Skip to content

Commit 482271b

Browse files
Vincent056Vincent056
committed
Add scannerType field, CustomRule CRD, and 'enabledCustomRule' fields
- Introduce scannerType to ComplianceScan and ComplianceSuite for specifying OpenSCAP or CEL. - Add custom rule CRD (compliance.openshift.io_customrules.yaml) and types. - Extend TailoredProfile with addtional EnableCustomRule field.
1 parent d9c72a3 commit 482271b

18 files changed

+676
-3
lines changed

‎bundle/manifests/compliance-operator.clusterserviceversion.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ spec:
205205
kind: ComplianceSuite
206206
name: compliancesuites.compliance.openshift.io
207207
version: v1alpha1
208+
- kind: CustomRule
209+
name: customrules.compliance.openshift.io
210+
version: v1alpha1
208211
- description: ProfileBundle is the Schema for the profilebundles API
209212
displayName: Profile Bundle
210213
kind: ProfileBundle

‎bundle/manifests/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎bundle/manifests/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎bundle/manifests/compliance.openshift.io_customrules.yaml

+141
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.17.1
6+
creationTimestamp: null
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
checkType:
42+
description: |-
43+
What type of check will this rule execute:
44+
Platform or none (represented by an empty string)
45+
enum:
46+
- Platform
47+
type: string
48+
description:
49+
description: The description of the Rule
50+
type: string
51+
errorMessage:
52+
description: ErrorMessage is displayed when the rule evaluation fails
53+
minLength: 1
54+
type: string
55+
expression:
56+
description: Expression is the CEL expression to evaluate
57+
minLength: 1
58+
type: string
59+
id:
60+
description: The ID of the Rule
61+
type: string
62+
inputs:
63+
description: Inputs defines the Kubernetes resources that need to
64+
be fetched before evaluating the expression
65+
items:
66+
nullable: true
67+
properties:
68+
apiGroup:
69+
description: APIGroup is the Kubernetes API group of the resource
70+
type: string
71+
name:
72+
description: Name is the variable name used to reference this
73+
resource in the CEL expression
74+
minLength: 1
75+
type: string
76+
namespace:
77+
description: Namespace is the Kubernetes namespace of the resource
78+
type: string
79+
resource:
80+
description: Resource is the Kubernetes resource type
81+
minLength: 1
82+
type: string
83+
type:
84+
enum:
85+
- KubeGroupVersionResource
86+
type: string
87+
version:
88+
description: Version is the Kubernetes API version of the resource
89+
minLength: 1
90+
type: string
91+
required:
92+
- apiGroup
93+
- name
94+
- resource
95+
- type
96+
- version
97+
type: object
98+
minItems: 1
99+
type: array
100+
instructions:
101+
description: Instructions for auditing this specific rule
102+
type: string
103+
rationale:
104+
description: The rationale of the Rule
105+
type: string
106+
scannerType:
107+
description: ScannerType denotes the scanning implementation to use
108+
when evaluating rules
109+
enum:
110+
- CEL
111+
type: string
112+
severity:
113+
description: The severity level
114+
type: string
115+
title:
116+
description: The title of the Rule
117+
type: string
118+
warning:
119+
description: A discretionary warning about the of the Rule
120+
type: string
121+
required:
122+
- checkType
123+
- errorMessage
124+
- expression
125+
- id
126+
- inputs
127+
- scannerType
128+
- title
129+
type: object
130+
status:
131+
description: Status is intentionally left empty.
132+
type: object
133+
type: object
134+
served: true
135+
storage: true
136+
status:
137+
acceptedNames:
138+
kind: ""
139+
plural: ""
140+
conditions: null
141+
storedVersions: null

‎bundle/manifests/compliance.openshift.io_rules.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: The ID of the Rule
6363
type: string
6464
instructions:
6565
description: Instructions for auditing this specific rule

‎bundle/manifests/compliance.openshift.io_tailoredprofiles.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,24 @@ spec:
6969
type: object
7070
nullable: true
7171
type: array
72+
enableCustomRules:
73+
description: Enables the referenced custom rules
74+
items:
75+
description: CustomRuleReferenceSpec specifies a customRule to be
76+
selected, as well as the reason why
77+
properties:
78+
name:
79+
description: Name of the customRule that's being referenced
80+
type: string
81+
rationale:
82+
description: Rationale of why this customRule is being selected
83+
type: string
84+
required:
85+
- name
86+
- rationale
87+
type: object
88+
nullable: true
89+
type: array
7290
enableRules:
7391
description: Enables the referenced rules
7492
items:

‎config/crd/bases/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎config/crd/bases/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎config/crd/bases/compliance.openshift.io_customrules.yaml

+135
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.17.1
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
checkType:
42+
description: |-
43+
What type of check will this rule execute:
44+
Platform or none (represented by an empty string)
45+
enum:
46+
- Platform
47+
type: string
48+
description:
49+
description: The description of the Rule
50+
type: string
51+
errorMessage:
52+
description: ErrorMessage is displayed when the rule evaluation fails
53+
minLength: 1
54+
type: string
55+
expression:
56+
description: Expression is the CEL expression to evaluate
57+
minLength: 1
58+
type: string
59+
id:
60+
description: The ID of the Rule
61+
type: string
62+
inputs:
63+
description: Inputs defines the Kubernetes resources that need to
64+
be fetched before evaluating the expression
65+
items:
66+
nullable: true
67+
properties:
68+
apiGroup:
69+
description: APIGroup is the Kubernetes API group of the resource
70+
type: string
71+
name:
72+
description: Name is the variable name used to reference this
73+
resource in the CEL expression
74+
minLength: 1
75+
type: string
76+
namespace:
77+
description: Namespace is the Kubernetes namespace of the resource
78+
type: string
79+
resource:
80+
description: Resource is the Kubernetes resource type
81+
minLength: 1
82+
type: string
83+
type:
84+
enum:
85+
- KubeGroupVersionResource
86+
type: string
87+
version:
88+
description: Version is the Kubernetes API version of the resource
89+
minLength: 1
90+
type: string
91+
required:
92+
- apiGroup
93+
- name
94+
- resource
95+
- type
96+
- version
97+
type: object
98+
minItems: 1
99+
type: array
100+
instructions:
101+
description: Instructions for auditing this specific rule
102+
type: string
103+
rationale:
104+
description: The rationale of the Rule
105+
type: string
106+
scannerType:
107+
description: ScannerType denotes the scanning implementation to use
108+
when evaluating rules
109+
enum:
110+
- CEL
111+
type: string
112+
severity:
113+
description: The severity level
114+
type: string
115+
title:
116+
description: The title of the Rule
117+
type: string
118+
warning:
119+
description: A discretionary warning about the of the Rule
120+
type: string
121+
required:
122+
- checkType
123+
- errorMessage
124+
- expression
125+
- id
126+
- inputs
127+
- scannerType
128+
- title
129+
type: object
130+
status:
131+
description: Status is intentionally left empty.
132+
type: object
133+
type: object
134+
served: true
135+
storage: true

‎config/crd/bases/compliance.openshift.io_rules.yaml

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: The ID of the Rule
6363
type: string
6464
instructions:
6565
description: Instructions for auditing this specific rule

‎config/crd/bases/compliance.openshift.io_tailoredprofiles.yaml

+18
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,24 @@ spec:
6969
type: object
7070
nullable: true
7171
type: array
72+
enableCustomRules:
73+
description: Enables the referenced custom rules
74+
items:
75+
description: CustomRuleReferenceSpec specifies a customRule to be
76+
selected, as well as the reason why
77+
properties:
78+
name:
79+
description: Name of the customRule that's being referenced
80+
type: string
81+
rationale:
82+
description: Rationale of why this customRule is being selected
83+
type: string
84+
required:
85+
- name
86+
- rationale
87+
type: object
88+
nullable: true
89+
type: array
7290
enableRules:
7391
description: Enables the referenced rules
7492
items:

0 commit comments

Comments
 (0)