CMP-2456: PCI-DSS v4 Requirement 4 #12002

yuumasato · 2024-05-16T16:21:14Z

Description:

4.1 is not applicable
Documentation and processes are not be created and maintained at in OpenShift.
4.2 is partially applicable
While OCP uses and can provide support for secure cryptography and protocols, the application / workload needs correctly to leverage them.

github-actions · 2024-05-16T16:22:46Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

github-actions · 2024-05-16T16:26:04Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12002
This image was built from commit: 00cfb09

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12002

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12002 make deploy-local

controls/pcidss_4_ocp4.yml

rhmdnd · 2024-05-23T22:54:54Z

/test

openshift-ci · 2024-05-23T22:54:57Z

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.13-e2e-aws-ocp4-bsi
/test 4.13-e2e-aws-ocp4-bsi-node
/test 4.13-e2e-aws-ocp4-cis
/test 4.13-e2e-aws-ocp4-cis-node
/test 4.13-e2e-aws-ocp4-e8
/test 4.13-e2e-aws-ocp4-high
/test 4.13-e2e-aws-ocp4-high-node
/test 4.13-e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate-node
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.13-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig-node
/test 4.13-e2e-aws-rhcos4-bsi
/test 4.13-e2e-aws-rhcos4-e8
/test 4.13-e2e-aws-rhcos4-high
/test 4.13-e2e-aws-rhcos4-moderate
/test 4.13-e2e-aws-rhcos4-stig
/test 4.13-images
/test 4.14-e2e-aws-ocp4-bsi
/test 4.14-e2e-aws-ocp4-bsi-node
/test 4.14-e2e-aws-rhcos4-bsi
/test 4.14-images
/test 4.15-e2e-aws-ocp4-bsi
/test 4.15-e2e-aws-ocp4-bsi-node
/test 4.15-e2e-aws-ocp4-cis
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-e8
/test 4.15-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high-node
/test 4.15-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate-node
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig-node
/test 4.15-e2e-aws-rhcos4-bsi
/test 4.15-e2e-aws-rhcos4-e8
/test 4.15-e2e-aws-rhcos4-high
/test 4.15-e2e-aws-rhcos4-moderate
/test 4.15-e2e-aws-rhcos4-stig
/test 4.15-e2e-rosa-ocp4-cis-node
/test 4.15-e2e-rosa-ocp4-pci-dss-node
/test 4.15-images
/test 4.16-e2e-aws-ocp4-bsi
/test 4.16-e2e-aws-ocp4-bsi-node
/test 4.16-e2e-aws-ocp4-cis
/test 4.16-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-e8
/test 4.16-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high-node
/test 4.16-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate-node
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig-node
/test 4.16-e2e-aws-rhcos4-bsi
/test 4.16-e2e-aws-rhcos4-e8
/test 4.16-e2e-aws-rhcos4-high
/test 4.16-e2e-aws-rhcos4-moderate
/test 4.16-e2e-aws-rhcos4-stig
/test 4.16-images
/test e2e-aws-ocp4-bsi
/test e2e-aws-ocp4-bsi-node
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-bsi
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

rhmdnd · 2024-05-23T22:55:32Z

Kicking the tires on some new CI we have for ROSA:

/test 4.15-e2e-rosa-ocp4-cis-node
/test 4.15-e2e-rosa-ocp4-pci-dss-node

xiaojiey · 2024-05-27T05:57:29Z

/hold for test

xiaojiey · 2024-05-30T08:38:35Z

/unhold

rhmdnd

Overall looks good to me. Just one question on if we need to include a couple additional rules for encrypting network traffic.

rhmdnd

Looks good to me. I'll keep my comment open since @xiaojiey has a valid question there, too.

yuumasato · 2024-06-10T12:47:48Z

Following my comment on #12002 (comment) I have removed the etcd_check_cipher_suite.

xiaojiey · 2024-06-11T06:14:15Z

/retest

xiaojiey · 2024-06-11T06:18:55Z

/lgtm

openshift-ci · 2024-06-11T06:21:38Z

@yuumasato: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.15-e2e-rosa-ocp4-cis-node	`997b24c`	link	true	`/test 4.15-e2e-rosa-ocp4-cis-node`
ci/prow/4.15-e2e-rosa-ocp4-pci-dss-node	`997b24c`	link	true	`/test 4.15-e2e-rosa-ocp4-pci-dss-node`

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

xiaojiey · 2024-06-11T06:56:42Z

Following my comment on #12002 (comment) I have removed the etcd_check_cipher_suite.

@yuumasato I noticed this error in the ci jobs. Do we need to drop this rule?
ValueError: Control pcidss_4_ocp4:4.2.1 contains nonexisting rule(s) api_server_tls_cipher_suite

yuumasato · 2024-06-11T08:27:52Z

api_server_tls_cipher_suite

@xiaojiey There was a typo in the rule. Should be fixed now.

xiaojiey · 2024-06-11T09:16:53Z

/lgtm

yuumasato · 2024-06-11T15:20:14Z

Rebased on top of latest master.

This req is defining processes and creating documentation.

OpenShift uses and provides strong cryptography and secure protocols, but it is still up to the applications to leverage them.

- Add api_server_tls_cert rule - Tweak note on requirement 4.2.1

The rule api_server_tls_security_profile sets up a custom security profile, without specifying ciphers. So we also need to select api_server_tls_security_profile. Removing etcd cipher rule, it is not related to transission on public networks.

codeclimate · 2024-06-19T13:42:40Z

Code Climate has analyzed commit 00cfb09 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

yuumasato · 2024-06-19T15:16:17Z

@rhmdnd @Vincent056 CI is happy now, :)

rhmdnd

/lgtm

yuumasato added the OpenShift OpenShift product related. label May 16, 2024

yuumasato requested review from Vincent056 and rhmdnd May 16, 2024 16:21

yuumasato commented May 21, 2024

View reviewed changes

controls/pcidss_4_ocp4.yml Outdated Show resolved Hide resolved

openshift-ci bot added the do-not-merge/hold Used by openshift-ci-robot bot. label May 27, 2024

openshift-ci bot removed the do-not-merge/hold Used by openshift-ci-robot bot. label May 30, 2024

rhmdnd reviewed Jun 3, 2024

View reviewed changes

rhmdnd added the pci-dss label Jun 5, 2024

yuumasato requested a review from rhmdnd June 6, 2024 16:56

rhmdnd reviewed Jun 7, 2024

View reviewed changes

yuumasato force-pushed the pcidss_4_req_4 branch from 7fd6368 to b8bb32d Compare June 11, 2024 08:27

yuumasato force-pushed the pcidss_4_req_4 branch from b8bb32d to f855af6 Compare June 11, 2024 15:19

yuumasato added 3 commits June 19, 2024 14:56

CMP-2456: Requirement 4.1 is not applicable

b214f11

This req is defining processes and creating documentation.

CMP-2456: Requirement 4.2 is partial

0f707bf

OpenShift uses and provides strong cryptography and secure protocols, but it is still up to the applications to leverage them.

Adjust PCI-DSS 4.2.1

f22b4c0

- Add api_server_tls_cert rule - Tweak note on requirement 4.2.1

Add tls_cipher_suite, drop etcd cihper rule

00cfb09

The rule api_server_tls_security_profile sets up a custom security profile, without specifying ciphers. So we also need to select api_server_tls_security_profile. Removing etcd cipher rule, it is not related to transission on public networks.

yuumasato force-pushed the pcidss_4_req_4 branch from f855af6 to 00cfb09 Compare June 19, 2024 12:56

rhmdnd approved these changes Jun 20, 2024

View reviewed changes

rhmdnd merged commit 8ff6232 into ComplianceAsCode:master Jun 20, 2024
92 of 93 checks passed

Mab879 added this to the 0.1.74 milestone Jun 20, 2024

Mab879 added the Update Profile Issues or pull requests related to Profiles updates. label Jun 20, 2024

yuumasato deleted the pcidss_4_req_4 branch June 21, 2024 13:21

yuumasato assigned rhmdnd Jun 21, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CMP-2456: PCI-DSS v4 Requirement 4 #12002

CMP-2456: PCI-DSS v4 Requirement 4 #12002

yuumasato commented May 16, 2024

github-actions bot commented May 16, 2024

github-actions bot commented May 16, 2024 •

edited

Loading

rhmdnd commented May 23, 2024

openshift-ci bot commented May 23, 2024

rhmdnd commented May 23, 2024

xiaojiey commented May 27, 2024

xiaojiey commented May 30, 2024

rhmdnd left a comment

rhmdnd left a comment

yuumasato commented Jun 10, 2024

xiaojiey commented Jun 11, 2024

xiaojiey commented Jun 11, 2024

openshift-ci bot commented Jun 11, 2024 •

edited

Loading

xiaojiey commented Jun 11, 2024

yuumasato commented Jun 11, 2024

xiaojiey commented Jun 11, 2024

yuumasato commented Jun 11, 2024

codeclimate bot commented Jun 19, 2024

yuumasato commented Jun 19, 2024

rhmdnd left a comment

CMP-2456: PCI-DSS v4 Requirement 4 #12002

CMP-2456: PCI-DSS v4 Requirement 4 #12002

Conversation

yuumasato commented May 16, 2024

Description:

github-actions bot commented May 16, 2024

github-actions bot commented May 16, 2024 • edited Loading

rhmdnd commented May 23, 2024

openshift-ci bot commented May 23, 2024

rhmdnd commented May 23, 2024

xiaojiey commented May 27, 2024

xiaojiey commented May 30, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

rhmdnd left a comment

Choose a reason for hiding this comment

yuumasato commented Jun 10, 2024

xiaojiey commented Jun 11, 2024

xiaojiey commented Jun 11, 2024

openshift-ci bot commented Jun 11, 2024 • edited Loading

xiaojiey commented Jun 11, 2024

yuumasato commented Jun 11, 2024

xiaojiey commented Jun 11, 2024

yuumasato commented Jun 11, 2024

codeclimate bot commented Jun 19, 2024

yuumasato commented Jun 19, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

github-actions bot commented May 16, 2024 •

edited

Loading

openshift-ci bot commented Jun 11, 2024 •

edited

Loading