CMP-4655: Add oc compliance fetch-stig-results subcommand - #1378
CMP-4655: Add oc compliance fetch-stig-results subcommand#1378yuumasato wants to merge 17 commits into
oc compliance fetch-stig-results subcommand#1378Conversation
|
@yuumasato: This pull request references CMP-4647 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the epic to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: yuumasato The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
Add k8s.io/cli-runtime, k8s.io/kubectl/pkg/cmd/cp, and github.com/pkg/browser to support the oc-compliance CLI tool being ported into this repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the shared utilities from oc-compliance into this repository. This includes constants, Kubernetes client abstractions, input validation, YAML serialization, and profile/suite helpers that all subcommands depend on. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the main CLI entry point and the bind subcommand from oc-compliance. The bind command creates ScanSettingBinding objects for given Profiles or TailoredProfiles, with optional dry-run output. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the controls subcommand from oc-compliance. This command reports which compliance controls a profile fulfills by inspecting rule annotations, with output rendered as a merged table grouped by benchmark. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the rerun-now subcommand from oc-compliance. This command forces ComplianceScans to re-trigger by setting the rescan annotation, supporting ComplianceScan, ComplianceSuite, and ScanSettingBinding targets. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the fetch-fixes subcommand entry point, the shared FixPersister, and the ExtraManifestBuilder framework (default and ArgoCD) from oc-compliance. The object type helpers follow in the next commit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the Rule, Profile, and ComplianceRemediation helpers for the fetch-fixes subcommand. These handle fetching available fixes from each object type and persisting them as YAML files. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the fetch-raw subcommand entry point and the ComplianceSuite and ScanSettingBinding helpers from oc-compliance. The ComplianceScan helper that handles PVC extraction follows in the next commit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the ComplianceScan helper that extracts raw ARF results from PVCs by creating an extractor pod, using kubectl cp to copy results, and optionally generating HTML reports via oscap. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the view-result subcommand from oc-compliance. This command displays detailed information about a ComplianceCheckResult by traversing the owner chain to find the relevant rule, profile, and remediation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the end-to-end tests from oc-compliance. These tests cover all subcommands: bind, controls, fetch-fixes, fetch-raw, rerun-now, and view-result. Updated deprecated ioutil calls to use os package equivalents. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add Makefile targets for building, installing, and running e2e tests for oc-compliance. The e2e target builds the binary, installs it as an oc plugin, then runs the tests — matching the original oc-compliance repository's workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
After rebasing the port onto master, re-pin go.mod to master's dependency versions (k8s.io/* v0.35.7, cel-go v0.30.0, golang.org/x/crypto v0.54.0, compliance-sdk v0.1.1, go 1.25.11) and re-run go mod tidy + go mod vendor so the oc-compliance additions (k8s.io/cli-runtime, k8s.io/kubectl, github.com/pkg/browser, tablewriter) resolve consistently at v0.35.7 instead of the stale v0.35.5 the branch was originally cut against. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
d5ea92c to
6251904
Compare
Generate DISA STIG Viewer XCCDF result files from the ComplianceCheckResults produced by a ScanSettingBinding. Each rule id is rewritten to its STIG reference (SV-*_rule) from the control.compliance.openshift.io/STIG-RULE annotation. Where a single STIG rule is covered by more than one check, the worst status wins. The output matches the standalone <TestResult> format that OpenSCAP writes with --stig-viewer, which DISA STIG Viewer imports natively. By default every scan is collapsed into a single combined file (named after the binding); because STIG rule ids are globally unique, that file can be imported against either the platform or node STIG. --per-scan emits one file per scan instead, and --scan restricts output to a single named scan. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a README for the oc-compliance plugin listing its subcommands, and a topic doc walking through the fetch-stig-results workflow: generating XCCDF results (combined, per-scan, single-scan), how overlapping results are collapsed worst-status-wins, importing into DISA STIG Viewer, and the benign rule-revision mismatch warning. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a Dockerfile and Makefile targets to build a throwaway oc-compliance plugin image from public bases, for testing the plugin. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
go vet rejects the non-constant format string in generateHTMLReports (oscap output was passed as the format argument); use "%s". Also apply the gofmt struct-field alignment corrected by `make update-coverage-line`. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
6251904 to
880b8e1
Compare
|
🤖 To deploy this PR, run the following command: |
yuumasato
changed the title
oc compliance fetch-stig-results subcommandoc compliance fetch-stig-results subcommand
|
@yuumasato: This pull request references CMP-4655 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.1.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/retest |
|
PR needs rebase. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
3 participants
Note
This PR builds on top of #1329 (the oc-compliance port). Because it is
stacked, the diff currently includes the port commits, so it should be
reviewed/merged after #1329. Once #1329 merges, this branch will be
rebased onto
masterand the diff will reduce to just the commits below.CI failures originating in already-ported files (e.g. gofmt/
go vetinfetchraw/fetchfixes/controls/viewresult) belong to #1329, not to thischange.
What
Adds a new
oc compliance fetch-stig-resultssubcommand that converts theComplianceCheckResults produced by a STIGScanSettingBindinginto XCCDFresults files importable by DISA STIG Viewer, rewriting each rule id to its
DISA
SV-*_rulereference.Why
Users running the DISA STIG profiles (
ocp4-stig,rhcos4-stig) review andattest results in DISA STIG Viewer. Until now there was no way to produce a file
STIG Viewer can ingest with the DISA rule ids — this bridges Compliance Operator
results into that workflow.
How
control.compliance.openshift.io/STIG-RULEannotation the operatorsets on each result (the
SV-*_ruleid;;-separated when a check maps toseveral).
<TestResult>matchingoscap --stig-vieweroutput,which STIG Viewer imports natively.
importable against either the platform or node STIG since SV ids are globally
unique);
--per-scan= one file per scan;--scan <name>= a single scan.(
FAIL > ERROR > INCONSISTENT > MANUAL > INFO > no-result > PASS > NOT-APPLICABLE).Get(ScanSettingBinding) andList(ComplianceCheckResults); all writes are to the local output directory.
Testing
three output modes.
imports cleanly into DISA STIG Viewer.
Docs
cmd/oc-compliance/README.md(plugin overview) anddoc/stig-viewer-results.md(workflow, aggregation precedence table, importsteps, and the benign rule-revision mismatch note).
Image build
Also includes a plugin image build (
images/oc-compliance/Dockerfile+ Makefiletargets) so the plugin can be built and pushed to any registry: