Skip to content

Commit cb3392e

Browse files
Vincent056Vincent056
committed
Add scannerType field, CustomRule CRD, and 'kind' property for rule references
- Introduce scannerType to ComplianceScan and ComplianceSuite for specifying OpenSCAP or CEL. - Add custom rule CRD (compliance.openshift.io_customrules.yaml) and types. - Extend TailoredProfile references with a 'kind' field to differentiate between Rule and CustomRule.
1 parent d9c72a3 commit cb3392e

18 files changed

+691
-5
lines changed

‎bundle/manifests/compliance-operator.clusterserviceversion.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ spec:
205205
kind: ComplianceSuite
206206
name: compliancesuites.compliance.openshift.io
207207
version: v1alpha1
208+
- kind: CustomRule
209+
name: customrules.compliance.openshift.io
210+
version: v1alpha1
208211
- description: ProfileBundle is the Schema for the profilebundles API
209212
displayName: Profile Bundle
210213
kind: ProfileBundle

‎bundle/manifests/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎bundle/manifests/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

‎bundle/manifests/compliance.openshift.io_customrules.yaml

+166
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
apiVersion: apiextensions.k8s.io/v1
2+
kind: CustomResourceDefinition
3+
metadata:
4+
annotations:
5+
controller-gen.kubebuilder.io/version: v0.17.1
6+
creationTimestamp: null
7+
name: customrules.compliance.openshift.io
8+
spec:
9+
group: compliance.openshift.io
10+
names:
11+
kind: CustomRule
12+
listKind: CustomRuleList
13+
plural: customrules
14+
singular: customrule
15+
scope: Namespaced
16+
versions:
17+
- name: v1alpha1
18+
schema:
19+
openAPIV3Schema:
20+
description: CustomRule is the Schema for the customrules API
21+
properties:
22+
apiVersion:
23+
description: |-
24+
APIVersion defines the versioned schema of this representation of an object.
25+
Servers should convert recognized schemas to the latest internal value, and
26+
may reject unrecognized values.
27+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
28+
type: string
29+
kind:
30+
description: |-
31+
Kind is a string value representing the REST resource this object represents.
32+
Servers may infer this from the endpoint the client submits requests to.
33+
Cannot be updated.
34+
In CamelCase.
35+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
36+
type: string
37+
metadata:
38+
type: object
39+
spec:
40+
properties:
41+
availableFixes:
42+
description: |-
43+
The Available fixes
44+
This is not supported with CustomRule
45+
items:
46+
description: |-
47+
FixDefinition Specifies a fix or remediation
48+
that applies to a rule
49+
properties:
50+
disruption:
51+
description: |-
52+
An estimate of the potential disruption or operational
53+
degradation that this fix will impose in the target system
54+
type: string
55+
fixObject:
56+
description: an object that should bring the rule into compliance
57+
type: object
58+
x-kubernetes-embedded-resource: true
59+
x-kubernetes-preserve-unknown-fields: true
60+
platform:
61+
description: The platform that the fix applies to
62+
type: string
63+
type: object
64+
nullable: true
65+
type: array
66+
x-kubernetes-list-type: atomic
67+
checkType:
68+
description: |-
69+
What type of check will this rule execute:
70+
Platform, Node or none (represented by an empty string)
71+
type: string
72+
description:
73+
description: The description of the Rule
74+
type: string
75+
errorMessage:
76+
description: ErrorMessage is displayed when the rule evaluation fails
77+
minLength: 1
78+
type: string
79+
expression:
80+
description: Expression is the CEL expression to evaluate
81+
minLength: 1
82+
type: string
83+
id:
84+
description: |-
85+
The ID of the Rule
86+
This can be the XCCDF ID for OpenSCAP rules
87+
or the ID of the rule in the source content
88+
type: string
89+
inputs:
90+
description: Inputs defines the Kubernetes resources that need to
91+
be fetched before evaluating the expression
92+
items:
93+
nullable: true
94+
properties:
95+
apiGroup:
96+
description: APIGroup is the Kubernetes API group of the resource
97+
type: string
98+
name:
99+
description: Name is the variable name used to reference this
100+
resource in the CEL expression
101+
minLength: 1
102+
type: string
103+
namespace:
104+
description: Namespace is the Kubernetes namespace of the resource
105+
type: string
106+
resource:
107+
description: Resource is the Kubernetes resource type
108+
minLength: 1
109+
type: string
110+
type:
111+
enum:
112+
- KubeGroupVersionResource
113+
type: string
114+
version:
115+
description: Version is the Kubernetes API version of the resource
116+
minLength: 1
117+
type: string
118+
required:
119+
- apiGroup
120+
- name
121+
- resource
122+
- type
123+
- version
124+
type: object
125+
minItems: 1
126+
type: array
127+
instructions:
128+
description: Instructions for auditing this specific rule
129+
type: string
130+
rationale:
131+
description: The rationale of the Rule
132+
type: string
133+
scannerType:
134+
description: ScannerType specifies what type of check this rule performs
135+
enum:
136+
- CEL
137+
type: string
138+
severity:
139+
description: The severity level
140+
type: string
141+
title:
142+
description: The title of the Rule
143+
type: string
144+
warning:
145+
description: A discretionary warning about the of the Rule
146+
type: string
147+
required:
148+
- errorMessage
149+
- expression
150+
- id
151+
- inputs
152+
- scannerType
153+
- title
154+
type: object
155+
status:
156+
description: Status is intentionally left empty.
157+
type: object
158+
type: object
159+
served: true
160+
storage: true
161+
status:
162+
acceptedNames:
163+
kind: ""
164+
plural: ""
165+
conditions: null
166+
storedVersions: null

‎bundle/manifests/compliance.openshift.io_rules.yaml

+7-2
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,9 @@ spec:
2727
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
2828
type: string
2929
availableFixes:
30-
description: The Available fixes
30+
description: |-
31+
The Available fixes
32+
This is not supported with CustomRule
3133
items:
3234
description: |-
3335
FixDefinition Specifies a fix or remediation
@@ -59,7 +61,10 @@ spec:
5961
description: The description of the Rule
6062
type: string
6163
id:
62-
description: The XCCDF ID
64+
description: |-
65+
The ID of the Rule
66+
This can be the XCCDF ID for OpenSCAP rules
67+
or the ID of the rule in the source content
6368
type: string
6469
instructions:
6570
description: Instructions for auditing this specific rule

‎bundle/manifests/compliance.openshift.io_tailoredprofiles.yaml

+15
Original file line numberDiff line numberDiff line change
@@ -57,13 +57,18 @@ spec:
5757
description: RuleReferenceSpec specifies a rule to be selected/deselected,
5858
as well as the reason why
5959
properties:
60+
kind:
61+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
62+
is the default if not specified.
63+
type: string
6064
name:
6165
description: Name of the rule that's being referenced
6266
type: string
6367
rationale:
6468
description: Rationale of why this rule is being selected/deselected
6569
type: string
6670
required:
71+
- kind
6772
- name
6873
- rationale
6974
type: object
@@ -75,13 +80,18 @@ spec:
7580
description: RuleReferenceSpec specifies a rule to be selected/deselected,
7681
as well as the reason why
7782
properties:
83+
kind:
84+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
85+
is the default if not specified.
86+
type: string
7887
name:
7988
description: Name of the rule that's being referenced
8089
type: string
8190
rationale:
8291
description: Rationale of why this rule is being selected/deselected
8392
type: string
8493
required:
94+
- kind
8595
- name
8696
- rationale
8797
type: object
@@ -97,13 +107,18 @@ spec:
97107
description: RuleReferenceSpec specifies a rule to be selected/deselected,
98108
as well as the reason why
99109
properties:
110+
kind:
111+
description: Type of rule, either "Rule" or "CustomRule". "Rule"
112+
is the default if not specified.
113+
type: string
100114
name:
101115
description: Name of the rule that's being referenced
102116
type: string
103117
rationale:
104118
description: Rationale of why this rule is being selected/deselected
105119
type: string
106120
required:
121+
- kind
107122
- name
108123
- rationale
109124
type: object

‎config/crd/bases/compliance.openshift.io_compliancescans.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -266,6 +266,10 @@ spec:
266266
default: Node
267267
description: The type of Compliance scan.
268268
type: string
269+
scannerType:
270+
default: OpenSCAP
271+
description: The scanner used to perform the scan.
272+
type: string
269273
showNotApplicable:
270274
default: false
271275
description: Determines whether to hide or show results that are not

‎config/crd/bases/compliance.openshift.io_compliancesuites.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -285,6 +285,10 @@ spec:
285285
default: Node
286286
description: The type of Compliance scan.
287287
type: string
288+
scannerType:
289+
default: OpenSCAP
290+
description: The scanner used to perform the scan.
291+
type: string
288292
showNotApplicable:
289293
default: false
290294
description: Determines whether to hide or show results that

0 commit comments

Comments
 (0)