File Integrity Monitoring & Node Hardening
Duration: ~20 minutes
Overview
Learn how to deploy and configure the File Integrity Operator to monitor file system integrity on OpenShift nodes, detect unauthorized changes, and implement node-level security hardening measures.
Configure file integrity monitoring and related node hardening so unexpected host file changes become visible and actionable.
Why it matters
File integrity monitoring detects unauthorized changes to critical system files, which could indicate compromise or misconfiguration. Combined with node hardening, this provides defense-in-depth for the control plane and worker nodes, meeting compliance requirements for system integrity monitoring.
What does it solve
-
Undetected file system tampering
-
Compliance monitoring requirements
-
Node-level security gaps
-
Unauthorized configuration changes
-
Security baseline drift
Your Mission
Complete the examples below to close the attack paths this lab covers—treat each step as defending the cluster, not just clicking through commands.
Click each step only if you need a hint.
Check File Integrity Operator installation
oc get pods -n openshift-file-integrity
oc get fileintegrity -ACreate FileIntegrity resource
oc apply -f - <<'EOF'
apiVersion: fileintegrity.openshift.io/v1alpha1
kind: FileIntegrity
metadata:
name: worker-file-integrity
namespace: openshift-file-integrity
spec:
nodeSelector:
node-role.kubernetes.io/worker: ""
config:
name: my-file-integrity-config
namespace: openshift-file-integrity
debug: false
EOFMonitor integrity status
oc get fileintegrity -n openshift-file-integrity
oc get fileintegrityreports -n openshift-file-integrityReview integrity reports
oc get fileintegrityreports -n openshift-file-integrity -o yaml | grep -A 10 "results"Cleanup
oc delete fileintegrity worker-file-integrity -n openshift-file-integrityDebrief
File Integrity Operator is a camera for node-critical paths—catch unexpected file and config changes before they become incidents.
What breaks without this:
-
Silent binary or config drift on nodes → malware or misconfig with no early signal
-
Compliance asks for FIM with no operator story
Controls that matter: File Integrity Operator, clear monitored paths, alerting into your ops channel, and pairing with node hardening baselines.
Quick facts: focus on critical system/bin/config files; overhead is usually light; intervals are configurable.
