Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 (Splitted into 3 PRs) #11659

Conversation

benruland
Copy link
Contributor

Description:
Notes / Rules for BSI APP4.4.A17 - APP4.4.A19 added.

Rationale:
As we have multiple customers asking for a BSI profile to be included in the compliance-operator, we are contributing a profile. To provide a better review process, the individual controle are implemented as separate PRs.

@benruland benruland marked this pull request as draft March 6, 2024 16:13
@openshift-ci openshift-ci bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Mar 6, 2024
Copy link

openshift-ci bot commented Mar 6, 2024

Hi @benruland. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Copy link

github-actions bot commented Mar 6, 2024

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff
New content has different text for rule 'xccdf_org.ssgproject.content_rule_cluster_version_operator_exists'.
--- xccdf_org.ssgproject.content_rule_cluster_version_operator_exists
+++ xccdf_org.ssgproject.content_rule_cluster_version_operator_exists
@@ -21,6 +21,9 @@
     file.
 
 [reference]:
+APP.4.4.A17
+
+[reference]:
 SA-10(1)
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_cluster_version_operator_verify_integrity'.
--- xccdf_org.ssgproject.content_rule_cluster_version_operator_verify_integrity
+++ xccdf_org.ssgproject.content_rule_cluster_version_operator_verify_integrity
@@ -18,6 +18,9 @@
     file.
 
 [reference]:
+APP.4.4.A17
+
+[reference]:
 SA-10(1)
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_integrity_exists'.
--- xccdf_org.ssgproject.content_rule_file_integrity_exists
+++ xccdf_org.ssgproject.content_rule_file_integrity_exists
@@ -12,6 +12,9 @@
 [warning]:
 This rule's check operates on the cluster configuration dump.
 Therefore, you need to use a tool that can query the OCP API, retrieve the /apis/fileintegrity.openshift.io/v1alpha1/fileintegrities?limit=5 API endpoint to the local /apis/fileintegrity.openshift.io/v1alpha1/fileintegrities?limit=5 file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_client_ca'.
--- xccdf_org.ssgproject.content_rule_api_server_client_ca
+++ xccdf_org.ssgproject.content_rule_api_server_client_ca
@@ -27,6 +27,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#d56e72c377d8f85e0601a704d4218064a0ea4a2235ceee82d20db6cdafc74608
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_https_for_kubelet_conn'.
--- xccdf_org.ssgproject.content_rule_api_server_https_for_kubelet_conn
+++ xccdf_org.ssgproject.content_rule_api_server_https_for_kubelet_conn
@@ -16,6 +16,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#54842ba5cf821644f2727625c1518eba2de6e6b7ae318043d0bf7ccc9570e430
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_kubelet_client_cert'.
--- xccdf_org.ssgproject.content_rule_api_server_kubelet_client_cert
+++ xccdf_org.ssgproject.content_rule_api_server_kubelet_client_cert
@@ -23,6 +23,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#e5500055b4aa2fcf00dc09ad0e66e44b6b42d67f8d53d1e72ff81b32f0e09865
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_kubelet_client_key'.
--- xccdf_org.ssgproject.content_rule_api_server_kubelet_client_key
+++ xccdf_org.ssgproject.content_rule_api_server_kubelet_client_key
@@ -23,6 +23,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#1e2b7c1158e0b9a602cb20d62c82b4660907bb57b63dac11c6c7c64211c49c69
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_tls_cert'.
--- xccdf_org.ssgproject.content_rule_api_server_tls_cert
+++ xccdf_org.ssgproject.content_rule_api_server_tls_cert
@@ -26,6 +26,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#bca394347bab5b9902f1d1568d4f5d6e5498b01ec27ddf8231443e376b18757d
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_tls_cipher_suites'.
--- xccdf_org.ssgproject.content_rule_api_server_tls_cipher_suites
+++ xccdf_org.ssgproject.content_rule_api_server_tls_cipher_suites
@@ -35,6 +35,9 @@
 server.
 
 [reference]:
+APP.4.4.A17
+
+[reference]:
 CM-6
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_tls_private_key'.
--- xccdf_org.ssgproject.content_rule_api_server_tls_private_key
+++ xccdf_org.ssgproject.content_rule_api_server_tls_private_key
@@ -26,6 +26,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#8c69c1fe6742f70a3a16c09461f57a19ef2a695143301cede2f2f5d307aa3508
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_integrity_notification_enabled'.
--- xccdf_org.ssgproject.content_rule_file_integrity_notification_enabled
+++ xccdf_org.ssgproject.content_rule_file_integrity_notification_enabled
@@ -16,6 +16,9 @@
     and persist it to the local
     /apis/monitoring.coreos.com/v1/prometheusrules#dda8d6e19f5a89264301ce56ece4df115a14d8a85e3ae6bd3cd8eccd234252c5
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 SI-6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_tls_version_check_apiserver'.
--- xccdf_org.ssgproject.content_rule_tls_version_check_apiserver
+++ xccdf_org.ssgproject.content_rule_tls_version_check_apiserver
@@ -16,6 +16,9 @@
     file.
 
 [reference]:
+APP.4.4.A17
+
+[reference]:
 Req-4.1
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_client_ca'.
--- xccdf_org.ssgproject.content_rule_kubelet_configure_client_ca
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_client_ca
@@ -15,6 +15,9 @@
   x509:
     clientCAFile: /etc/kubernetes/kubelet-ca.crt
 ...
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cert'.
--- xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cert
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cert
@@ -17,6 +17,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#e5500055b4aa2fcf00dc09ad0e66e44b6b42d67f8d53d1e72ff81b32f0e09865
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cipher_suites'.
--- xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cipher_suites
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_tls_cipher_suites
@@ -29,6 +29,9 @@
 and var_kubelet_tls_cipher_suites have to be set
 
 [reference]:
+APP.4.4.A17
+
+[reference]:
 CIP-003-8 R6
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_tls_key'.
--- xccdf_org.ssgproject.content_rule_kubelet_configure_tls_key
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_tls_key
@@ -17,6 +17,9 @@
     and persist it to the local
     /api/v1/namespaces/openshift-kube-apiserver/configmaps/config#1e2b7c1158e0b9a602cb20d62c82b4660907bb57b63dac11c6c7c64211c49c69
     file.
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R4.2

New content has different text for rule 'xccdf_org.ssgproject.content_rule_kubelet_configure_tls_min_version'.
--- xccdf_org.ssgproject.content_rule_kubelet_configure_tls_min_version
+++ xccdf_org.ssgproject.content_rule_kubelet_configure_tls_min_version
@@ -51,6 +51,9 @@
 the relevant documentation.
 
 [reference]:
+APP.4.4.A17
+
+[reference]:
 SC-8
 
 [reference]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_network_policies'.
--- xccdf_org.ssgproject.content_rule_configure_network_policies
+++ xccdf_org.ssgproject.content_rule_configure_network_policies
@@ -19,7 +19,10 @@
     file.
 
 [reference]:
-APP.4.4.A7
+APP.4.4.7
+
+[reference]:
+APP.4.4.A18
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces'.
--- xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces
+++ xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces
@@ -23,6 +23,9 @@
 
 [reference]:
 APP.4.4.A7
+
+[reference]:
+APP.4.4.A18
 
 [reference]:
 CIP-003-8 R4

New content has different text for rule 'xccdf_org.ssgproject.content_rule_project_template_network_policy'.
--- xccdf_org.ssgproject.content_rule_project_template_network_policy
+++ xccdf_org.ssgproject.content_rule_project_template_network_policy
@@ -19,6 +19,9 @@
     file.
 
 [reference]:
+APP.4.4.A18
+
+[reference]:
 SRG-APP-000039-CTR-000110
 
 [rationale]:

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_kubelet_conf'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_kubelet_conf
+++ xccdf_org.ssgproject.content_rule_file_groupowner_kubelet_conf
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the group owner of /etc/kubernetes/kubelet.conf, run the command: $ sudo chgrp root /etc/kubernetes/kubelet.conf
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_worker_ca'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_worker_ca
+++ xccdf_org.ssgproject.content_rule_file_groupowner_worker_ca
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the group owner of /etc/kubernetes/kubelet-ca.crt, run the command: $ sudo chgrp root /etc/kubernetes/kubelet-ca.crt
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_worker_kubeconfig'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_worker_kubeconfig
+++ xccdf_org.ssgproject.content_rule_file_groupowner_worker_kubeconfig
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the group owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chgrp root /var/lib/kubelet/kubeconfig
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_groupowner_worker_service'.
--- xccdf_org.ssgproject.content_rule_file_groupowner_worker_service
+++ xccdf_org.ssgproject.content_rule_file_groupowner_worker_service
@@ -6,6 +6,9 @@
 '
   To properly set the group owner of /etc/systemd/system/kubelet.service, run the command:
   $ sudo chgrp root /etc/systemd/system/kubelet.service'
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_kubelet'.
--- xccdf_org.ssgproject.content_rule_file_owner_kubelet
+++ xccdf_org.ssgproject.content_rule_file_owner_kubelet
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the owner of /var/lib/kubelet/config.json, run the command: $ sudo chown root /var/lib/kubelet/config.json
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_kubelet_conf'.
--- xccdf_org.ssgproject.content_rule_file_owner_kubelet_conf
+++ xccdf_org.ssgproject.content_rule_file_owner_kubelet_conf
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the owner of /etc/kubernetes/kubelet.conf, run the command: $ sudo chown root /etc/kubernetes/kubelet.conf
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_worker_ca'.
--- xccdf_org.ssgproject.content_rule_file_owner_worker_ca
+++ xccdf_org.ssgproject.content_rule_file_owner_worker_ca
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the owner of /etc/kubernetes/kubelet-ca.crt, run the command: $ sudo chown root /etc/kubernetes/kubelet-ca.crt
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_worker_kubeconfig'.
--- xccdf_org.ssgproject.content_rule_file_owner_worker_kubeconfig
+++ xccdf_org.ssgproject.content_rule_file_owner_worker_kubeconfig
@@ -4,6 +4,9 @@
 
 [description]:
 To properly set the owner of /var/lib/kubelet/kubeconfig, run the command: $ sudo chown root /var/lib/kubelet/kubeconfig
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_owner_worker_service'.
--- xccdf_org.ssgproject.content_rule_file_owner_worker_service
+++ xccdf_org.ssgproject.content_rule_file_owner_worker_service
@@ -6,6 +6,9 @@
 '
   To properly set the owner of /etc/systemd/system/kubelet.service, run the command:
   $ sudo chown root /etc/systemd/system/kubelet.service '
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_kubelet'.
--- xccdf_org.ssgproject.content_rule_file_permissions_kubelet
+++ xccdf_org.ssgproject.content_rule_file_permissions_kubelet
@@ -5,6 +5,9 @@
 [description]:
 To properly set the permissions of /var/lib/kubelet/config.json, run the command:
 $ sudo chmod 0600 /var/lib/kubelet/config.json
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_kubelet_conf'.
--- xccdf_org.ssgproject.content_rule_file_permissions_kubelet_conf
+++ xccdf_org.ssgproject.content_rule_file_permissions_kubelet_conf
@@ -5,6 +5,9 @@
 [description]:
 To properly set the permissions of /etc/kubernetes/kubelet.conf, run the command:
 $ sudo chmod 0644 /etc/kubernetes/kubelet.conf
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_worker_ca'.
--- xccdf_org.ssgproject.content_rule_file_permissions_worker_ca
+++ xccdf_org.ssgproject.content_rule_file_permissions_worker_ca
@@ -5,6 +5,9 @@
 [description]:
 To properly set the permissions of /etc/kubernetes/kubelet-ca.crt, run the command:
 $ sudo chmod 0644 /etc/kubernetes/kubelet-ca.crt
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_worker_kubeconfig'.
--- xccdf_org.ssgproject.content_rule_file_permissions_worker_kubeconfig
+++ xccdf_org.ssgproject.content_rule_file_permissions_worker_kubeconfig
@@ -5,6 +5,9 @@
 [description]:
 To properly set the permissions of /var/lib/kubelet/kubeconfig, run the command:
 $ sudo chmod 0600 /var/lib/kubelet/kubeconfig
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_file_permissions_worker_service'.
--- xccdf_org.ssgproject.content_rule_file_permissions_worker_service
+++ xccdf_org.ssgproject.content_rule_file_permissions_worker_service
@@ -5,6 +5,9 @@
 [description]:
 To properly set the permissions of /etc/systemd/system/kubelet.service, run the command:
 $ sudo chmod 0644 /etc/systemd/system/kubelet.service
+
+[reference]:
+APP.4.4.A17
 
 [reference]:
 CIP-003-8 R6

Copy link

github-actions bot commented Mar 6, 2024

Start a new ephemeral environment with changes proposed in this pull request:

ocp4 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Copy link

github-actions bot commented Mar 6, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11659
This image was built from commit: c660330

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11659

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11659 make deploy-local

Copy link
Contributor

@sluetze sluetze left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@benruland this one is a biggy. I think the only mandatory change is the doubled bsi: reference and the partial/automated state. lets discuss the other points.

controls/bsi_app_4_4.yml Outdated Show resolved Hide resolved
controls/bsi_app_4_4.yml Outdated Show resolved Hide resolved
controls/bsi_app_4_4.yml Outdated Show resolved Hide resolved
@benruland
Copy link
Contributor Author

In the future, for APP.4.4.18, we might need to also look at AdminNetworkPolicy, currently in TechPreviewNoUpgrade state.

@marcusburghardt marcusburghardt added the OpenShift OpenShift product related. label Apr 18, 2024
@yuumasato yuumasato self-assigned this May 15, 2024
@yuumasato
Copy link
Member

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Used by openshift-ci bot. and removed needs-ok-to-test Used by openshift-ci bot. labels May 22, 2024
@yuumasato
Copy link
Member

/test e2e-aws-ocp4-bsi
/test e2e-aws-ocp4-bsi-node
/test e2e-aws-rhcos4-bsi

@benruland benruland marked this pull request as ready for review July 15, 2024 10:48
@openshift-ci openshift-ci bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 15, 2024
@benruland
Copy link
Contributor Author

benruland commented Jul 15, 2024

@sluetze @ermeratos, I am finished content-wise. Please have a look.
@yuumasato A lot of tests are failing but I am unsure if this is expected. Could you also have a look?

I know this is a big MR with a couple of new rules. The majority of new lines is, however, produced by test cases.

@benruland benruland closed this Jul 15, 2024
@benruland benruland changed the title Draft: Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 Jul 15, 2024
@benruland
Copy link
Contributor Author

I accidentially reset the branch to the master branch and removed all my commits. I have just re-added them and will re-open this PR as soon as GitHub notices them

@benruland
Copy link
Contributor Author

I was unable to reopen the PR and split up the changes into 3 PRs for better reviewability

@benruland benruland changed the title Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 Splitted into 3 PRs: Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 Jul 15, 2024
@benruland benruland changed the title Splitted into 3 PRs: Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 Defined notes and rules for control BSI APP4.4.A17 - APP4.4.A19 (Splitted into 3 PRs) Jul 15, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ok-to-test Used by openshift-ci bot. OpenShift OpenShift product related.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants