Retire old TLS Cipher Checks and homogenize the active ones

[sluetze]

Description:

Removing kubelet_configure_tls_cipher_suites_openshiftapiserver_operator and kubelet_configure_tls_cipher_suites_kubeapiserver_operator and renaming kubelet_configure_tls_cipher_suites_ingresscontroller to create a more concise structure

this is part of a larger effort to make all TLS Cipher Suites and their remediations configurable with variables (see https://issues.redhat.com/browse/RFE-6859 )

Rationale:

The current state of the TLS Cipher Checks is a little bit heterogenous. There are currently 6 of them:

1. api_server_tls_cipher_suites
2. kubelet_tls_cipher_suites
3. kubelet_configure_tls_cipher_suites_ingresscontroller
4. etcd_check_cipher_suite
5. kubelet_configure_tls_cipher_suites_openshiftapiserver_operator
6. kubelet_configure_tls_cipher_suites_kubeapiserver_operator

while 1-4 are used in multiple profiles, kubelet_configure_tls_cipher_suites_openshiftapiserver_operator and kubelet_configure_tls_cipher_suites_kubeapiserver_operator are only used in the default profile. they also do not really have anything to do with kubelet and also have remediations which are unsupported or defect. There are nowadays better ways to configure TLS profiles and these are used by the newer rules.

Furthermore the kubelet_configure_tls_cipher_suites_ingresscontroller doesnt have anything to do with the kubelet. There are more rules regarding the ingresscontroller under networking. I believe this to be an artifact, since you can see, that the new api_server_tls_cipher_suites is under apiserver. Moving kubelet_configure_tls_cipher_suites_ingresscontroller to networking bundles the ingresscontroller tls rules together and makes it easier to get a grasp of what is existing.

These changes should prevent people creating new profiles to use the wrong/outdated rules and also more easily find relevant rules.

Review Hints:

I checked for occurences of the rules by grepping the repository

grep -iR kubelet_configure_tls_cipher_suites_openshiftapiserver_operator ./

./products/ocp4/profiles/default.profile:    - kubelet_configure_tls_cipher_suites_openshiftapiserver_operator

grep -iR kubelet_configure_tls_cipher_suites_kubeapiserver_operator ./
./products/ocp4/profiles/default.profile:    - kubelet_configure_tls_cipher_suites_kubeapiserver_operator

grep -iR kubelet_configure_tls_cipher_suites_ingresscontroller ./
controls/cis_ocp_1_4_0/section-4.yml:        - kubelet_configure_tls_cipher_suites_ingresscontroller

I replaced the occurence in controls/cis_ocp_1_4_0/section-4.yml
with the new name.
IMHO this rule does not match the requirement, as the ingresscontroller has nothing to do with the kubelet. I would recommend to remove it, as the requirement is addressed by the kubelet rule.

Furthermore I wonder, why this rule is not used in more places.

one could also go one step further and unify the naming of the cipher rules, but I think this is creating no value.

[openshift-ci]

Hi @sluetze. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

[codeclimate]

Code Climate has analyzed commit c9de579 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 61.6% (0.0% change).

View more on Code Climate.

[yuumasato]

Interesting that in CIS v1.6.0 item 1.2.33, the use of unsupportedConfigOverrides is not recommended anymore.
We don't have a rule for that though.

[yuumasato]

There is no need to keep this rule in default.profile, since it is selected in CIS Control file.

[yuumasato]

The default.profile is not an actual profile, it is a list of rules not selected in any profiles that should be kept in the data stream.

[yuumasato]

This rename and move makes sense to me.
@rhmdnd @Vincent056 thoughts?