OCP4 STIG: Fix up rules that dealt with network policy #10142
Conversation
…e, select the correct rules SRG-APP-000038-CTR-000105 is resolved by making sure all non-control plane namespaces contain a `NetworkPolicy`. Let's move the metadata to the rules' policy files and remove all unrelated SRGs from rhe rules themselves.
…stification, remove spurious rule A rule that is inherently met shouldn't be resolved by a rule.
…ix status This is a manual rule that is not solved by a particular rule, but instead has a number of other related rules that pertain to configuration of registries. Also adds the check and fix texts.
…ation and status_justification A rule with a does not meet status should have a mitigation and status justification.
…tion and status_justification A rule that's inherently met shouldn't be resolved by a rule, but should have supporting evidence and status justification.
…licies_namespaces from controls that are not resolved by these rules This is a catch-all where we remove configure_network_policies_namespaces and configure_network_policies and routes_protected_by_tls from the `rules:` attribute of unrelated controls. We fix those controls in a later patch.
…090 and SRG-APP-000442-CTR-001095, not SRG-APP-000441-CTR-001090 SRG-APP-000441-CTR-001090 and SRG-APP-000442-CTR-001095 talk about integrity, SRG-APP-000441-CTR-001090 is about network segmentation.
|
Start a new ephemeral environment with changes proposed in this pull request: Fedora Environment Oracle Linux 8 Environment |
|
Code Climate has analyzed commit a6a4fe6 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 49.5% (0.0% change). View more on Code Climate. |
|
/retest |
marcusburghardt
added
OpenShift
|
more cluster install issues |
|
This time the operator didn't install, might be an outage |
|
/test e2e-aws-ocp4-e8 |
|
/test e2e-aws-ocp4-e8 |
1 similar comment
|
/test e2e-aws-ocp4-e8 |
|
@jhrozek: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here. |
Description:
This PR started as a patch to fix SRG-APP-000038-CTR-000105 but I went a
little overboard and checked all controls that deal with network policies
and routes.
rules:attribute of unrelated controls. We fix those controls in a later patch.Rationale:
Review Hints:
./build_product --debug ocp4export PYTHONPATH=$(pwd); python3 ./utils/rule_dir_json.pyexport PYTHONPATH=$(pwd); python3 utils/create_srg_export.py -c controls/srg_ctr.yml -p ocp4 -m shared/references/disa-ctr-srg-v1r3.xml --out-format html --output /tmp/srg-mapping-ocp4.html