Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update OpenShift logging rules to handle CLO 6.0 #12484

Merged
merged 11 commits into from
Oct 17, 2024
Merged

Update OpenShift logging rules to handle CLO 6.0 #12484

merged 11 commits into from
Oct 17, 2024

Conversation

yuumasato
Copy link
Member

Description:

  • Update Cluster Logging Operator to use observability.openshift.io when CLO 6.0 is installed/available
  • Duplicate the rules to handle multiple API versions.

Rationale:

  • The rules should work when CLO 6.0 is installed.
  • The rules need to work with CLO 5.9 and 6.0, as users will not immediately migrate.

Review Hints:

@yuumasato
Update channel from which CLO is intalled
7476629 
cluster-loggin-operator has transitioned to stable-6.0 channel.
This updates our testing remediations to grab CLO from the correct
channel.
@yuumasato
audit_log_forwarding_enabled now handles two APIs
897b6b4 
Reform rule audit_log_forwarding_enabled to check for
ClusterlogForwarders from logging and observability APIs.
Adds two rules checking for log forwarding in each API
@yuumasato
audit_log_forwarding_uses_tls now handles two APIs
a3a72cd 
Reform rule audit_log_forwarding_uses_tls to check for
ClusterlogForwarders from logging and observability APIs.
Adds two rules checking for log forwarding in each API
@yuumasato
audit_log_forwarding_webhook now handles two APIs
78232c4 
Reform rule audit_log_forwarding_webhook to check for
ClusterlogForwarders from logging and observability APIs.
Adds two rules checking for log forwarding in each API
@yuumasato
cluster_logging_operator_exists now handles two APIs
76a5bd9 
Reform rule cluster_logging_operator_exists to check for
existence ClusterlogForwarders from logging and observability APIs.
Adds two rules checking for log forwarding in each API
@yuumasato
Update test data
6384242
@yuumasato yuumasato added the OpenShift OpenShift product related. label Oct 10, 2024
@github-actions GitHub Actions
Copy link

Start a new ephemeral environment with changes proposed in this pull request:

rhel8 (from CTF) Environment (using Fedora as testing environment)
Open in Gitpod

Fedora Testing Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@yuumasato yuumasato mentioned this pull request Oct 10, 2024
Merged
@github-actions GitHub Actions
Copy link

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12484
This image was built from commit: 6384242

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12484

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12484 make deploy-local

@rhmdnd
Copy link
Collaborator

rhmdnd commented Oct 10, 2024

Should be good to rekick the testing here now that ComplianceAsCode/compliance-operator#616 landed. The images should rebuild and push to the ghci.

@yuumasato
Copy link
Member Author

/test 4.17-e2e-aws-ocp4-pci-dss-4-0
/test 4.16-e2e-aws-ocp4-pci-dss-4-0

/test 4.17-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig

@yuumasato
Copy link
Member Author

/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-stig

@rhmdnd rhmdnd added this to the 0.1.75 milestone Oct 11, 2024
@yuumasato
Copy link
Member Author

/test 4.17-e2e-aws-ocp4-pci-dss-4-0
/test 4.14-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-4-0

/test 4.17-e2e-aws-ocp4-stig
/test 4.14-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig

@yuumasato
Copy link
Member Author

/test 4.13-e2e-aws-ocp4-stig

@yuumasato
Copy link
Member Author

Rule e2e-stig-audit-log-forwarding-uses-tls faiiled on STIG profile, let's see how it behaves on nist profiles

/test 4.13-e2e-aws-ocp4-high
/test 4.14-e2e-aws-ocp4-high

@yuumasato
Copy link
Member Author

/test 4.15-e2e-aws-ocp4-high

@yuumasato
Fix uses_tls filter for logging.openshift.io api
32022ea 
Fix jq filter for audit_log_forwarding_uses_tls for the legacy
clusterlogforwarder on logging.openshift.io.
There is a single object named 'instance', so there is no need for
'.items[]'
@yuumasato
Copy link
Member Author

/test 4.17-e2e-aws-ocp4-pci-dss-4-0
/test 4.15-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-4-0

/test 4.17-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig

@rhmdnd
Copy link
Collaborator

rhmdnd commented Oct 14, 2024

I think the PCI-DSS 4.0 failure will get fixed with https://github.com/ComplianceAsCode/content/pull/12491/files

@rhmdnd
Copy link
Collaborator

rhmdnd commented Oct 14, 2024

Looks like this is working as intended through CI.

@yuumasato
Update URL to point to latest CLO 6.0 docs
5607dde
@yuumasato
Update URLs to point to loggin.openshift.io docs
e310cd6 
Update logging api rules to point to latest logging.openshift.io docs
@yuumasato
Fix rule description typo
3782188 
configured to logs to -> configured to log to
@yuumasato yuumasato requested a review from rhmdnd October 14, 2024 18:00
@codeclimate CodeClimate
Copy link

codeclimate bot commented Oct 14, 2024

Code Climate has analyzed commit 3782188 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

rhmdnd
rhmdnd approved these changes Oct 15, 2024
View reviewed changes
Copy link
Collaborator

@rhmdnd rhmdnd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@rhmdnd
Copy link
Collaborator

rhmdnd commented Oct 17, 2024

/test 4.17-e2e-aws-ocp4-pci-dss-4-0
/test 4.15-e2e-aws-ocp4-pci-dss-4-0
/test 4.13-e2e-aws-ocp4-pci-dss-4-0
/test 4.17-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig

@rhmdnd rhmdnd merged commit 5f2899c into ComplianceAsCode:master Oct 17, 2024
103 of 110 checks passed
@yuumasato yuumasato deleted the update-clo-rules-and-tests branch October 17, 2024 17:08
@yuumasato
Copy link
Member Author

What a beautiful prow run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rhmdnd rhmdnd rhmdnd approved these changes

@Vincent056 Vincent056 Awaiting requested review from Vincent056

@xiaojiey xiaojiey Awaiting requested review from xiaojiey

@BhargaviGudi BhargaviGudi Awaiting requested review from BhargaviGudi

Assignees

@rhmdnd rhmdnd

Labels
OpenShift OpenShift product related.
Projects
None yet
Milestone
0.1.75
Development

Successfully merging this pull request may close these issues.
2 participants
@yuumasato @rhmdnd