Skip to content

Commit 9627c42

Browse files
Vincent056Vincent056
committed
CMP-2868: Layout the CRDs changes needed for CEL
Modifies Rule, ComplianceScan CRDs, added fields needed for CEL implmentation.
1 parent fed54b4 commit 9627c42

12 files changed

+227
-0
lines changed

‎bundle/manifests/compliance.openshift.io_compliancecheckresults.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ spec:
4141
description:
4242
description: A human-readable check description, what and why it does
4343
type: string
44+
errorMessage:
45+
description: The ErrorMessage of the rule evaluation
46+
type: string
4447
id:
4548
description: A unique identifier of a check
4649
type: string

‎bundle/manifests/compliance.openshift.io_compliancescans.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,12 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scanner:
270+
default: OpenSCAP
271+
description: |-
272+
Scanner is the type of scanner that should be used to evaluate this rule
273+
Defaults to OpenSCAP
274+
type: string
269275
showNotApplicable:
270276
default: false
271277
description: Determines whether to hide or show results that are not

‎bundle/manifests/compliance.openshift.io_compliancesuites.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,12 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scanner:
289+
default: OpenSCAP
290+
description: |-
291+
Scanner is the type of scanner that should be used to evaluate this rule
292+
Defaults to OpenSCAP
293+
type: string
288294
showNotApplicable:
289295
default: false
290296
description: Determines whether to hide or show results that

‎bundle/manifests/compliance.openshift.io_rules.yaml

+60
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,63 @@ spec:
5858
description:
5959
description: The description of the Rule
6060
type: string
61+
evaluations:
62+
description: |-
63+
Evaluations is the list of CEL expressions that will be used
64+
to evaluate the rule
65+
items:
66+
properties:
67+
errorMessage:
68+
description: Error message to be displayed if the evaluation fails
69+
type: string
70+
expression:
71+
description: The CEL expression to be evaluated
72+
type: string
73+
required:
74+
- expression
75+
type: object
76+
nullable: true
77+
type: array
78+
x-kubernetes-list-type: atomic
6179
id:
6280
description: The XCCDF ID
6381
type: string
82+
inputs:
83+
description: Inputs represent the input parameters for the CEL expression
84+
items:
85+
description: InputPayload defines the structure for the inputs used
86+
in the CEL expression
87+
properties:
88+
kubeResource:
89+
description: The kubernetes resource that will be used as input
90+
nullable: true
91+
properties:
92+
apiGroup:
93+
description: The API group of the resource
94+
type: string
95+
apiVersion:
96+
description: The version of the resource
97+
type: string
98+
namespace:
99+
description: The namespace of the resource
100+
type: string
101+
resource:
102+
description: The resource type
103+
type: string
104+
required:
105+
- apiGroup
106+
- apiVersion
107+
- resource
108+
type: object
109+
name:
110+
description: The name of the input parameter
111+
type: string
112+
required:
113+
- name
114+
type: object
115+
nullable: true
116+
type: array
117+
x-kubernetes-list-type: atomic
64118
instructions:
65119
description: Instructions for auditing this specific rule
66120
type: string
@@ -77,6 +131,12 @@ spec:
77131
rationale:
78132
description: The rationale of the Rule
79133
type: string
134+
scanner:
135+
default: OpenSCAP
136+
description: |-
137+
Scanner is the type of scanner that should be used to evaluate this rule
138+
Defaults to OpenSCAP
139+
type: string
80140
severity:
81141
description: The severity level
82142
type: string

‎config/crd/bases/compliance.openshift.io_compliancecheckresults.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,9 @@ spec:
4141
description:
4242
description: A human-readable check description, what and why it does
4343
type: string
44+
errorMessage:
45+
description: The ErrorMessage of the rule evaluation
46+
type: string
4447
id:
4548
description: A unique identifier of a check
4649
type: string

‎config/crd/bases/compliance.openshift.io_compliancescans.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,12 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scanner:
270+
default: OpenSCAP
271+
description: |-
272+
Scanner is the type of scanner that should be used to evaluate this rule
273+
Defaults to OpenSCAP
274+
type: string
269275
showNotApplicable:
270276
default: false
271277
description: Determines whether to hide or show results that are not

‎config/crd/bases/compliance.openshift.io_compliancesuites.yaml

+6
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,12 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scanner:
289+
default: OpenSCAP
290+
description: |-
291+
Scanner is the type of scanner that should be used to evaluate this rule
292+
Defaults to OpenSCAP
293+
type: string
288294
showNotApplicable:
289295
default: false
290296
description: Determines whether to hide or show results that

‎config/crd/bases/compliance.openshift.io_rules.yaml

+60
Original file line numberDiff line numberDiff line change
@@ -58,9 +58,63 @@ spec:
5858
description:
5959
description: The description of the Rule
6060
type: string
61+
evaluations:
62+
description: |-
63+
Evaluations is the list of CEL expressions that will be used
64+
to evaluate the rule
65+
items:
66+
properties:
67+
errorMessage:
68+
description: Error message to be displayed if the evaluation fails
69+
type: string
70+
expression:
71+
description: The CEL expression to be evaluated
72+
type: string
73+
required:
74+
- expression
75+
type: object
76+
nullable: true
77+
type: array
78+
x-kubernetes-list-type: atomic
6179
id:
6280
description: The XCCDF ID
6381
type: string
82+
inputs:
83+
description: Inputs represent the input parameters for the CEL expression
84+
items:
85+
description: InputPayload defines the structure for the inputs used
86+
in the CEL expression
87+
properties:
88+
kubeResource:
89+
description: The kubernetes resource that will be used as input
90+
nullable: true
91+
properties:
92+
apiGroup:
93+
description: The API group of the resource
94+
type: string
95+
apiVersion:
96+
description: The version of the resource
97+
type: string
98+
namespace:
99+
description: The namespace of the resource
100+
type: string
101+
resource:
102+
description: The resource type
103+
type: string
104+
required:
105+
- apiGroup
106+
- apiVersion
107+
- resource
108+
type: object
109+
name:
110+
description: The name of the input parameter
111+
type: string
112+
required:
113+
- name
114+
type: object
115+
nullable: true
116+
type: array
117+
x-kubernetes-list-type: atomic
64118
instructions:
65119
description: Instructions for auditing this specific rule
66120
type: string
@@ -77,6 +131,12 @@ spec:
77131
rationale:
78132
description: The rationale of the Rule
79133
type: string
134+
scanner:
135+
default: OpenSCAP
136+
description: |-
137+
Scanner is the type of scanner that should be used to evaluate this rule
138+
Defaults to OpenSCAP
139+
type: string
80140
severity:
81141
description: The severity level
82142
type: string

‎pkg/apis/compliance/v1alpha1/compliancecheckresult_types.go

+2
Original file line numberDiff line numberDiff line change
@@ -98,6 +98,8 @@ type ComplianceCheckResult struct {
9898
Warnings []string `json:"warnings,omitempty"`
9999
// It stores a list of values used by the check
100100
ValuesUsed []string `json:"valuesUsed,omitempty"`
101+
// The ErrorMessage of the rule evaluation
102+
ErrorMessage string `json:"errorMessage,omitempty"`
101103
}
102104

103105
// +kubebuilder:object:root=true

‎pkg/apis/compliance/v1alpha1/compliancescan_types.go

+7
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,9 @@ const CmScanResultAnnotation = "compliance.openshift.io/scan-result"
8989
// CmScanResultErrMsg holds the processed scanner error message
9090
const CmScanResultErrMsg = "compliance.openshift.io/scan-error-msg"
9191

92+
// CELFeatureEnableAnnotation is used to enable the CEL feature
93+
const CELFeatureEnableAnnotation = "compliance.openshift.io/cel-feature-enable"
94+
9295
const (
9396
// ResultNot available represents the compliance scan not having finished yet
9497
ResultNotAvailable ComplianceScanStatusResult = "NOT-AVAILABLE"
@@ -244,6 +247,10 @@ type ComplianceScanSpec struct {
244247
// rule. Note that when leaving this empty, the scan will check for all the
245248
// rules for a specific profile.
246249
Rule string `json:"rule,omitempty"`
250+
// Scanner is the type of scanner that should be used to evaluate this rule
251+
// Defaults to OpenSCAP
252+
// +kubebuilder:default=OpenSCAP
253+
Scanner ScannerType `json:"scanner,omitempty"`
247254
// Is the path to the file that contains the content (the data stream).
248255
// Note that the path needs to be relative to the `/` (root) directory, as
249256
// it is in the ContentImage

‎pkg/apis/compliance/v1alpha1/profile_types.go

+7
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,13 @@ const ProductAnnotation = "compliance.openshift.io/product"
1515
// ProfileGuidLabel specifies the unique identifier of the Profile
1616
const ProfileGuidLabel = "compliance.openshift.io/profile-guid"
1717

18+
// ScannerAnnotation specifies the type of scanner to use for this Profile
19+
const ScannerAnnotation = "compliance.openshift.io/scanner"
20+
21+
// UserProfileAnnotation define if tailored profile contains User Created rules
22+
// that are not part of the original profile
23+
const UserProfileAnnotation = "compliance.openshift.io/user-profile"
24+
1825
// ProfileRule defines the name of a specific rule in the profile
1926
type ProfileRule string
2027

‎pkg/apis/compliance/v1alpha1/rule_types.go

+61
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,28 @@ const (
2727
CheckTypeNone = ""
2828
)
2929

30+
// ScannerType is an enum type for the scanner type
31+
type ScannerType string
32+
33+
// InputType is an enum type for the input type
34+
type InputType string
35+
36+
const (
37+
// ScannerTypeOpenSCAP is the default scanner type
38+
ScannerTypeOpenSCAP ScannerType = "OpenSCAP"
39+
// ScannerTypeCelScanner is the scanner type for the CEL scanner
40+
ScannerTypeCelScanner ScannerType = "CEL"
41+
// ScannerTypeUnknown is the scanner type for an unknown scanner
42+
ScannerTypeUnknown ScannerType = "Unknown"
43+
)
44+
45+
type Evaluation struct {
46+
// The CEL expression to be evaluated
47+
Expression string `json:"expression"`
48+
// Error message to be displayed if the evaluation fails
49+
ErrorMessage string `json:"errorMessage,omitempty"`
50+
}
51+
3052
type RulePayload struct {
3153
// The XCCDF ID
3254
ID string `json:"id"`
@@ -50,6 +72,45 @@ type RulePayload struct {
5072
// +optional
5173
// +listType=atomic
5274
AvailableFixes []FixDefinition `json:"availableFixes,omitempty"`
75+
// Scanner is the type of scanner that should be used to evaluate this rule
76+
// Defaults to OpenSCAP
77+
// +kubebuilder:default=OpenSCAP
78+
Scanner ScannerType `json:"scanner,omitempty"`
79+
// Evaluations is the list of CEL expressions that will be used
80+
// to evaluate the rule
81+
// +nullable
82+
// +optional
83+
// +listType=atomic
84+
Evaluatiosn []Evaluation `json:"evaluations,omitempty"`
85+
// Inputs represent the input parameters for the CEL expression
86+
// +nullable
87+
// +optional
88+
// +listType=atomic
89+
Inputs []InputPayload `json:"inputs,omitempty"`
90+
}
91+
92+
// KubernetesResource represents a kubernetes resource that can be used as an input
93+
// for the CEL expression
94+
type KubernetesResource struct {
95+
// The API group of the resource
96+
APIGroup string `json:"apiGroup"`
97+
// The version of the resource
98+
ApiVersion string `json:"apiVersion"`
99+
// The resource type
100+
Resource string `json:"resource"`
101+
// The namespace of the resource
102+
// +optional
103+
Namespace string `json:"namespace,omitempty"`
104+
}
105+
106+
// InputPayload defines the structure for the inputs used in the CEL expression
107+
type InputPayload struct {
108+
// The name of the input parameter
109+
Name string `json:"name"`
110+
// The kubernetes resource that will be used as input
111+
// +nullable
112+
// +optional
113+
KubeResource KubernetesResource `json:"kubeResource,omitempty"`
53114
}
54115

55116
// +kubebuilder:object:root=true

0 commit comments

Comments
 (0)