Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

OCP4 CIS: Re-add forgotten rules #10864

Merged
merged 3 commits into from
Jul 19, 2023
Merged

OCP4 CIS: Re-add forgotten rules #10864

merged 3 commits into from
Jul 19, 2023

Conversation

jhrozek
Copy link
Collaborator

@jhrozek jhrozek commented Jul 18, 2023

Description:

  • CIS: Use the correct rule for 1.1.3 - this was a copy-paste most probably
  • CIS: Use the automated rule for checking kube scheduler permissions - there's two rules that differ just by one having _kube in the name and one of them is manual, the other is automated. Let's use the automated one.
  • CIS: Additional rules for already covered controls - Just re-adds rules that were in the original hand-written CIS profile, but left out from the control files. I'll point out some questions

Rationale:

  • OCP4 CIS coverage

Review Hints:

  • I'll point out some questions inline
  • Otherwise just check that the rules make sense and that CI passes

jhrozek
jhrozek commented Jul 18, 2023
View reviewed changes
controls/cis_ocp_1_4_0/section-4.yml
@@ -47,6 +47,8 @@ controls:
rules:
- file_groupowner_kubelet_conf
- file_owner_kubelet_conf
#- file_groupowner_kubelet
- file_owner_kubelet
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@Vincent056 Are these rules still valid? We have file_owner_kubelet that seems reasonable, but file_groupowner_kubelet is missing despite having been used in the original CIS profile. Should we drop the rules or re-add the group one?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it looks like we were missing that one, let's keep this one here, and re-add the group one

@github-actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@rhmdnd
Copy link
Collaborator

rhmdnd commented Jul 18, 2023

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

rhmdnd
rhmdnd reviewed Jul 18, 2023
View reviewed changes
Copy link
Collaborator

@rhmdnd rhmdnd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

Thanks for this. Waiting to see what others have to say and what CI reports, but otherwise this looks good to me.

@rhmdnd rhmdnd added OpenShift OpenShift product related. CIS CIS Benchmark related. labels Jul 18, 2023
@codeclimate
Copy link

codeclimate bot commented Jul 19, 2023

Code Climate has analyzed commit ac6e08a and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 53.2% (0.0% change).

View more on Code Climate.

@yuumasato
Copy link
Member

/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node

yuumasato
yuumasato approved these changes Jul 19, 2023
View reviewed changes
Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks Jakub, LGTM!

@yuumasato yuumasato added this to the 0.1.70 milestone Jul 19, 2023
@yuumasato
Copy link
Member

Fail on Automatus Sanity happens on untouched and unrelated rule.
Rawhide failure is on import imp.

@rhmdnd rhmdnd merged commit 807d702 into ComplianceAsCode:master Jul 19, 2023
28 of 30 checks passed
@Mab879 Mab879 added the Update Profile Issues or pull requests related to Profiles updates. label Oct 12, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Vincent056 Vincent056 Vincent056 left review comments

@rhmdnd rhmdnd rhmdnd left review comments

@yuumasato yuumasato yuumasato approved these changes

Assignees

@yuumasato yuumasato

@rhmdnd rhmdnd

Labels
CIS CIS Benchmark related. OpenShift OpenShift product related. Update Profile Issues or pull requests related to Profiles updates.
Projects
None yet
Milestone
0.1.70
Development

Successfully merging this pull request may close these issues.
5 participants
@jhrozek @rhmdnd @yuumasato @Vincent056 @Mab879