Remove kubernetes hardcoded solution for templated service_debug rules #11370

CoreyCook8 · 2023-12-11T21:56:46Z

Description:

service_debug-shell_disabled and service_autofs_disabled have hardcoded remediations for the Kubernetes lang but templates exist for these rules.

Also, updates the jinja macro to reflect masking the service/socket.

Prior to this change there are two different fixes created for ignition and kubernetes

<xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_autofs_disabled">---
apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - enabled: false
        name: autofs.service
</xccdf-1.2:fix>
<xccdf-1.2:fix system="urn:xccdf:fix:script:ignition" id="service_autofs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: autofs.service
        enabled: false
        mask: true
      - name: autofs.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>

After this change, the kubernetes lang takes the templated version and the two fixes are identical.

<xccdf-1.2:fix system="urn:xccdf:fix:script:kubernetes" id="service_autofs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: autofs.service
        enabled: false
        mask: true
      - name: autofs.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>
<xccdf-1.2:fix system="urn:xccdf:fix:script:ignition" id="service_autofs_disabled" complexity="low" disruption="medium" reboot="true" strategy="disable">apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0
    systemd:
      units:
      - name: autofs.service
        enabled: false
        mask: true
      - name: autofs.socket
        enabled: false
        mask: true
</xccdf-1.2:fix>

Rationale:

There is no need to create hardcoded remediation files for these since the template files exist.

Also, when using the OpenShift Compliance Operator, the fix used for this depends on the ordering of these fixes. In my case, the kubernetes fix was before the ignition fix in the list. This caused the compliance operator to apply the kubernetes fix which failed to mask the service.

If the rule is going to check for the services to be masked, then all of the available remediations should mask the service.

openshift-ci · 2023-12-11T21:56:57Z

Hi @CoreyCook8. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

github-actions · 2023-12-11T21:58:40Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

CoreyCook8 · 2024-01-02T14:29:00Z

👋 Could I get some eyes on here when someone has a chance? 🙏

CoreyCook8 · 2024-01-17T19:00:49Z

Hey @rhmdnd could I get some 👀 on this one when you have a chance please? 🙏

rhmdnd · 2024-02-05T22:24:05Z

/test

openshift-ci · 2024-02-05T22:24:10Z

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.13-images
/test 4.14-images
/test 4.15-images
/test 4.16-images
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rhmdnd · 2024-02-05T22:24:21Z

/test e2e-aws-rhcos4-high

rhmdnd · 2024-02-05T22:26:07Z

Thanks for the patch @CoreyCook8.

Testing this rule against a dev cluster and I noticed the default result changed since 1ce0c75 landed.

Running e2e tests to see what the outcome is of this patch with those changes.

rhmdnd · 2024-02-06T02:52:22Z

Based on the e2e results - this appears to be failing because the autofs package isn't installed.

#11546 should fix the e2e issues, but we might need to validate a different way to make sure the remediation still works (installing autofs manually).

openshift-ci · 2024-02-06T04:23:37Z

@CoreyCook8: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.13-images
/test 4.14-images
/test 4.15-images
/test 4.16-images
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

CoreyCook8 · 2024-02-12T18:59:53Z

/retest

rhmdnd · 2024-02-12T19:53:05Z

/test

openshift-ci · 2024-02-12T19:53:09Z

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.13-e2e-aws-ocp4-cis
/test 4.13-e2e-aws-ocp4-cis-node
/test 4.13-e2e-aws-ocp4-e8
/test 4.13-e2e-aws-ocp4-high
/test 4.13-e2e-aws-ocp4-high-node
/test 4.13-e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate-node
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.13-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig-node
/test 4.13-e2e-aws-rhcos4-e8
/test 4.13-e2e-aws-rhcos4-high
/test 4.13-e2e-aws-rhcos4-moderate
/test 4.13-e2e-aws-rhcos4-stig
/test 4.13-images
/test 4.14-images
/test 4.15-e2e-aws-ocp4-cis
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-e8
/test 4.15-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high-node
/test 4.15-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate-node
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig-node
/test 4.15-e2e-aws-rhcos4-e8
/test 4.15-e2e-aws-rhcos4-high
/test 4.15-e2e-aws-rhcos4-moderate
/test 4.15-e2e-aws-rhcos4-stig
/test 4.15-images
/test 4.16-e2e-aws-ocp4-cis
/test 4.16-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-e8
/test 4.16-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high-node
/test 4.16-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate-node
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig-node
/test 4.16-e2e-aws-rhcos4-e8
/test 4.16-e2e-aws-rhcos4-high
/test 4.16-e2e-aws-rhcos4-moderate
/test 4.16-e2e-aws-rhcos4-stig
/test 4.16-images
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

rhmdnd · 2024-02-12T19:53:40Z

/test 4.15-e2e-aws-rhcos4-high

CoreyCook8 · 2024-02-29T18:40:44Z

/test 4.15-e2e-aws-rhcos4-high

CoreyCook8 · 2024-02-29T20:57:47Z

/test e2e-aws-rhcos4-high

CoreyCook8 · 2024-02-29T23:31:53Z

Hey @rhmdnd looks like we are passing the tests now

rhmdnd · 2024-03-06T22:41:19Z

@CoreyCook8 looks like some of the build tests are hung up. @Mab879 should we just rekick these?

CoreyCook8 · 2024-03-11T18:27:17Z

Any way I can help rekick those?

Mab879 · 2024-03-11T20:33:00Z

@CoreyCook8 looks like some of the build tests are hung up. @Mab879 should we just rekick these?

Sorry, I just saw this. First time contributors need approval for the CI to run. I just gave the approval.

@rhmdnd you should be able to do this as well.

github-actions · 2024-03-11T20:35:00Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11370
This image was built from commit: 2ebd379

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11370

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11370 make deploy-local

CoreyCook8 · 2024-03-13T17:01:05Z

@rhmdnd looks good to go?

yuumasato · 2024-03-15T11:28:58Z

@CoreyCook8 Hi, sorry for the delay, the changes look good to me.

But could you please remove the merge commits? One way to do it is to:

$ git rebase --onto master 49de0664014309054881de12e2b73993951849ce~1 a710b6f5fbfa6ad22145c283505d2ec5148c1238
$ git checkout -B patch-1 HEAD

…-shell_disabled/kubernetes directory Remove unnecessary kubernetes file

…bled/kubernetes directory

CoreyCook8 · 2024-03-18T15:24:10Z

👋 @yuumasato Look alright now?

yuumasato · 2024-03-20T23:57:57Z

/test e2e-aws-rhcos4-high

codeclimate · 2024-03-21T00:12:50Z

Code Climate has analyzed commit 2ebd379 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.3% (0.0% change).

View more on Code Climate.

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Dec 11, 2023

marcusburghardt added the Kubernetes Kubernetes remediation update. label Dec 12, 2023

marcusburghardt requested a review from rhmdnd January 8, 2024 13:42

rhmdnd added the ok-to-test Used by openshift-ci bot. label Feb 5, 2024

openshift-ci bot removed the needs-ok-to-test Used by openshift-ci bot. label Feb 5, 2024

rhmdnd requested a review from Vincent056 February 5, 2024 22:26

yuumasato self-assigned this Mar 15, 2024

CoreyCook8 added 3 commits March 15, 2024 11:54

Delete linux_os/guide/system/accounts/accounts-physical/service_debug…

44f53a8

…-shell_disabled/kubernetes directory Remove unnecessary kubernetes file

Delete linux_os/guide/system/permissions/mounting/service_autofs_disa…

8865608

…bled/kubernetes directory

Update 01-general.jinja

2ebd379

CoreyCook8 force-pushed the patch-1 branch from 5bc7067 to 2ebd379 Compare March 15, 2024 15:55

yuumasato added this to the 0.1.73 milestone Mar 26, 2024

yuumasato approved these changes Mar 26, 2024

View reviewed changes

yuumasato merged commit 5d2b664 into ComplianceAsCode:master Mar 26, 2024
45 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Remove kubernetes hardcoded solution for templated service_debug rules #11370

Remove kubernetes hardcoded solution for templated service_debug rules #11370

CoreyCook8 commented Dec 11, 2023 •

edited

Loading

openshift-ci bot commented Dec 11, 2023

github-actions bot commented Dec 11, 2023

CoreyCook8 commented Jan 2, 2024 •

edited

Loading

CoreyCook8 commented Jan 17, 2024

rhmdnd commented Feb 5, 2024

openshift-ci bot commented Feb 5, 2024

rhmdnd commented Feb 5, 2024

rhmdnd commented Feb 5, 2024

rhmdnd commented Feb 6, 2024

openshift-ci bot commented Feb 6, 2024

CoreyCook8 commented Feb 12, 2024

rhmdnd commented Feb 12, 2024

openshift-ci bot commented Feb 12, 2024

rhmdnd commented Feb 12, 2024

CoreyCook8 commented Feb 29, 2024

CoreyCook8 commented Feb 29, 2024

CoreyCook8 commented Feb 29, 2024

rhmdnd commented Mar 6, 2024

CoreyCook8 commented Mar 11, 2024

Mab879 commented Mar 11, 2024

github-actions bot commented Mar 11, 2024 •

edited

Loading

CoreyCook8 commented Mar 13, 2024

yuumasato commented Mar 15, 2024

CoreyCook8 commented Mar 18, 2024

yuumasato commented Mar 20, 2024

codeclimate bot commented Mar 21, 2024

Remove kubernetes hardcoded solution for templated service_debug rules #11370

Remove kubernetes hardcoded solution for templated service_debug rules #11370

Conversation

CoreyCook8 commented Dec 11, 2023 • edited Loading

Description:

Rationale:

openshift-ci bot commented Dec 11, 2023

github-actions bot commented Dec 11, 2023

CoreyCook8 commented Jan 2, 2024 • edited Loading

CoreyCook8 commented Jan 17, 2024

rhmdnd commented Feb 5, 2024

openshift-ci bot commented Feb 5, 2024

rhmdnd commented Feb 5, 2024

rhmdnd commented Feb 5, 2024

rhmdnd commented Feb 6, 2024

openshift-ci bot commented Feb 6, 2024

CoreyCook8 commented Feb 12, 2024

rhmdnd commented Feb 12, 2024

openshift-ci bot commented Feb 12, 2024

rhmdnd commented Feb 12, 2024

CoreyCook8 commented Feb 29, 2024

CoreyCook8 commented Feb 29, 2024

CoreyCook8 commented Feb 29, 2024

rhmdnd commented Mar 6, 2024

CoreyCook8 commented Mar 11, 2024

Mab879 commented Mar 11, 2024

github-actions bot commented Mar 11, 2024 • edited Loading

CoreyCook8 commented Mar 13, 2024

yuumasato commented Mar 15, 2024

CoreyCook8 commented Mar 18, 2024

yuumasato commented Mar 20, 2024

codeclimate bot commented Mar 21, 2024

CoreyCook8 commented Dec 11, 2023 •

edited

Loading

CoreyCook8 commented Jan 2, 2024 •

edited

Loading

github-actions bot commented Mar 11, 2024 •

edited

Loading