Skip to content

Commit 866bd41

Browse files
Vincent056Vincent056
committed
Add scannerType field, CustomRule CRD, and 'kind' property for rule references
- Introduce scannerType to ComplianceScan and ComplianceSuite for specifying OpenSCAP or CEL. - Add custom rule CRD (compliance.openshift.io_customrules.yaml) and types. - Extend TailoredProfile references with a 'kind' field to differentiate between Rule and CustomRule.
1 parent 3065c09 commit 866bd41

16 files changed

+516
-3
lines changed

‎bundle/manifests/compliance-operator.clusterserviceversion.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,10 @@ spec:
218218
kind: Rule
219219
name: rules.compliance.openshift.io
220220
version: v1alpha1
221+
- description: Rule is the Schema for the rules API
222+
kind: CustomRule
223+
name: customrules.compliance.openshift.io
224+
version: v1alpha1
221225
- description: ScanSettingBinding is the Schema for the scansettingbindings API
222226
displayName: Scan Setting Binding
223227
kind: ScanSettingBinding

‎bundle/manifests/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎bundle/manifests/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎bundle/manifests/compliance.openshift.io_rules.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,10 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: |-
63+
The ID of the Rule
64+
This can be the XCCDF ID for OpenSCAP rules
65+
or the ID of the rule in the source content
6366
type: string
6467
instructions:
6568
description: Instructions for auditing this specific rule

‎bundle/manifests/compliance.openshift.io_tailoredprofiles.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,18 @@ spec:
5757
description: RuleReferenceSpec specifies a rule to be selected/deselected,
5858
as well as the reason why
5959
properties:
60+
kind:
61+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
62+
is the default if not specified.
63+
type: string
6064
name:
6165
description: Name of the rule that's being referenced
6266
type: string
6367
rationale:
6468
description: Rationale of why this rule is being selected/deselected
6569
type: string
6670
required:
71+
- kind
6772
- name
6873
- rationale
6974
type: object
@@ -75,13 +80,18 @@ spec:
7580
description: RuleReferenceSpec specifies a rule to be selected/deselected,
7681
as well as the reason why
7782
properties:
83+
kind:
84+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
85+
is the default if not specified.
86+
type: string
7887
name:
7988
description: Name of the rule that's being referenced
8089
type: string
8190
rationale:
8291
description: Rationale of why this rule is being selected/deselected
8392
type: string
8493
required:
94+
- kind
8595
- name
8696
- rationale
8797
type: object
@@ -97,13 +107,18 @@ spec:
97107
description: RuleReferenceSpec specifies a rule to be selected/deselected,
98108
as well as the reason why
99109
properties:
110+
kind:
111+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
112+
is the default if not specified.
113+
type: string
100114
name:
101115
description: Name of the rule that's being referenced
102116
type: string
103117
rationale:
104118
description: Rationale of why this rule is being selected/deselected
105119
type: string
106120
required:
121+
- kind
107122
- name
108123
- rationale
109124
type: object

‎config/crd/bases/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎config/crd/bases/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎config/crd/bases/compliance.openshift.io_customrules.yaml

+158
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,158 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.17.1
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
availableFixes:
42+
description: The Available fixes
43+
items:
44+
description: |-
45+
FixDefinition Specifies a fix or remediation
46+
that applies to a rule
47+
properties:
48+
disruption:
49+
description: |-
50+
An estimate of the potential disruption or operational
51+
degradation that this fix will impose in the target system
52+
type: string
53+
fixObject:
54+
description: an object that should bring the rule into compliance
55+
type: object
56+
x-kubernetes-embedded-resource: true
57+
x-kubernetes-preserve-unknown-fields: true
58+
platform:
59+
description: The platform that the fix applies to
60+
type: string
61+
type: object
62+
nullable: true
63+
type: array
64+
x-kubernetes-list-type: atomic
65+
checkType:
66+
description: |-
67+
What type of check will this rule execute:
68+
Platform, Node or none (represented by an empty string)
69+
type: string
70+
description:
71+
description: The description of the Rule
72+
type: string
73+
errorMessage:
74+
description: ErrorMessage is displayed when the rule evaluation fails
75+
minLength: 1
76+
type: string
77+
expression:
78+
description: Expression is the CEL expression to evaluate
79+
minLength: 1
80+
type: string
81+
id:
82+
description: |-
83+
The ID of the Rule
84+
This can be the XCCDF ID for OpenSCAP rules
85+
or the ID of the rule in the source content
86+
type: string
87+
inputs:
88+
description: Inputs defines the Kubernetes resources that need to
89+
be fetched before evaluating the expression
90+
items:
91+
nullable: true
92+
properties:
93+
apiGroup:
94+
description: APIGroup is the Kubernetes API group of the resource
95+
type: string
96+
name:
97+
description: Name is the variable name used to reference this
98+
resource in the CEL expression
99+
minLength: 1
100+
type: string
101+
namespace:
102+
description: Namespace is the Kubernetes namespace of the resource
103+
type: string
104+
resource:
105+
description: Resource is the Kubernetes resource type
106+
minLength: 1
107+
type: string
108+
type:
109+
enum:
110+
- KubeGroupVersionResource
111+
type: string
112+
version:
113+
description: Version is the Kubernetes API version of the resource
114+
minLength: 1
115+
type: string
116+
required:
117+
- apiGroup
118+
- name
119+
- resource
120+
- type
121+
- version
122+
type: object
123+
minItems: 1
124+
type: array
125+
instructions:
126+
description: Instructions for auditing this specific rule
127+
type: string
128+
rationale:
129+
description: The rationale of the Rule
130+
type: string
131+
scannerType:
132+
description: ScannerType specifies what type of check this rule performs
133+
enum:
134+
- CEL
135+
type: string
136+
severity:
137+
description: The severity level
138+
type: string
139+
title:
140+
description: The title of the Rule
141+
type: string
142+
warning:
143+
description: A discretionary warning about the of the Rule
144+
type: string
145+
required:
146+
- errorMessage
147+
- expression
148+
- id
149+
- inputs
150+
- scannerType
151+
- title
152+
type: object
153+
status:
154+
description: Status is intentionally left empty.
155+
type: object
156+
type: object
157+
served: true
158+
storage: true

‎config/crd/bases/compliance.openshift.io_rules.yaml

+4-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,10 @@ spec:
5959
description: The description of the Rule
6060
type: string
6161
id:
62-
description: The XCCDF ID
62+
description: |-
63+
The ID of the Rule
64+
This can be the XCCDF ID for OpenSCAP rules
65+
or the ID of the rule in the source content
6366
type: string
6467
instructions:
6568
description: Instructions for auditing this specific rule

‎config/crd/bases/compliance.openshift.io_tailoredprofiles.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,18 @@ spec:
5757
description: RuleReferenceSpec specifies a rule to be selected/deselected,
5858
as well as the reason why
5959
properties:
60+
kind:
61+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
62+
is the default if not specified.
63+
type: string
6064
name:
6165
description: Name of the rule that's being referenced
6266
type: string
6367
rationale:
6468
description: Rationale of why this rule is being selected/deselected
6569
type: string
6670
required:
71+
- kind
6772
- name
6873
- rationale
6974
type: object
@@ -75,13 +80,18 @@ spec:
7580
description: RuleReferenceSpec specifies a rule to be selected/deselected,
7681
as well as the reason why
7782
properties:
83+
kind:
84+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
85+
is the default if not specified.
86+
type: string
7887
name:
7988
description: Name of the rule that's being referenced
8089
type: string
8190
rationale:
8291
description: Rationale of why this rule is being selected/deselected
8392
type: string
8493
required:
94+
- kind
8595
- name
8696
- rationale
8797
type: object
@@ -97,13 +107,18 @@ spec:
97107
description: RuleReferenceSpec specifies a rule to be selected/deselected,
98108
as well as the reason why
99109
properties:
110+
kind:
111+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
112+
is the default if not specified.
113+
type: string
100114
name:
101115
description: Name of the rule that's being referenced
102116
type: string
103117
rationale:
104118
description: Rationale of why this rule is being selected/deselected
105119
type: string
106120
required:
121+
- kind
107122
- name
108123
- rationale
109124
type: object

0 commit comments

Comments
 (0)