The rule audit-log-forwarding-uses-tls fail even if tls enabled for clusterloggerforwarder for openshift logging operator v6.1
% oc get ccr | grep audit-log-forwarding
ocp4-moderate-audit-log-forwarding-enabled                                                          PASS     medium
ocp4-moderate-audit-log-forwarding-uses-tls                                                         FAIL     medium
 % oc get -n openshift-logging clusterlogforwarders -o json | jq 'try [.items[].spec.outputs[][]|objects|.url] catch []
'
[
  "tls://rsyslog.e2e-test-vector-syslog-64tbl.svc:6514",
  null
]
 % oc get daemonset -n openshift-logging
NAME       DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR            AGE
instance   6         6         6       6            6           kubernetes.io/os=linux   105m
 
% oc get -n openshift-logging clusterlogforwarders instance -o yaml                                                   
apiVersion: observability.openshift.io/v1
kind: ClusterLogForwarder
metadata:
  creationTimestamp: "2024-12-20T05:16:41Z"
  generation: 1
  name: instance
  namespace: openshift-logging
  resourceVersion: "137177"
  uid: b2f3728e-e1ca-40af-8a5f-b4d68ffdddb1
spec:
  managementState: Managed
  outputs:
  - name: external-syslog
    syslog:
      facility: local0
      rfc: RFC5424
      severity: informational
      url: tls://rsyslog.e2e-test-vector-syslog-64tbl.svc:6514
    tls:
      ca:
        key: ca-bundle.crt
        secretName: rsyslog-tls
    type: syslog
  pipelines:
  - inputRefs:
    - infrastructure
    - audit
    - application
    name: forward-to-external-syslog
    outputRefs:
    - external-syslog
  serviceAccount:
    name: test-clf-s9ntu4bc
status:
  conditions:
  - lastTransitionTime: "2024-12-20T05:16:41Z"
    message: 'permitted to collect log types: [application audit infrastructure]'
    reason: ClusterRolesExist
    status: "True"
    type: observability.openshift.io/Authorized
  - lastTransitionTime: "2024-12-20T05:16:41Z"
    message: ""
    reason: ValidationSuccess
    status: "True"
    type: observability.openshift.io/Valid
  - lastTransitionTime: "2024-12-20T05:16:46Z"
    message: ""
    reason: ReconciliationComplete
    status: "True"
    type: Ready
  inputConditions:
  - lastTransitionTime: "2024-12-20T07:00:42Z"
    message: input "infrastructure" is valid
    reason: ValidationSuccess
    status: "True"
    type: observability.openshift.io/ValidInput-infrastructure
  - lastTransitionTime: "2024-12-20T07:00:42Z"
    message: input "audit" is valid
    reason: ValidationSuccess
    status: "True"
    type: observability.openshift.io/ValidInput-audit
  - lastTransitionTime: "2024-12-20T07:00:42Z"
    message: input "application" is valid
    reason: ValidationSuccess
    status: "True"
    type: observability.openshift.io/ValidInput-application
  outputConditions:
  - lastTransitionTime: "2024-12-20T05:16:41Z"
    message: output "external-syslog" is valid
    reason: ValidationSuccess
    status: "True"
    type: observability.openshift.io/ValidOutput-external-syslog
  pipelineConditions:
  - lastTransitionTime: "2024-12-20T05:16:41Z"
    message: pipeline "forward-to-external-syslog" is valid
    reason: ValidationSuccess
    status: "True"
    type: observability.openshift.io/ValidPipeline-forward-to-external-syslog

    Always

1. Install openshift loggingv0.6.1 
2. Create clusterlogforwarder with tls enabled 
3. Install CO from latest upstream code
4. Create a ssb with ocp4-moderate profile and default ss
    

Rule audit-log-forwarding-uses-tls FAIL when tls enabled for clusterloggerforwarder for openshift logging operator v6.1

% oc get ccr | grep audit-log-forwarding
ocp4-moderate-audit-log-forwarding-enabled                                                          PASS     medium
ocp4-moderate-audit-log-forwarding-uses-tls                                                         FAIL     medium    

Rule audit-log-forwarding-uses-tls should PASS when tls enabled for clusterloggerforwarder for openshift logging operator v6.1