CMP-3834: Add CIS profiles auto-remediation test#77
CMP-3834: Add CIS profiles auto-remediation test#77taimurhafeez wants to merge 1 commit intoComplianceAsCode:mainfrom
Conversation
|
@taimurhafeez: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
rhmdnd
left a comment
rhmdnd
left a comment
There was a problem hiding this comment.
I'm curious on the direction of this test since it's profile specific, where historically these tests have been willing to accept any profile offered by the operator.
| } | ||
| } | ||
|
|
||
| // TestCISProfiles tests auto-remediation for CIS profiles. |
There was a problem hiding this comment.
This seems to do a lot of what TestProfileRemediations already does when running it with the CIS profiles.
Is there a way we can incorporate the test paths for MCP/KubeletConfig setup and etcd encryption into the TestProfileRemediations path?
Most of the testing here is independent of any particular profile. It's mostly designed to take a profile, and run it through scans and remediation in a generic way, then asserts the final scan state. This change takes that pattern in a new direction, where we're starting build profile-specific behavior into the tests themselves (e.g., we wouldn't reuse TestCISProfiles with another but the cis and cis-node profiles).
Thoughts?
2 participants
The test validates that auto-remediation works correctly for CIS profiles by:
ocp4-cisandocp4-cis-nodeprofilesThe test case requires encryption to be enabled on the cluster first, which might take some time. The command to enable encryption is
oc patch apiserver cluster --type=merge -p '{"spec":{"encryption":{"type":"aesgcm"}}}'It will take some time. To know if the next command can be executed, in a seperate terminal we can monitor it for every 30 seconds:
watch -n 30 "oc get co kube-apiserver openshift-apiserver"And when progressing is
Falsefor bothkube-apiserverandopenshift-apiserver,then we can run the test with the following commandgo test -v -timeout 120m . -run=^TestCISProfiles$ \ -install-operator=trueOutput on OCP 4.22: