Add support to Ignition remediation type. #5137
Conversation
ggbecker
force-pushed
the
machine-config-remediation
branch
from
72cd978
to
85587c4
Compare
| @@ -77,6 +77,7 @@ selections: | |||
| #- sshd_set_keepalive | |||
| #- sshd_enable_warning_banner | |||
| #- sshd_rekey_limit | |||
|
|
|||
There was a problem hiding this comment.
nitpick: Unchaning change. But I'd rather not wait for Jenkins to test it again.
|
Nice! LGTM. 👍 |
| @@ -0,0 +1,18 @@ | |||
| # platform = multi_platform_all | |||
| apiVersion: machineconfiguration.openshift.io/v1 | |||
| kind: Ignition | |||
There was a problem hiding this comment.
The Kind should be "MachineConfig", not "Ignition".
Sorry, I know this is confusing. Ignition is the yaml-based language that is used under spec.config. But together with the other things, the spec makes up a "MachineConfig" Kubernetes type.
There was a problem hiding this comment.
Great work overall by the way. I'm testing the result with the operator now.
There was a problem hiding this comment.
It was actually a find-replace error. I will fix that.
There was a problem hiding this comment.
@jhrozek while OCP may aggregate these snippets into MachineConfig's, would it be reasonable to expect use cases where other Kubernetes distributions may take the Ignition scripts for other purposes?
Or in other words -- should these remain to be called Ignition scripts, and let downstreams such as OpenShift convert to product-specific terms like Machine Configs? Trying to avoid having remediation snippets for OCP vs Docker vs Pivotal vs Rancher if possible, by letting Ignition be the commonality between them.
There was a problem hiding this comment.
Right, if we were to keep this as ignition, we would then want to keep only from line 10 to 18. And remove the headers. Those should be handled by the compliance-operator as an implementation detail.
|
@ggbecker Code was reviewed and jenkins passed - this can be merged. To enable others to begin building remediation content this afternoon, what do you think about merging this now and having you update the namespace/naming back to ignition this afternoon? If agreeable, feel free to create a ticket to track the work and self-merge. |
I agree. The code part which enables the capability to use a new type of remediation is seems to correct. We just need to figure out what is the format of the remediation, eg. which kind of data is expected to be there. |
ggbecker
added
the
Highlight
Description:
How to generate the remediation meanwhile OpenSCAP doesn't support this specific type:
oscap xccdf generate fix --profile coreos-ncp --template urn:xccdf:fix:script:ignition build/ssg-ocp4-ds.xml