OCPBUGS-3344: fetchraw: Lock down the PVCExtractorPod

[jhrozek]

This would comply with security policies, although it's mostly academical, because the openshift-compliance namespace must be privileged in order for scans to run. Still, better lock down all we can..

[openshift-ci-robot]

@jhrozek: This pull request references Jira Issue OCPBUGS-3344, which is invalid:

• expected the bug to target the "4.13.0" version, but no target version was set

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

This would comply with security policies, although it's mostly academical, because the openshift-compliance namespace must be privileged in order for scans to run. Still, better lock down all we can..

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[jhrozek]

/jira refresh

[openshift-ci-robot]

@jhrozek: This pull request references Jira Issue OCPBUGS-3344, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

• bug is open, matching expected state (open)
• bug target version (4.13.0) matches configured target version for branch (4.13.0)
• bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @xiaojiey

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

@JAORMX: changing LGTM is restricted to collaborators

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[BhargaviGudi]

/hold for QE review

[BhargaviGudi]

Verification PASS with OpenShift 4.13.0-0.nightly-2023-02-03-145213
Compliance operator bundle v0.1.60

[bgudi@bgudi openshift]$ oc create -f createComplianceOperator.yaml 
catalogsource.operators.coreos.com/compliance-operator created
namespace/openshift-compliance created
operatorgroup.operators.coreos.com/openshift-compliance-abcd created
subscription.operators.coreos.com/openshift-compliance-operator created
[bgudi@bgudi oc-compliance]$ ./bin/oc-compliance bind -N test -S default profile/ocp4-cis
Creating ScanSettingBinding test
[bgudi@bgudi oc-compliance]$ oc get ssb -n openshift-compliance 
NAME   AGE
test   99s
[bgudi@bgudi oc-compliance]$ oc get suite -n openshift-compliance 
NAME   PHASE   RESULT
test   DONE    NON-COMPLIANT
[bgudi@bgudi oc-compliance]$ oc get scan -n openshift-compliance 
NAME       PHASE   RESULT
ocp4-cis   DONE    NON-COMPLIANT
[bgudi@bgudi oc-compliance]$ oc get pods -n openshift-compliance 
NAME                                              READY   STATUS    RESTARTS      AGE
compliance-operator-fb7bb6f5f-wxdrz               1/1     Running   1 (86m ago)   86m
ocp4-openshift-compliance-pp-86c767b5b8-87bmj     1/1     Running   0             86m
rhcos4-openshift-compliance-pp-844989b8c4-dz878   1/1     Running   0             86m

[bgudi@bgudi oc-compliance]$ ./bin/oc-compliance fetch-raw scansettingbinding test -o /tmp/
Fetching results for test scans: ocp4-cis
W0206 18:55:29.854684  571616 warnings.go:70] would violate PodSecurity "restricted:latest": runAsNonRoot != true (container "pv-extract-pod" must not set securityContext.runAsNonRoot=false)
Fetching raw compliance results for pod 'raw-result-extractor-7sxdw'.Fetching raw compliance results for scan 'ocp4-cis'........
The raw compliance results are avaliable in the following directory: /tmp/ocp4-cis
[bgudi@bgudi oc-compliance]$ ls /tmp/ocp4-cis
ocp4-cis-api-checks-pod.xml.bzip2
[bgudi@bgudi ocp4-cis]$ bunzip2 ocp4-cis-api-checks-pod.xml.bzip2
bunzip2: Can't guess original name for ocp4-cis-api-checks-pod.xml.bzip2 -- using ocp4-cis-api-checks-pod.xml.bzip2.out
[bgudi@bgudi ocp4-cis]$ ls -ltr
total 6608
-rw-rw-r--. 1 bgudi bgudi 6500898 Feb  6 18:55 ocp4-cis-api-checks-pod.xml.bzip2.out
-rw-rw-r--. 1 bgudi bgudi  260412 Feb  6 19:20 ocp4-cis-api-checks-pod.xml
[bgudi@bgudi ocp4-cis]$ head ocp4-cis-api-checks-pod.xml.bzip2.out
<?xml version="1.0" encoding="UTF-8"?>
<arf:asset-report-collection xmlns:arf="http://scap.nist.gov/schema/asset-reporting-format/1.1" xmlns:core="http://scap.nist.gov/schema/reporting-core/1.1" xmlns:ai="http://scap.nist.gov/schema/asset-identification/1.1">
  <core:relationships xmlns:arfvocab="http://scap.nist.gov/specifications/arf/vocabulary/relationships/1.0#">
    <core:relationship type="arfvocab:createdFor" subject="xccdf1">
      <core:ref>collection1</core:ref>
    </core:relationship>
    <core:relationship type="arfvocab:isAbout" subject="xccdf1">
      <core:ref>asset0</core:ref>
    </core:relationship>
  </core:relationships>

[BhargaviGudi]

/label qe-approved

[BhargaviGudi]

/unhold

[jhrozek]

This should now pass CI since we bumped the deps

[openshift-bot]

Issues go stale after 90d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle stale

[openshift-bot]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh by commenting /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
Exclude this issue from closing by commenting /lifecycle frozen.

If this issue is safe to close now please do so with /close.

/lifecycle rotten
/remove-lifecycle stale

[jhrozek]

/remove-lifecycle rotten

[Vincent056]

/lgtm

[openshift-ci-robot]

@jhrozek: Jira Issue OCPBUGS-3344: All pull requests linked via external trackers have merged:

• openshift/oc-compliance#223

Jira Issue OCPBUGS-3344 has been moved to the MODIFIED state.

In response to this:

This would comply with security policies, although it's mostly academical, because the openshift-compliance namespace must be privileged in order for scans to run. Still, better lock down all we can..

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JAORMX, jhrozek, Vincent056

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [Vincent056]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[openshift-ci]

@jhrozek: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e	a571527	link	true	/test e2e

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.