Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OCP4: Drop not-arch from file_permissions_cni_conf #11756

Merged
merged 1 commit into from
Mar 28, 2024

Conversation

Vincent056
Copy link
Contributor

Similar to what we did in ebbd895, is a workaround for #9077 that makes the filter to put rule in the correct profile.

Copy link

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

Copy link

github-actions bot commented Mar 26, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11756
This image was built from commit: a1acf03

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11756

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11756 make deploy-local

@rhmdnd
Copy link
Collaborator

rhmdnd commented Mar 26, 2024

/test

Copy link

openshift-ci bot commented Mar 26, 2024

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

  • /test 4.13-e2e-aws-ocp4-cis
  • /test 4.13-e2e-aws-ocp4-cis-node
  • /test 4.13-e2e-aws-ocp4-e8
  • /test 4.13-e2e-aws-ocp4-high
  • /test 4.13-e2e-aws-ocp4-high-node
  • /test 4.13-e2e-aws-ocp4-moderate
  • /test 4.13-e2e-aws-ocp4-moderate-node
  • /test 4.13-e2e-aws-ocp4-pci-dss
  • /test 4.13-e2e-aws-ocp4-pci-dss-node
  • /test 4.13-e2e-aws-ocp4-stig
  • /test 4.13-e2e-aws-ocp4-stig-node
  • /test 4.13-e2e-aws-rhcos4-e8
  • /test 4.13-e2e-aws-rhcos4-high
  • /test 4.13-e2e-aws-rhcos4-moderate
  • /test 4.13-e2e-aws-rhcos4-stig
  • /test 4.13-images
  • /test 4.14-images
  • /test 4.15-e2e-aws-ocp4-cis
  • /test 4.15-e2e-aws-ocp4-cis-node
  • /test 4.15-e2e-aws-ocp4-e8
  • /test 4.15-e2e-aws-ocp4-high
  • /test 4.15-e2e-aws-ocp4-high-node
  • /test 4.15-e2e-aws-ocp4-moderate
  • /test 4.15-e2e-aws-ocp4-moderate-node
  • /test 4.15-e2e-aws-ocp4-pci-dss
  • /test 4.15-e2e-aws-ocp4-pci-dss-node
  • /test 4.15-e2e-aws-ocp4-stig
  • /test 4.15-e2e-aws-ocp4-stig-node
  • /test 4.15-e2e-aws-rhcos4-e8
  • /test 4.15-e2e-aws-rhcos4-high
  • /test 4.15-e2e-aws-rhcos4-moderate
  • /test 4.15-e2e-aws-rhcos4-stig
  • /test 4.15-images
  • /test 4.16-e2e-aws-ocp4-cis
  • /test 4.16-e2e-aws-ocp4-cis-node
  • /test 4.16-e2e-aws-ocp4-e8
  • /test 4.16-e2e-aws-ocp4-high
  • /test 4.16-e2e-aws-ocp4-high-node
  • /test 4.16-e2e-aws-ocp4-moderate
  • /test 4.16-e2e-aws-ocp4-moderate-node
  • /test 4.16-e2e-aws-ocp4-pci-dss
  • /test 4.16-e2e-aws-ocp4-pci-dss-node
  • /test 4.16-e2e-aws-ocp4-stig
  • /test 4.16-e2e-aws-ocp4-stig-node
  • /test 4.16-e2e-aws-rhcos4-e8
  • /test 4.16-e2e-aws-rhcos4-high
  • /test 4.16-e2e-aws-rhcos4-moderate
  • /test 4.16-e2e-aws-rhcos4-stig
  • /test 4.16-images
  • /test e2e-aws-ocp4-cis
  • /test e2e-aws-ocp4-cis-node
  • /test e2e-aws-ocp4-e8
  • /test e2e-aws-ocp4-high
  • /test e2e-aws-ocp4-high-node
  • /test e2e-aws-ocp4-moderate
  • /test e2e-aws-ocp4-moderate-node
  • /test e2e-aws-ocp4-pci-dss
  • /test e2e-aws-ocp4-pci-dss-node
  • /test e2e-aws-ocp4-stig
  • /test e2e-aws-ocp4-stig-node
  • /test e2e-aws-rhcos4-e8
  • /test e2e-aws-rhcos4-high
  • /test e2e-aws-rhcos4-moderate
  • /test e2e-aws-rhcos4-stig
  • /test images

Use /test all to run the following jobs that were automatically triggered:

  • pull-ci-ComplianceAsCode-content-master-4.13-images
  • pull-ci-ComplianceAsCode-content-master-4.14-images
  • pull-ci-ComplianceAsCode-content-master-4.15-images
  • pull-ci-ComplianceAsCode-content-master-4.16-images
  • pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@rhmdnd rhmdnd self-requested a review March 26, 2024 15:35
@rhmdnd rhmdnd added the OpenShift OpenShift product related. label Mar 26, 2024
@rhmdnd
Copy link
Collaborator

rhmdnd commented Mar 26, 2024

/test 4.13-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-cis-node

Copy link
Collaborator

@rhmdnd rhmdnd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good - just two very minor nits on wording and one question about the expected result of the old rule.


description: |-
{{{ describe_file_permissions(file="/etc/cni/net.d/*", perms="0600") }}}
This rule is to for architectures other than s390x.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nit: This rule is for all architectures except s390x.

Or just remove to.


description: |-
{{{ describe_file_permissions(file="/etc/cni/net.d/*", perms="0600") }}}
This rule is to for architectures on s390x.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar comment as above.

@Vincent056
Copy link
Contributor Author

/test 4.13-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-cis-node

Copy link

@GroceryBoyJr GroceryBoyJr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

</criteria>

</definition>
</def-group>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is breaking some of the build jobs.

@rhmdnd rhmdnd requested review from xiaojiey and BhargaviGudi March 27, 2024 00:53
@@ -0,0 +1,11 @@
<def-group oval_version="5.11">
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Strange - it doesn't look like this was picked up in the latest CI run.

@xiaojiey
Copy link
Collaborator

/hold for test

@openshift-ci openshift-ci bot added the do-not-merge/hold Used by openshift-ci-robot bot. label Mar 27, 2024
@xiaojiey
Copy link
Collaborator

@Vincent056 I found the rule ocp4-file-permissions-cni-conf get removed. But I didn't see ocp4-file-permissions-cni-conf-not-x390 neither. Is it expected? Thanks.

% oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.16.0-0.nightly-2024-03-25-100907   True        False         4h35m   Cluster version is 4.16.0-0.nightly-2024-03-25-100907
% oc apply -f -<<EOF
heredoc> apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cis-compliance
  namespace: openshift-compliance
profiles:
  - name: upstream-ocp4-cis-node
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
  - name: upstream-ocp4-cis
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
settingsRef:
  name: default
  kind: ScanSetting
  apiGroup: compliance.openshift.io/v1alpha1
heredoc> EOF
scansettingbinding.compliance.openshift.io/cis-compliance created
% oc apply -f -<<EOF        
apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cis-d         
  namespace: openshift-compliance
profiles:
  - name: ocp4-cis-node 
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
  - name: ocp4-cis         
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
settingsRef:
  name: default
  kind: ScanSetting
  apiGroup: compliance.openshift.io/v1alpha1
EOF
scansettingbinding.compliance.openshift.io/cis-d created
 % oc get scan
NAME                            PHASE     RESULT
ocp4-cis                        RUNNING   NOT-AVAILABLE
ocp4-cis-node-master            RUNNING   NOT-AVAILABLE
ocp4-cis-node-worker            RUNNING   NOT-AVAILABLE
upstream-ocp4-cis               DONE      NON-COMPLIANT
upstream-ocp4-cis-node-master   DONE      COMPLIANT
upstream-ocp4-cis-node-worker   DONE      COMPLIANT
 % oc get scan
\NAME                            PHASE   RESULT
ocp4-cis                        DONE    NON-COMPLIANT
ocp4-cis-node-master            DONE    NON-COMPLIANT
ocp4-cis-node-worker            DONE    NON-COMPLIANT
upstream-ocp4-cis               DONE    NON-COMPLIANT
upstream-ocp4-cis-node-master   DONE    COMPLIANT
upstream-ocp4-cis-node-worker   DONE    COMPLIANT
 % oc get ccr | grep cni-conf
ocp4-cis-node-master-file-groupowner-cni-conf                                          PASS     medium
ocp4-cis-node-master-file-owner-cni-conf                                               PASS     medium
ocp4-cis-node-master-file-permissions-cni-conf                                         FAIL     medium
ocp4-cis-node-worker-file-groupowner-cni-conf                                          PASS     medium
ocp4-cis-node-worker-file-owner-cni-conf                                               PASS     medium
ocp4-cis-node-worker-file-permissions-cni-conf                                         FAIL     medium
upstream-ocp4-cis-node-master-file-groupowner-cni-conf                                 PASS     medium
upstream-ocp4-cis-node-master-file-owner-cni-conf                                      PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-cni-conf                                 PASS     medium
upstream-ocp4-cis-node-worker-file-owner-cni-conf                                      PASS     medium
xiyuan@xiyuan-mac content % oc get rule | grep s390
ocp4-file-groupowner-ovs-conf-db-lock-not-s390x                                              71m
ocp4-file-groupowner-ovs-conf-db-lock-s390x                                                  71m
ocp4-file-groupowner-ovs-conf-db-not-s390x                                                   71m
ocp4-file-groupowner-ovs-conf-db-s390x                                                       71m
ocp4-file-groupowner-ovs-sys-id-conf-not-s390x                                               71m
ocp4-file-groupowner-ovs-sys-id-conf-s390x                                                   71m
upstream-ocp4-file-groupowner-ovs-conf-db-lock-not-s390x                                     67m
upstream-ocp4-file-groupowner-ovs-conf-db-lock-s390x                                         67m
upstream-ocp4-file-groupowner-ovs-conf-db-not-s390x                                          67m
upstream-ocp4-file-groupowner-ovs-conf-db-s390x                                              67m
upstream-ocp4-file-groupowner-ovs-sys-id-conf-not-s390x                                      67m
upstream-ocp4-file-groupowner-ovs-sys-id-conf-s390x                                          67m
% oc get rule | grep cni-conf
ocp4-file-groupowner-cni-conf                                                                76m
ocp4-file-owner-cni-conf                                                                     76m
ocp4-file-permissions-cni-conf                                                               76m
upstream-ocp4-file-groupowner-cni-conf                                                       73m
upstream-ocp4-file-owner-cni-conf                                                            73m
upstream-ocp4-file-permissions-cni-conf                                                      73m

@Vincent056 Vincent056 force-pushed the s390x_disable branch 3 times, most recently from 1aee491 to acf0e0e Compare March 27, 2024 10:49
@@ -0,0 +1,3 @@
---
# This will fail until OpenShift 4.14 is released and used by CI.
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Specifically - this will fail until https://issues.redhat.com//browse/OCPBUGS-22995 is landed in a 4.14 branch and released as a z-stream (which explains why this is still failing even though we're using 4.14 in CI).

Similar to what we did in ComplianceAsCode@ebbd895, is a workaround for ComplianceAsCode#9077 that makes the filter to put rule in the correct profile.
Copy link

codeclimate bot commented Mar 28, 2024

Code Climate has analyzed commit a1acf03 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.3% (0.0% change).

View more on Code Climate.

@xiaojiey
Copy link
Collaborator

Verification pass with 4.16.0-0.nightly-2024-03-25-100907 + #11756:

% oc get clusterversion
NAME      VERSION                              AVAILABLE   PROGRESSING   SINCE   STATUS
version   4.16.0-0.nightly-2024-03-25-100907   True        False         64m     Cluster version is 4.16.0-0.nightly-2024-03-25-100907
 % oc apply -f -<<EOF
heredoc> apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cis-compliance
  namespace: openshift-compliance
profiles:
  - name: upstream-ocp4-cis-node
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
  - name: upstream-ocp4-cis
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
settingsRef:
  name: default
  kind: ScanSetting
  apiGroup: compliance.openshift.io/v1alpha1
heredoc> EOF
scansettingbinding.compliance.openshift.io/cis-compliance created
% oc apply -f -<<EOF        
apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cis-d
  namespace: openshift-compliance
profiles:
  - name: ocp4-cis-node
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
  - name: ocp4-cis
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
settingsRef:
  name: default
  kind: ScanSetting
  apiGroup: compliance.openshift.io/v1alpha1
EOF
scansettingbinding.compliance.openshift.io/cis-d created
% oc get scan
NAME                            PHASE   RESULT
ocp4-cis                        DONE    NON-COMPLIANT
ocp4-cis-node-master            DONE    NON-COMPLIANT
ocp4-cis-node-worker            DONE    NON-COMPLIANT
upstream-ocp4-cis               DONE    NON-COMPLIANT
upstream-ocp4-cis-node-master   DONE    NON-COMPLIANT
upstream-ocp4-cis-node-worker   DONE    NON-COMPLIANT
% oc get ccr | grep cni-conf
ocp4-cis-node-master-file-groupowner-cni-conf                                          PASS     medium
ocp4-cis-node-master-file-owner-cni-conf                                               PASS     medium
ocp4-cis-node-master-file-permissions-cni-conf                                         FAIL     medium
ocp4-cis-node-worker-file-groupowner-cni-conf                                          PASS     medium
ocp4-cis-node-worker-file-owner-cni-conf                                               PASS     medium
ocp4-cis-node-worker-file-permissions-cni-conf                                         FAIL     medium
upstream-ocp4-cis-node-master-file-groupowner-cni-conf                                 PASS     medium
upstream-ocp4-cis-node-master-file-owner-cni-conf                                      PASS     medium
upstream-ocp4-cis-node-master-file-permissions-cni-conf                                FAIL     medium
upstream-ocp4-cis-node-worker-file-groupowner-cni-conf                                 PASS     medium
upstream-ocp4-cis-node-worker-file-owner-cni-conf                                      PASS     medium
upstream-ocp4-cis-node-worker-file-permissions-cni-conf                                FAIL     medium
xiyuan@xiyuan-mac content % oc get ccr | grep file-groupowner-ovs
ocp4-cis-node-master-file-groupowner-ovs-conf-db                                       PASS     medium
ocp4-cis-node-master-file-groupowner-ovs-conf-db-lock                                  PASS     medium
ocp4-cis-node-master-file-groupowner-ovs-pid                                           PASS     medium
ocp4-cis-node-master-file-groupowner-ovs-sys-id-conf                                   PASS     medium
ocp4-cis-node-master-file-groupowner-ovs-vswitchd-pid                                  PASS     medium
ocp4-cis-node-master-file-groupowner-ovsdb-server-pid                                  PASS     medium
ocp4-cis-node-worker-file-groupowner-ovs-conf-db                                       PASS     medium
ocp4-cis-node-worker-file-groupowner-ovs-conf-db-lock                                  PASS     medium
ocp4-cis-node-worker-file-groupowner-ovs-pid                                           PASS     medium
ocp4-cis-node-worker-file-groupowner-ovs-sys-id-conf                                   PASS     medium
ocp4-cis-node-worker-file-groupowner-ovs-vswitchd-pid                                  PASS     medium
ocp4-cis-node-worker-file-groupowner-ovsdb-server-pid                                  PASS     medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-conf-db                              PASS     medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-conf-db-lock                         PASS     medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-pid                                  PASS     medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-sys-id-conf                          PASS     medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-vswitchd-pid                         PASS     medium
upstream-ocp4-cis-node-master-file-groupowner-ovsdb-server-pid                         PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-conf-db                              PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-conf-db-lock                         PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-pid                                  PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-sys-id-conf                          PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-vswitchd-pid                         PASS     medium
upstream-ocp4-cis-node-worker-file-groupowner-ovsdb-server-pid                         PASS     medium

@xiaojiey
Copy link
Collaborator

/unhold

@openshift-ci openshift-ci bot removed the do-not-merge/hold Used by openshift-ci-robot bot. label Mar 28, 2024
@xiaojiey
Copy link
Collaborator

/lgtm

@rhmdnd
Copy link
Collaborator

rhmdnd commented Mar 28, 2024

/test 4.13-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-cis-node

Copy link

openshift-ci bot commented Mar 28, 2024

@Vincent056: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/4.13-e2e-aws-ocp4-cis-node a1acf03 link true /test 4.13-e2e-aws-ocp4-cis-node
ci/prow/4.16-e2e-aws-ocp4-cis-node a1acf03 link true /test 4.16-e2e-aws-ocp4-cis-node
ci/prow/e2e-aws-ocp4-cis-node a1acf03 link true /test e2e-aws-ocp4-cis-node
ci/prow/4.15-e2e-aws-ocp4-cis-node a1acf03 link true /test 4.15-e2e-aws-ocp4-cis-node

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

Copy link
Collaborator

@rhmdnd rhmdnd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@rhmdnd
Copy link
Collaborator

rhmdnd commented Mar 28, 2024

The e2e failures are unrelated to this specific rule, and after checking the e2e logs the rule is failing as expected.

@rhmdnd rhmdnd merged commit 978d2c6 into ComplianceAsCode:master Mar 28, 2024
41 of 49 checks passed
@jan-cerny jan-cerny added this to the 0.1.73 milestone Apr 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OpenShift OpenShift product related.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants