Skip to content

Commit 1fed741

Browse files
Vincent056Vincent056
committed
Add scannerType field, CustomRule CRD, and 'kind' property for rule references
- Introduce scannerType to ComplianceScan and ComplianceSuite for specifying OpenSCAP or CEL. - Add custom rule CRD (compliance.openshift.io_customrules.yaml) and types. - Extend TailoredProfile references with a 'kind' field to differentiate between Rule and CustomRule.
1 parent 3065c09 commit 1fed741

15 files changed

+514
-3
lines changed

‎bundle/manifests/compliance.openshift.io_compliancescans.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎bundle/manifests/compliance.openshift.io_compliancesuites.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎bundle/manifests/compliance.openshift.io_rules.yaml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,10 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: |-
63+
The ID of the Rule
64+
This can be the XCCDF ID for OpenSCAP rules
65+
or the ID of the rule in the source content
6366
type: string
6467
instructions:
6568
description: Instructions for auditing this specific rule

‎bundle/manifests/compliance.openshift.io_tailoredprofiles.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ spec:
5757
description: RuleReferenceSpec specifies a rule to be selected/deselected,
5858
as well as the reason why
5959
properties:
60+
kind:
61+
description: |-
62+
Type of the rule reference, either "Rule" or "CustomRule"
63+
We will use "Rule" by default if not specified
64+
type: string
6065
name:
6166
description: Name of the rule that's being referenced
6267
type: string
@@ -75,6 +80,11 @@ spec:
7580
description: RuleReferenceSpec specifies a rule to be selected/deselected,
7681
as well as the reason why
7782
properties:
83+
kind:
84+
description: |-
85+
Type of the rule reference, either "Rule" or "CustomRule"
86+
We will use "Rule" by default if not specified
87+
type: string
7888
name:
7989
description: Name of the rule that's being referenced
8090
type: string
@@ -97,6 +107,11 @@ spec:
97107
description: RuleReferenceSpec specifies a rule to be selected/deselected,
98108
as well as the reason why
99109
properties:
110+
kind:
111+
description: |-
112+
Type of the rule reference, either "Rule" or "CustomRule"
113+
We will use "Rule" by default if not specified
114+
type: string
100115
name:
101116
description: Name of the rule that's being referenced
102117
type: string

‎config/crd/bases/compliance.openshift.io_compliancescans.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎config/crd/bases/compliance.openshift.io_compliancesuites.yaml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎config/crd/bases/compliance.openshift.io_customrules.yaml

Lines changed: 159 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,159 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.17.1
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
availableFixes:
42+
description: The Available fixes
43+
items:
44+
description: |-
45+
FixDefinition Specifies a fix or remediation
46+
that applies to a rule
47+
properties:
48+
disruption:
49+
description: |-
50+
An estimate of the potential disruption or operational
51+
degradation that this fix will impose in the target system
52+
type: string
53+
fixObject:
54+
description: an object that should bring the rule into compliance
55+
type: object
56+
x-kubernetes-embedded-resource: true
57+
x-kubernetes-preserve-unknown-fields: true
58+
platform:
59+
description: The platform that the fix applies to
60+
type: string
61+
type: object
62+
nullable: true
63+
type: array
64+
x-kubernetes-list-type: atomic
65+
checkType:
66+
description: |-
67+
What type of check will this rule execute:
68+
Platform, Node or none (represented by an empty string)
69+
type: string
70+
description:
71+
description: The description of the Rule
72+
type: string
73+
errorMessage:
74+
description: ErrorMessage is displayed when the rule evaluation fails
75+
minLength: 1
76+
type: string
77+
expression:
78+
description: Expression is the CEL expression to evaluate
79+
minLength: 1
80+
type: string
81+
id:
82+
description: |-
83+
The ID of the Rule
84+
This can be the XCCDF ID for OpenSCAP rules
85+
or the ID of the rule in the source content
86+
type: string
87+
inputs:
88+
description: Inputs defines the Kubernetes resources that need to
89+
be fetched before evaluating the expression
90+
items:
91+
nullable: true
92+
properties:
93+
apiGroup:
94+
description: APIGroup is the Kubernetes API group of the resource
95+
type: string
96+
name:
97+
description: Name is the variable name used to reference this
98+
resource in the CEL expression
99+
minLength: 1
100+
type: string
101+
namespace:
102+
description: Namespace is the Kubernetes namespace of the resource
103+
type: string
104+
resource:
105+
description: Resource is the Kubernetes resource type
106+
minLength: 1
107+
type: string
108+
type:
109+
enum:
110+
- KubeGroupVersionResource
111+
type: string
112+
version:
113+
description: Version is the Kubernetes API version of the resource
114+
minLength: 1
115+
type: string
116+
required:
117+
- apiGroup
118+
- name
119+
- resource
120+
- type
121+
- version
122+
type: object
123+
minItems: 1
124+
type: array
125+
instructions:
126+
description: Instructions for auditing this specific rule
127+
type: string
128+
rationale:
129+
description: The rationale of the Rule
130+
type: string
131+
scannerType:
132+
description: ScannerType specifies what type of check this rule performs
133+
enum:
134+
- CEL
135+
- OpenSCAP
136+
type: string
137+
severity:
138+
description: The severity level
139+
type: string
140+
title:
141+
description: The title of the Rule
142+
type: string
143+
warning:
144+
description: A discretionary warning about the of the Rule
145+
type: string
146+
required:
147+
- errorMessage
148+
- expression
149+
- id
150+
- inputs
151+
- scannerType
152+
- title
153+
type: object
154+
status:
155+
description: Status is intentionally left empty.
156+
type: object
157+
type: object
158+
served: true
159+
storage: true

‎config/crd/bases/compliance.openshift.io_rules.yaml

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,10 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: |-
63+
The ID of the Rule
64+
This can be the XCCDF ID for OpenSCAP rules
65+
or the ID of the rule in the source content
6366
type: string
6467
instructions:
6568
description: Instructions for auditing this specific rule

‎config/crd/bases/compliance.openshift.io_tailoredprofiles.yaml

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -57,6 +57,11 @@ spec:
5757
description: RuleReferenceSpec specifies a rule to be selected/deselected,
5858
as well as the reason why
5959
properties:
60+
kind:
61+
description: |-
62+
Type of the rule reference, either "Rule" or "CustomRule"
63+
We will use "Rule" by default if not specified
64+
type: string
6065
name:
6166
description: Name of the rule that's being referenced
6267
type: string
@@ -75,6 +80,11 @@ spec:
7580
description: RuleReferenceSpec specifies a rule to be selected/deselected,
7681
as well as the reason why
7782
properties:
83+
kind:
84+
description: |-
85+
Type of the rule reference, either "Rule" or "CustomRule"
86+
We will use "Rule" by default if not specified
87+
type: string
7888
name:
7989
description: Name of the rule that's being referenced
8090
type: string
@@ -97,6 +107,11 @@ spec:
97107
description: RuleReferenceSpec specifies a rule to be selected/deselected,
98108
as well as the reason why
99109
properties:
110+
kind:
111+
description: |-
112+
Type of the rule reference, either "Rule" or "CustomRule"
113+
We will use "Rule" by default if not specified
114+
type: string
100115
name:
101116
description: Name of the rule that's being referenced
102117
type: string

‎pkg/apis/compliance/v1alpha1/compliancescan_types.go

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ const DefaultStorageRotation = 3
5050

5151
var ErrUnkownScanType = errors.New("Unknown scan type")
5252

53+
var ErrUnkownScanerType = errors.New("Unknown scanner type")
54+
5355
// Represents the status of the compliance scan run.
5456
type ComplianceScanStatusPhase string
5557

@@ -234,6 +236,9 @@ type ComplianceScanSpec struct {
234236
// The type of Compliance scan.
235237
// +kubebuilder:default=Node
236238
ScanType ComplianceScanType `json:"scanType,omitempty"`
239+
// The scanner used to perform the scan.
240+
// +kubebuilder:default=OpenSCAP
241+
ScannerType ScannerType `json:"scannerType,omitempty"`
237242
// Is the image with the content (Data Stream), that will be used to run
238243
// OpenSCAP.
239244
ContentImage string `json:"contentImage,omitempty"`
@@ -367,6 +372,19 @@ func (cs *ComplianceScan) GetScanTypeIfValid() (ComplianceScanType, error) {
367372
return "", ErrUnkownScanType
368373
}
369374

375+
// GetScanerTypeIfValid returns scaner type we will be using if the scan has a valid one, else it returns
376+
// an error
377+
func (cs *ComplianceScan) GetScanerTypeIfValid() (ScannerType, error) {
378+
if strings.ToLower(string(cs.Spec.ScannerType)) == strings.ToLower(string(ScannerTypeOpenSCAP)) {
379+
return ScannerTypeOpenSCAP, nil
380+
}
381+
382+
if strings.ToLower(string(cs.Spec.ScannerType)) == strings.ToLower(string(ScannerTypeCEL)) {
383+
return ScannerTypeCEL, nil
384+
}
385+
return "", ErrUnkownScanerType
386+
}
387+
370388
// GetScanType get's the scan type for a scan
371389
func (cs *ComplianceScan) GetScanType() ComplianceScanType {
372390
scantype, err := cs.GetScanTypeIfValid()
@@ -377,6 +395,16 @@ func (cs *ComplianceScan) GetScanType() ComplianceScanType {
377395
return scantype
378396
}
379397

398+
// GetScannerType will get the scanner type for a scan
399+
func (cs *ComplianceScan) GetScannerType() ScannerType {
400+
scannertype, err := cs.GetScanerTypeIfValid()
401+
if err != nil {
402+
// This shouldn't happen
403+
panic(err)
404+
}
405+
return scannertype
406+
}
407+
380408
// Returns whether remediation enforcement is off or not
381409
func (cs *ComplianceScan) RemediationEnforcementIsOff() bool {
382410
return (strings.EqualFold(cs.Spec.RemediationEnforcement, RemediationEnforcementEmpty) ||

0 commit comments

Comments
 (0)