Add profile aliases for OpenShift versioned profiles #11241
Conversation
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
There was a problem hiding this comment.
In general LGTM.
@rhmdnd How about making the non-versioned profiles extend the versioned profiles in this PR? This way we ensure there is only one source of truth for the profiles, and don't risk missing changes.
So profile cis-node would extend cis-node-1.4.0, and when cis-node-1.5.0.profile exists, we just need to update the Profile title, description, and extends.
There was a problem hiding this comment.
I briefly tested that OpenSCAP is able to digest profiles with extra dots at the end.
SCAPVAL also seems accepts this ID as valid, not that we care that much about for OCP content, but it is good to know.
rhmdnd
force-pushed
the
ocp-profile-version-aliases
branch
from
0232cd5
to
6e84fcc
Compare
Good suggestion. I noticed I couldn't supply a list of profiles where we have a single profile that extends multiple. Also - the |
I have filed #11268 to overcome this limitation and avoid repeating ourselves. |
The PR is merged, the non-versioned profiles can now have no |
rhmdnd
force-pushed
the
ocp-profile-version-aliases
branch
from
6e84fcc
to
f72e0c0
Compare
Thanks for this. I removed the I'm still curious about setting |
|
OCP CI should look better after ComplianceAsCode/compliance-operator#485 merges. |
|
/test e2e-aws-ocp4-cis |
|
/test e2e-aws-ocp4-cis |
|
Latest CIS runs failed because we're waiting on #11207 to merge, but that's blocked on testing farm failures we're still investigating. |
rhmdnd
force-pushed
the
ocp-profile-version-aliases
branch
from
6dc5dd8
to
a883395
Compare
|
Rebased to see if we can get a better CI run with the fixes from 11207. |
|
/test e2e-aws-ocp4-cis |
|
@rhmdnd Not sure if I am testing it in a correct way. I create a new profile.compliance manually but the suite using it will stuck at LAUNCHING phase. Could you please help to check? Thanks.
|
|
Sorry, above is a naming rule issue. Use a name "upstream-ocp4-cis-1-4-0" instead, it works. |
|
/unhold |
We've implement profile versioning for some of the OpenShift and RHCOS profiles. However, users that have ScanSettingBindings that reference profiles like `ocp4-cis` can still be affected by rolling updates to that profile. For example, when we implement support for CIS OpenShift 1.5.0, the `ocp4-cis` profile will automatically update to the rules for that profile. This is how we've historically maintained profiles. Now that we have a versioning mechanism and we're using it, we can give users the ability to pin to a specific version of a profile. This commit extends the profiles and names them according to their version. When a user wants to pin to a specific version of a profile, they can use `ocp4-cis-1-4` to run only the CIS OpenShift 1.4.0 rules, and they won't be affected by changes that implement the 1.5.0 profile when that is supported. This change doesn't change the functionality of the operator or the profiles, but gives users more flexibility for pinning to specific profile versions.
rhmdnd
force-pushed
the
ocp-profile-version-aliases
branch
from
a883395
to
9296538
Compare
|
/hold for retest |
|
/test e2e-aws-ocp4-cis |
|
Code Climate has analyzed commit 9296538 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 58.5%. View more on Code Climate. |
|
Green OCP4 CIS run, kicking off the rest of the tests. /test e2e-aws-ocp4-e8 |
|
/test e2e-aws-rhcos4-e8 |
|
/retest |
|
@rhmdnd: The following tests failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
|
Verification pass with 4.15.0-0.nightly-2023-11-28-101923 + content in the PR: |
|
Looks like the following rules are failing on the second and third scans: |
These failures are being tracked in https://issues.redhat.com/browse/OCPBUGS-19690 and are unrelated to the changes in this PR. |
|
/unhold |
We've implement profile versioning for some of the OpenShift and RHCOS
profiles. However, users that have ScanSettingBindings that reference
profiles like
ocp4-ciscan still be affected by rolling updates tothat profile. For example, when we implement support for CIS OpenShift
1.5.0, the
ocp4-cisprofile will automatically update to the rules forthat profile. This is how we've historically maintained profiles.
Now that we have a versioning mechanism and we're using it, we can give
users the ability to pin to a specific version of a profile.
This commit duplicates the profiles and names them according to their
version. When a user wants to pin to a specific version of a profile,
they can use
ocp4-cis-1.4.0to run only the CIS OpenShift 1.4.0rules, and they won't be affected by changes that implement the 1.5.0
profile when that is supported.
This change doesn't change the functionality of the operator or the
profiles, but gives users more flexibility for pinning to specific
profile versions.