-
Notifications
You must be signed in to change notification settings - Fork 694
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Defined notes and Rules for BSI APP.4.4.A6-7 #11794
Defined notes and Rules for BSI APP.4.4.A6-7 #11794
Conversation
Hi @sluetze. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
🤖 A k8s content image for this PR is available at: Click here to see how to deploy itIf you alread have Compliance Operator deployed: Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and: |
This datastream diff is auto generated by the check Click here to see the full diffNew content has different text for rule 'xccdf_org.ssgproject.content_rule_general_namespace_separation'.
--- xccdf_org.ssgproject.content_rule_general_namespace_separation
+++ xccdf_org.ssgproject.content_rule_general_namespace_separation
@@ -13,3 +13,6 @@
allows you to granularly control the access to this application on a kubernetes
level. It also allows you control the network flow from and to other namespaces
more easily.
+
+[ident]:
+CCE-90279-1
New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_network_policies'.
--- xccdf_org.ssgproject.content_rule_configure_network_policies
+++ xccdf_org.ssgproject.content_rule_configure_network_policies
@@ -17,6 +17,9 @@
and persist it to the local
/apis/operator.openshift.io/v1/networks/cluster#35e33d6dc1252a03495b35bd1751cac70041a511fa4d282c300a8b83b83e3498
file.
+
+[reference]:
+APP.4.4.A7
[reference]:
CIP-003-8 R6
New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces'.
--- xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces
+++ xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces
@@ -20,6 +20,9 @@
and persist it to the local
/api/v1/namespaces#34d4beecc95c65d815d9d48fd4fdcb0c521631852ad088ef74e36d012b0e1e0d
file.
+
+[reference]:
+APP.4.4.A7
[reference]:
CIP-003-8 R4
New content has different text for rule 'xccdf_org.ssgproject.content_rule_project_config_and_template_network_policy'.
--- xccdf_org.ssgproject.content_rule_project_config_and_template_network_policy
+++ xccdf_org.ssgproject.content_rule_project_config_and_template_network_policy
@@ -32,6 +32,9 @@
file.
[reference]:
+APP.4.4.A7
+
+[reference]:
SRG-APP-000039-CTR-000110
[reference]:
New content has different text for rule 'xccdf_org.ssgproject.content_rule_rbac_least_privilege'.
--- xccdf_org.ssgproject.content_rule_rbac_least_privilege
+++ xccdf_org.ssgproject.content_rule_rbac_least_privilege
@@ -28,6 +28,9 @@
[reference]:
APP.4.4.A3
+
+[reference]:
+APP.4.4.A7
[reference]:
AC-3 |
Code Climate has analyzed commit 42553b2 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 59.4%. View more on Code Climate. |
place in a separate Init container. It SHOULD be ensured that the initialisation terminates all | ||
processes that are already running. Kubernetes SHOULD ONLY start the other containers if | ||
the initialisation is successful. | ||
If an initialisation (e.g. of an application) takes place in a pod at start-up, this SHOULD take place in a separate Init container. It SHOULD be ensured that the initialisation terminates all processes that are already running. Kubernetes SHOULD ONLY start the other containers if the initialisation is successful. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@sluetze I see this paragraph now matches exactly the text on BSI pdf.
Is this intentional? I'd rather avoid very long lines to ease readability.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yes this is intentional and true for all controls in bsi_app_4_4 and bsi_sys_1_6
We created the skeleton of the control file by using the BSI pdf texts as description. We did so for two reasons. First we did not want to spread too much information over too many docs to avoid the necessity to switch between docs and versions all the time. Secondly this way we do not have to "invent" a new description which might lead to misunderstandings or be "slightly off" in comparison to what the bsi pdf writes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I definitely support having descriptions identical to the pdf.
What I'm not much a fan of are the very long lines, if you are okay, and it is possible, wrap them around at 99 characters.
@@ -58,6 +58,7 @@ identifiers: | |||
cce@ocp4: CCE-86070-0 | |||
|
|||
references: | |||
bsi: APP.4.4.A7 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The control files now support automated assignment of references to the rules.
https://complianceascode.readthedocs.io/en/latest/manual/developer/03_creating_content.html#using-controls-for-automated-reference-assignment-to-rules
With it there is no need to manually add bsi
reference to each rule.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There is no need to change the PR, I mention for awareness, and to make development a bit easier.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Sounds great. I will add the necessary info to the control file in a later PR.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
/lgtm
Skipping the Ansible hardening tests. |
Description:
Notes / Rules for BSI APP4.4.A6 - APP4.4.A7 added.
Rationale:
As we have multiple customers asking for a BSI profile to be included in the compliance-operator, we are contributing a profile. To provide a better review process, the individual controle are implemented as separate PRs.
This is still a draft, because we need to discuss on how to do the following:
@benruland