Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update assertions for ingress controller TLS check #12361

Conversation

rhmdnd
Copy link
Collaborator

@rhmdnd rhmdnd commented Sep 3, 2024

We recently incorporated a new rule into the CIS profile that checks
ingress controller TLS configs:

#12220

We added it to the CIS profile, but didn't update the assertions in the
moderate or high profiles, which is causing periodic CI to fail. This
commit adds the assertion to the moderate and high test files so we're
checking it in subsequent CI runs.

Copy link

github-actions bot commented Sep 3, 2024

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@rhmdnd rhmdnd force-pushed the update-assertions-for-ingress-operator-rule branch from 7d0345d to 4ec18f4 Compare September 3, 2024 16:14
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 3, 2024

/test

Copy link

openshift-ci bot commented Sep 3, 2024

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

  • /test 4.12-e2e-aws-ocp4-cis
  • /test 4.12-e2e-aws-ocp4-cis-node
  • /test 4.12-e2e-aws-ocp4-e8
  • /test 4.12-e2e-aws-ocp4-high
  • /test 4.12-e2e-aws-ocp4-high-node
  • /test 4.12-e2e-aws-ocp4-moderate
  • /test 4.12-e2e-aws-ocp4-moderate-node
  • /test 4.12-e2e-aws-ocp4-pci-dss
  • /test 4.12-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.12-e2e-aws-ocp4-pci-dss-node
  • /test 4.12-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.12-e2e-aws-ocp4-stig
  • /test 4.12-e2e-aws-ocp4-stig-node
  • /test 4.12-e2e-aws-rhcos4-e8
  • /test 4.12-e2e-aws-rhcos4-high
  • /test 4.12-e2e-aws-rhcos4-moderate
  • /test 4.12-e2e-aws-rhcos4-stig
  • /test 4.12-images
  • /test 4.13-e2e-aws-ocp4-bsi
  • /test 4.13-e2e-aws-ocp4-bsi-node
  • /test 4.13-e2e-aws-ocp4-cis
  • /test 4.13-e2e-aws-ocp4-cis-node
  • /test 4.13-e2e-aws-ocp4-e8
  • /test 4.13-e2e-aws-ocp4-high
  • /test 4.13-e2e-aws-ocp4-high-node
  • /test 4.13-e2e-aws-ocp4-moderate
  • /test 4.13-e2e-aws-ocp4-moderate-node
  • /test 4.13-e2e-aws-ocp4-pci-dss
  • /test 4.13-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.13-e2e-aws-ocp4-pci-dss-node
  • /test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.13-e2e-aws-ocp4-stig
  • /test 4.13-e2e-aws-ocp4-stig-node
  • /test 4.13-e2e-aws-rhcos4-bsi
  • /test 4.13-e2e-aws-rhcos4-e8
  • /test 4.13-e2e-aws-rhcos4-high
  • /test 4.13-e2e-aws-rhcos4-moderate
  • /test 4.13-e2e-aws-rhcos4-stig
  • /test 4.13-images
  • /test 4.14-e2e-aws-ocp4-bsi
  • /test 4.14-e2e-aws-ocp4-bsi-node
  • /test 4.14-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.14-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.14-e2e-aws-rhcos4-bsi
  • /test 4.14-images
  • /test 4.15-e2e-aws-ocp4-bsi
  • /test 4.15-e2e-aws-ocp4-bsi-node
  • /test 4.15-e2e-aws-ocp4-cis
  • /test 4.15-e2e-aws-ocp4-cis-node
  • /test 4.15-e2e-aws-ocp4-e8
  • /test 4.15-e2e-aws-ocp4-high
  • /test 4.15-e2e-aws-ocp4-high-node
  • /test 4.15-e2e-aws-ocp4-moderate
  • /test 4.15-e2e-aws-ocp4-moderate-node
  • /test 4.15-e2e-aws-ocp4-pci-dss
  • /test 4.15-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.15-e2e-aws-ocp4-pci-dss-node
  • /test 4.15-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.15-e2e-aws-ocp4-stig
  • /test 4.15-e2e-aws-ocp4-stig-node
  • /test 4.15-e2e-aws-rhcos4-bsi
  • /test 4.15-e2e-aws-rhcos4-e8
  • /test 4.15-e2e-aws-rhcos4-high
  • /test 4.15-e2e-aws-rhcos4-moderate
  • /test 4.15-e2e-aws-rhcos4-stig
  • /test 4.15-e2e-rosa-ocp4-cis-node
  • /test 4.15-e2e-rosa-ocp4-pci-dss-node
  • /test 4.15-images
  • /test 4.16-e2e-aws-ocp4-bsi
  • /test 4.16-e2e-aws-ocp4-bsi-node
  • /test 4.16-e2e-aws-ocp4-cis
  • /test 4.16-e2e-aws-ocp4-cis-node
  • /test 4.16-e2e-aws-ocp4-e8
  • /test 4.16-e2e-aws-ocp4-high
  • /test 4.16-e2e-aws-ocp4-high-node
  • /test 4.16-e2e-aws-ocp4-moderate
  • /test 4.16-e2e-aws-ocp4-moderate-node
  • /test 4.16-e2e-aws-ocp4-pci-dss
  • /test 4.16-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.16-e2e-aws-ocp4-pci-dss-node
  • /test 4.16-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.16-e2e-aws-ocp4-stig
  • /test 4.16-e2e-aws-ocp4-stig-node
  • /test 4.16-e2e-aws-rhcos4-bsi
  • /test 4.16-e2e-aws-rhcos4-e8
  • /test 4.16-e2e-aws-rhcos4-high
  • /test 4.16-e2e-aws-rhcos4-moderate
  • /test 4.16-e2e-aws-rhcos4-stig
  • /test 4.16-images
  • /test 4.17-e2e-aws-ocp4-bsi
  • /test 4.17-e2e-aws-ocp4-bsi-node
  • /test 4.17-e2e-aws-ocp4-cis
  • /test 4.17-e2e-aws-ocp4-cis-node
  • /test 4.17-e2e-aws-ocp4-e8
  • /test 4.17-e2e-aws-ocp4-high
  • /test 4.17-e2e-aws-ocp4-high-node
  • /test 4.17-e2e-aws-ocp4-moderate
  • /test 4.17-e2e-aws-ocp4-moderate-node
  • /test 4.17-e2e-aws-ocp4-pci-dss
  • /test 4.17-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.17-e2e-aws-ocp4-pci-dss-node
  • /test 4.17-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.17-e2e-aws-ocp4-stig
  • /test 4.17-e2e-aws-ocp4-stig-node
  • /test 4.17-e2e-aws-rhcos4-bsi
  • /test 4.17-e2e-aws-rhcos4-e8
  • /test 4.17-e2e-aws-rhcos4-high
  • /test 4.17-e2e-aws-rhcos4-moderate
  • /test 4.17-e2e-aws-rhcos4-stig
  • /test 4.17-images
  • /test e2e-aws-ocp4-bsi
  • /test e2e-aws-ocp4-bsi-node
  • /test e2e-aws-ocp4-cis
  • /test e2e-aws-ocp4-cis-node
  • /test e2e-aws-ocp4-e8
  • /test e2e-aws-ocp4-high
  • /test e2e-aws-ocp4-high-node
  • /test e2e-aws-ocp4-moderate
  • /test e2e-aws-ocp4-moderate-node
  • /test e2e-aws-ocp4-pci-dss
  • /test e2e-aws-ocp4-pci-dss-4-0
  • /test e2e-aws-ocp4-pci-dss-node
  • /test e2e-aws-ocp4-pci-dss-node-4-0
  • /test e2e-aws-ocp4-stig
  • /test e2e-aws-ocp4-stig-node
  • /test e2e-aws-rhcos4-bsi
  • /test e2e-aws-rhcos4-e8
  • /test e2e-aws-rhcos4-high
  • /test e2e-aws-rhcos4-moderate
  • /test e2e-aws-rhcos4-stig
  • /test images

Use /test all to run the following jobs that were automatically triggered:

  • pull-ci-ComplianceAsCode-content-master-4.12-images
  • pull-ci-ComplianceAsCode-content-master-4.13-images
  • pull-ci-ComplianceAsCode-content-master-4.14-images
  • pull-ci-ComplianceAsCode-content-master-4.15-images
  • pull-ci-ComplianceAsCode-content-master-4.16-images
  • pull-ci-ComplianceAsCode-content-master-4.17-images
  • pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@rhmdnd rhmdnd requested a review from yuumasato September 3, 2024 16:22
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 3, 2024

/test 4.13-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high
/test 4.17-e2e-aws-ocp4-high
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate
/test 4.17-e2e-aws-ocp4-moderate

Copy link

github-actions bot commented Sep 3, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12361
This image was built from commit: 5f2fca1

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12361

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12361 make deploy-local

@yuumasato yuumasato self-assigned this Sep 3, 2024
Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we are missing the same assertion for PCI-DSS, they also extend CIS profiles.

@yuumasato
Copy link
Member

/test 4.16-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss

@yuumasato
Copy link
Member

I think we are missing the same assertion for PCI-DSS, they also extend CIS profiles.

Nevermind, I see them on #12362

@yuumasato
Copy link
Member

Actually, the ocp4-pci-dss-4-0.4.XX.yml are missing the rule:
See for example:
https://github.com/ComplianceAsCode/content/blob/4ec18f4229ccef0a7019da13f7ce29bcd0cf1c79/tests/assertions/ocp4/ocp4-pci-dss-4-0-4.16.yml

@yuumasato
Copy link
Member

    helpers.go:872: Result - Name: e2e-pci-dss-4-0-kubelet-configure-tls-cipher-suites-ingresscontroller - Status: FAIL - Severity: medium
    helpers.go:879: E2E-Error: e2e-pci-dss-4-0-kubelet-configure-tls-cipher-suites-ingresscontroller: Rule assertion missing 

@rhmdnd rhmdnd added this to the 0.1.75 milestone Sep 3, 2024
We recently incorporated a new rule into the CIS profile that checks
ingress controller TLS configs:

  ComplianceAsCode#12220

We added it to the CIS profile, but didn't update the assertions in the
moderate or high profiles, which is causing periodic CI to fail. This
commit adds the assertion to the moderate and high test files so we're
checking it in subsequent CI runs.
@rhmdnd rhmdnd force-pushed the update-assertions-for-ingress-operator-rule branch from 4ec18f4 to 5f2fca1 Compare September 3, 2024 22:36
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 3, 2024

/test 4.13-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high
/test 4.17-e2e-aws-ocp4-high
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate
/test 4.17-e2e-aws-ocp4-moderate

Copy link

codeclimate bot commented Sep 3, 2024

Code Climate has analyzed commit 5f2fca1 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

Copy link

openshift-ci bot commented Sep 4, 2024

@rhmdnd: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/4.16-e2e-aws-ocp4-pci-dss-4-0 4ec18f4 link true /test 4.16-e2e-aws-ocp4-pci-dss-4-0
ci/prow/4.16-e2e-aws-ocp4-pci-dss 4ec18f4 link true /test 4.16-e2e-aws-ocp4-pci-dss
ci/prow/e2e-aws-ocp4-moderate 5f2fca1 link true /test e2e-aws-ocp4-moderate
ci/prow/4.17-e2e-aws-ocp4-moderate 5f2fca1 link true /test 4.17-e2e-aws-ocp4-moderate
ci/prow/4.17-e2e-aws-ocp4-high 5f2fca1 link true /test 4.17-e2e-aws-ocp4-high

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@marcusburghardt marcusburghardt added the OpenShift OpenShift product related. label Sep 4, 2024
Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@yuumasato yuumasato merged commit d7020ee into ComplianceAsCode:master Sep 4, 2024
107 of 110 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OpenShift OpenShift product related.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants