-
Bug
-
Resolution: Not a Bug
-
Normal
-
None
-
Alongside OpenShift 4.11
-
None
-
False
-
None
-
False
Rule example-scan-kubelet-configure-event-creation not found after creating compliance suite.
Polarian test: OCP-37063
Compliance operator: v0.1.55
Cluster version: 4.11.5 and Architecture: Power
1. Install Compliance operator v0.1.55 using index image registry-proxy.engineering.redhat.com/rh-osbs/iib:320188.
2. set labels to all rhcos workers:
$ for i in `oc get node -o wide | grep "worker" | grep "Ootpa" | awk '{print $1}'`; do oc label node $i node-role.kubernetes.io/rhcosw=; done
3. Create ComplianceSuite
oc create -f - <<EOF
apiVersion: compliance.openshift.io/v1alpha1
kind: ComplianceSuite
metadata:
name: worker-scan
spec:
autoApplyRemediations: false
schedule: "0 1 * * *"
scans:
- name: example-scan
profile: xccdf_org.ssgproject.content_profile_cis-node
content: ssg-ocp4-ds.xml
contentImage: registry.redhat.io/compliance/openshift-compliance-content-rhel8@sha256:0c8ee1d7d1ef266d96da7fc4c8003043983f370d85983ad476ee92ec7b604ddc
debug: true
nodeSelector:
node-role.kubernetes.io/rhcosw: ""
EOF
4. check the scan result
#oc get scan
NAME PHASE RESULT
example-scan DONE NON-COMPLIANT
#oc get compliancesuite
NAME PHASE RESULT
worker-scan DONE NON-COMPLIANT
#oc get ccr | grep kubelet-con
example-scan-file-groupowner-kubelet-conf PASS medium
example-scan-file-owner-kubelet-conf PASS medium
example-scan-file-permissions-kubelet-conf PASS medium
Result:
Rule "example-scan-kubelet-configure-event-creation" not found.
Expected result:
rule "example-scan-kubelet-configure-event-creation" in FAIL status.
logs: https://drive.google.com/file/d/1rexBckwkrsQdAkqF109TIc0U7QAtPqBb/view?usp=sharing