image to put into the imageset-config.yaml. If that is NOT done, your imageset will become static.

Pull the index image

podman pull registry.redhat.io/redhat/redhat-operator-index:v4.20

How to reset a user password or user login count for the quay mirror registry

Install required packages and modules

dnf install python3 python3-pip sqlite
sudo python3 -m pip install --upgrade pip
python3 -m pip install --user bcrypt

Generate a new password hash

Ansible playbook to create roles in vCenter with privileges to install an OCP cluster using IPI mode

Docs linked here: https://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html-single/installing_on_vmware_vsphere/index#installation-vsphere-installer-infra-requirements-account_ipi-vsphere-installation-reqs

Prep

ansible-galaxy collection install community.vmware

python3 -m pip install pyVim PyVmomi

	#!/bin/bash

	readonly CONTAINER_RUNTIME=${CONTAINER_RUNTIME:-podman}
	readonly CURRENT_SCRIPT=$(basename "$0")
	readonly CMD="${CONTAINER_RUNTIME} run --entrypoint performance-profile-creator"
	readonly IMG_EXISTS_CMD="${CONTAINER_RUNTIME} image exists"
	readonly IMG_PULL_CMD="${CONTAINER_RUNTIME} image pull"
	readonly MUST_GATHER_VOL="/must-gather"

	NTO_IMG="registry.redhat.io/openshift4/ose-cluster-node-tuning-rhel9-operator:v4.20"

	#!/bin/bash

	# Configuration
	APP_CODE_VALUE=""
	SERVICE_PHASE_VALUE=""
	COST_CENTER_VALUE=""
	REGION="us-east-1" # Change to your target region

	TAG_SET="app-code=${APP_CODE_VALUE},service-phase=${SERVICE_PHASE_VALUE},cost-center=${COST_CENTER_VALUE}"

	FROM registry.fedoraproject.org/fedora-minimal:latest

	WORKDIR /content

	RUN microdnf -y install cmake make git /usr/bin/python3 python3-pyyaml \
	python3-jinja2 openscap-utils python3-setuptools \
	jq vim scap-security-guide python3-pip python3-pygithub.noarch && \
	python3 -m pip install --upgrade pip && \
	python3 -m pip install --no-cache sh && \
	rm -rf /var/cache/yum /var/cache/dnf