Add PCI-DSS v4.0 assertion files #12311

yuumasato · 2024-08-16T14:19:29Z

Description:

Assertion files for pci-dss-4-0 and pci-dss-node-4-0 on ocp > 4.12
Enable the following rules on 4.17:
- api_server_kubelet_client_cert
- api_server_kubelet_client_key
- kubelet_configure_tls_cert
- kubelet_configure_tls_key

Rationale:

These asssertion files ensure the profile results are not drifting without us noticing.

Notes

Some assertion files are misssing, they will added in this PR briefly.

github-actions · 2024-08-16T14:20:55Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

github-actions · 2024-08-16T15:17:38Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12311
This image was built from commit: efc1483

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12311

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12311 make deploy-local

yuumasato · 2024-08-16T16:16:58Z

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.14-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.15-e2e-aws-ocp4-pci-dss-node-4-0

rhmdnd

/lgtm

rhmdnd · 2024-08-16T16:37:12Z

/test

openshift-ci · 2024-08-16T16:37:15Z

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.12-e2e-aws-ocp4-cis
/test 4.12-e2e-aws-ocp4-cis-node
/test 4.12-e2e-aws-ocp4-e8
/test 4.12-e2e-aws-ocp4-high
/test 4.12-e2e-aws-ocp4-high-node
/test 4.12-e2e-aws-ocp4-moderate
/test 4.12-e2e-aws-ocp4-moderate-node
/test 4.12-e2e-aws-ocp4-pci-dss
/test 4.12-e2e-aws-ocp4-pci-dss-4-0
/test 4.12-e2e-aws-ocp4-pci-dss-node
/test 4.12-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.12-e2e-aws-ocp4-stig
/test 4.12-e2e-aws-ocp4-stig-node
/test 4.12-e2e-aws-rhcos4-e8
/test 4.12-e2e-aws-rhcos4-high
/test 4.12-e2e-aws-rhcos4-moderate
/test 4.12-e2e-aws-rhcos4-stig
/test 4.12-images
/test 4.13-e2e-aws-ocp4-bsi
/test 4.13-e2e-aws-ocp4-bsi-node
/test 4.13-e2e-aws-ocp4-cis
/test 4.13-e2e-aws-ocp4-cis-node
/test 4.13-e2e-aws-ocp4-e8
/test 4.13-e2e-aws-ocp4-high
/test 4.13-e2e-aws-ocp4-high-node
/test 4.13-e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate-node
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.13-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig-node
/test 4.13-e2e-aws-rhcos4-bsi
/test 4.13-e2e-aws-rhcos4-e8
/test 4.13-e2e-aws-rhcos4-high
/test 4.13-e2e-aws-rhcos4-moderate
/test 4.13-e2e-aws-rhcos4-stig
/test 4.13-images
/test 4.14-e2e-aws-ocp4-bsi
/test 4.14-e2e-aws-ocp4-bsi-node
/test 4.14-e2e-aws-ocp4-pci-dss-4-0
/test 4.14-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.14-e2e-aws-rhcos4-bsi
/test 4.14-images
/test 4.15-e2e-aws-ocp4-bsi
/test 4.15-e2e-aws-ocp4-bsi-node
/test 4.15-e2e-aws-ocp4-cis
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-e8
/test 4.15-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high-node
/test 4.15-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate-node
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss-4-0
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.15-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig-node
/test 4.15-e2e-aws-rhcos4-bsi
/test 4.15-e2e-aws-rhcos4-e8
/test 4.15-e2e-aws-rhcos4-high
/test 4.15-e2e-aws-rhcos4-moderate
/test 4.15-e2e-aws-rhcos4-stig
/test 4.15-e2e-rosa-ocp4-cis-node
/test 4.15-e2e-rosa-ocp4-pci-dss-node
/test 4.15-images
/test 4.16-e2e-aws-ocp4-bsi
/test 4.16-e2e-aws-ocp4-bsi-node
/test 4.16-e2e-aws-ocp4-cis
/test 4.16-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-e8
/test 4.16-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high-node
/test 4.16-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate-node
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig-node
/test 4.16-e2e-aws-rhcos4-bsi
/test 4.16-e2e-aws-rhcos4-e8
/test 4.16-e2e-aws-rhcos4-high
/test 4.16-e2e-aws-rhcos4-moderate
/test 4.16-e2e-aws-rhcos4-stig
/test 4.16-images
/test 4.17-e2e-aws-ocp4-bsi
/test 4.17-e2e-aws-ocp4-bsi-node
/test 4.17-e2e-aws-ocp4-cis
/test 4.17-e2e-aws-ocp4-cis-node
/test 4.17-e2e-aws-ocp4-e8
/test 4.17-e2e-aws-ocp4-high
/test 4.17-e2e-aws-ocp4-high-node
/test 4.17-e2e-aws-ocp4-moderate
/test 4.17-e2e-aws-ocp4-moderate-node
/test 4.17-e2e-aws-ocp4-pci-dss
/test 4.17-e2e-aws-ocp4-pci-dss-4-0
/test 4.17-e2e-aws-ocp4-pci-dss-node
/test 4.17-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.17-e2e-aws-ocp4-stig
/test 4.17-e2e-aws-ocp4-stig-node
/test 4.17-e2e-aws-rhcos4-bsi
/test 4.17-e2e-aws-rhcos4-e8
/test 4.17-e2e-aws-rhcos4-high
/test 4.17-e2e-aws-rhcos4-moderate
/test 4.17-e2e-aws-rhcos4-stig
/test 4.17-images
/test e2e-aws-ocp4-bsi
/test e2e-aws-ocp4-bsi-node
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-4-0
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-pci-dss-node-4-0
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-bsi
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.12-images
pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-4.17-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

rhmdnd · 2024-08-16T16:38:23Z

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0

yuumasato · 2024-08-19T13:17:06Z

/test 4.14-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.15-e2e-aws-ocp4-pci-dss-node-4-0

rhmdnd · 2024-08-19T16:15:13Z

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0

rhmdnd · 2024-08-19T19:47:24Z

The e2e failures are due to the SPO remediation script not being executable. I proposed a quick fix in #12315

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.12.yml

rhmdnd · 2024-08-21T19:52:32Z

Rebased to pickup the fix in #12315

rhmdnd · 2024-08-21T19:52:41Z

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.13.yml

yuumasato · 2024-08-26T15:54:41Z

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.12.yml

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.13.yml

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.14.yml

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.15.yml

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.16.yml

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.17.yml

rhmdnd · 2024-08-26T21:15:39Z

One minor tweak and we should get a clean e2e run for the PCI-DSS profile.

These rules are valid and still work on 4.17. The platform notation needs improvements, but this is left for another PR.

Assertion files for pci-dss-4-0 and pci-dss-node-4-0 on ocp > 4.12

The manual remediation was recently fixed. These rules are noow passing after manual remediaiton.

The rule was recently updated to check for a new path on 4.17.

yuumasato · 2024-08-27T07:27:10Z

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-node-4-0

codeclimate · 2024-08-27T08:11:26Z

Code Climate has analyzed commit efc1483 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

rhmdnd

/lgtm

We recently enabled these rules for 4.17, but didn't update the 4.17 assertion files for STIG, FedRAMP High, FedRAMP Moderate, or CIS. This commit does that so that so the tests assert the correct behavior on 4.17. ComplianceAsCode#12311

We recently enabled these rules for 4.17, but didn't update the 4.17 assertion files for FedRAMP High, FedRAMP Moderate, PCI-DSS, or CIS. This commit does that so that so the tests assert the correct behavior on 4.17. ComplianceAsCode#12311

yuumasato requested review from Vincent056, xiaojiey and rhmdnd August 16, 2024 14:19

yuumasato force-pushed the add-pci-dss-v4.0-assertion-files branch from 98d4f52 to 31043d5 Compare August 16, 2024 14:57

rhmdnd added this to the 0.1.75 milestone Aug 16, 2024

rhmdnd approved these changes Aug 16, 2024

View reviewed changes

yuumasato force-pushed the add-pci-dss-v4.0-assertion-files branch from 31043d5 to 0b5e34f Compare August 19, 2024 14:58

jan-cerny added the OpenShift OpenShift product related. label Aug 19, 2024

rhmdnd reviewed Aug 19, 2024

View reviewed changes

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.12.yml Outdated Show resolved Hide resolved

rhmdnd force-pushed the add-pci-dss-v4.0-assertion-files branch from 0b5e34f to c7d7d35 Compare August 21, 2024 19:51

rhmdnd reviewed Aug 21, 2024

View reviewed changes

tests/assertions/ocp4/ocp4-pci-dss-4-0-4.13.yml Outdated Show resolved Hide resolved

yuumasato force-pushed the add-pci-dss-v4.0-assertion-files branch from c7d7d35 to 7f750af Compare August 26, 2024 14:28

rhmdnd requested changes Aug 26, 2024

View reviewed changes

yuumasato added 4 commits August 27, 2024 09:26

Enable these rules on OCP 4.17

6a49f22

These rules are valid and still work on 4.17. The platform notation needs improvements, but this is left for another PR.

Add PCI-DSS v4.0 assertion files

ffa4cc1

Assertion files for pci-dss-4-0 and pci-dss-node-4-0 on ocp > 4.12

security-profile-operator-exists: update assertion

c6b5f2e

The manual remediation was recently fixed. These rules are noow passing after manual remediaiton.

etcd_unique_ca: update assertion file

efc1483

The rule was recently updated to check for a new path on 4.17.

yuumasato force-pushed the add-pci-dss-v4.0-assertion-files branch from 7f750af to efc1483 Compare August 27, 2024 07:26

yuumasato requested a review from rhmdnd August 27, 2024 08:37

rhmdnd approved these changes Aug 27, 2024

View reviewed changes

rhmdnd merged commit ec2429f into ComplianceAsCode:master Aug 27, 2024
104 checks passed

yuumasato deleted the add-pci-dss-v4.0-assertion-files branch August 27, 2024 14:11

marcusburghardt assigned rhmdnd Aug 30, 2024

rhmdnd mentioned this pull request Sep 4, 2024

Update assertions for PCI-DSS profile #12362

Merged

rhmdnd mentioned this pull request Sep 5, 2024

Update assertions for kubelet-client-cert|key rules #12366

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add PCI-DSS v4.0 assertion files #12311

Add PCI-DSS v4.0 assertion files #12311

yuumasato commented Aug 16, 2024

github-actions bot commented Aug 16, 2024

github-actions bot commented Aug 16, 2024 •

edited

Loading

yuumasato commented Aug 16, 2024

rhmdnd left a comment

rhmdnd commented Aug 16, 2024

openshift-ci bot commented Aug 16, 2024

rhmdnd commented Aug 16, 2024

yuumasato commented Aug 19, 2024

rhmdnd commented Aug 19, 2024

rhmdnd commented Aug 19, 2024

rhmdnd commented Aug 21, 2024

rhmdnd commented Aug 21, 2024

yuumasato commented Aug 26, 2024

rhmdnd commented Aug 26, 2024

yuumasato commented Aug 27, 2024

codeclimate bot commented Aug 27, 2024

rhmdnd left a comment

Add PCI-DSS v4.0 assertion files #12311

Add PCI-DSS v4.0 assertion files #12311

Conversation

yuumasato commented Aug 16, 2024

Description:

Rationale:

Notes

github-actions bot commented Aug 16, 2024

github-actions bot commented Aug 16, 2024 • edited Loading

yuumasato commented Aug 16, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

rhmdnd commented Aug 16, 2024

openshift-ci bot commented Aug 16, 2024

rhmdnd commented Aug 16, 2024

yuumasato commented Aug 19, 2024

rhmdnd commented Aug 19, 2024

rhmdnd commented Aug 19, 2024

rhmdnd commented Aug 21, 2024

rhmdnd commented Aug 21, 2024

yuumasato commented Aug 26, 2024

rhmdnd commented Aug 26, 2024

yuumasato commented Aug 27, 2024

codeclimate bot commented Aug 27, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

github-actions bot commented Aug 16, 2024 •

edited

Loading