Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-31510

rhcos4-stig - imagestream scans incorrectly

XMLWordPrintable

    • Quality / Stability / Reliability
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • No
    • None
    • Multi-Arch Sprint 255
    • 1
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      rhcos4-disa-stig
      applications/openshift/registry/imagestream_sets_schedule/rule.yml
      
      Fails even when the imagestreams are properly setup
      
      oc get compliancecheckresults -l 'compliance.openshift.io/scan-name in (ocp4-disa-stig-stig, ocp4-disa-stig-stig-node-worker, ocp4-disa-stig-stig-node-master)' | grep imagestream
      ocp4-disa-stig-stig-imagestream-sets-schedule                                                    FAIL     medium
      
      

      Version-Release number of selected component (if applicable):

      Compliance Operator 1.4.1

      How reproducible:

      Every time 

      Steps to Reproduce:

      1.Create Compliance Operator with disa-stig rhcos4 node profile
      
      2.Create ScanSettingBinding
      
      apiVersion: compliance.openshift.io/v1alpha1
      kind: ScanSettingBinding
      metadata:
        name: ocp4-stig-compliance
        namespace: openshift-compliance
      profiles:
        - name: ocp4-stig
          kind: Profile
          apiGroup: compliance.openshift.io/v1alpha1
        - name: ocp4-stig-node
          kind: Profile
          apiGroup: compliance.openshift.io/v1alpha1
      settingsRef:
        name: default
        kind: ScanSetting
        apiGroup: compliance.openshift.io/v1alpha1
       
      3. Check the ComplianceCheckResults for imagestream-sets-schedule
      
      oc get compliancecheckresults -l 'compliance.openshift.io/scan-name in (ocp4-disa-stig-stig, ocp4-disa-stig-stig-node-worker, ocp4-disa-stig-stig-node-master)' | grep imagestream
      
      
      4. Grab the instructions
      
       oc get imagestreams -A -ojson | jq -r '.items[] | select(.spec.tags[]?.importPolicy.scheduled != true) | "\(.metadata.name),\(.metadata.namespace)"' | sort | uniq
           

      Actual results:

      The instructions / description and check are incorrect.

      from.kind should be used to consider DockerImage and not ImageStreamTag

      Expected results:

      Rule should be marked PASS

      Additional info:

          

              pbastide_rh Paul Bastide
              pbastide_rh Paul Bastide
              None
              None
              Doug Slavens Doug Slavens (Inactive)
              None
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: