OCP4: Add container_security_operator_exists to PCIDSS profile

[Vincent056]

This pr adds container_security_operator_exists rule to PCI-DSS 4.0 6.3.2

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[github-actions]

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11776
This image was built from commit: 6dcc5bc

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11776

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11776 make deploy-local

[yuumasato]

The rule seems to align closer to 6.3.2.

It is not clear to me how the rule container_security_operator_exists supports requirements 8.6.1, 8.6.2 and 8.6.3.

[yuumasato]

@Vincent056 You got into a conflict with another PR of yours:
#11675

[Vincent056]

@yuumasato wondering if you have seen ValueError: Rule container_security_operator_exists contains pcidss4 reference, but this reference type is provided by pcidss_4 controls. Please remove the reference from rule.yml.

[yuumasato]

@yuumasato wondering if you have seen ValueError: Rule container_security_operator_exists contains pcidss4 reference, but this reference type is provided by pcidss_4 controls. Please remove the reference from rule.yml.

@Vincent056 Yes, It means that pcidss4 references are added by a control file.

content/controls/pcidss_4.yml

Line 8 in 593f865

reference_type: pcidss4

So you don't need to add the reference in the rule.
So you can probally add reference_type: pcidss4 to controls/pcidss_4_ocp4.yml, and it will work.
If not, the build system will need adjustments, and we can do that lataer.

[codeclimate]

Code Climate has analyzed commit 6dcc5bc and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.2% (0.0% change).

View more on Code Climate.

[yuumasato]

Merging.
This PR is just selecting a rule for OCP4 PCI-DSS.
There is no need to run profile remediations for rhel7, 8 and 9.