Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-6906

Compliance check results are missing for some rules available in TailoredProfile

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Undefined Undefined
    • None
    • 4.10.z
    • Compliance Operator
    • False
    • Hide

      None

      Show
      None

      Description of problem:

      Compliance check results are missing for rules available in TailoredProfile. I have tried the scenario on OCP 4.10 cluster on Power.

      Version-Release number of selected component (if applicable):

      Compliance operator v0.1.60

      How reproducible:

      Every time

      Steps to Reproduce:

      1. Install compliance operator using index image:  registry-proxy.engineering.redhat.com/rh-osbs/iib:421196
      # oc get csv
      NAME                          DISPLAY               VERSION   REPLACES   PHASE
      compliance-operator.v0.1.60   Compliance Operator   0.1.60               Succeeded# oc get pods
      NAME                                              READY   STATUS    RESTARTS      AGE
      compliance-operator-796cf58b9c-vx5jm              1/1     Running   1 (19h ago)   19h
      ocp4-openshift-compliance-pp-588f7498d7-2ksn4     1/1     Running   0             19h
      rhcos4-openshift-compliance-pp-6684c8b559-wsxgm   1/1     Running   0             19h# oc get prof
      NAME                AGE
      ocp4-cis            19h
      ocp4-cis-node       19h
      ocp4-pci-dss        19h
      ocp4-pci-dss-node   19h
      
      2. create a tailored profile:
      # oc apply -f -<<EOF
      > apiVersion: compliance.openshift.io/v1alpha1
      > kind: TailoredProfile
      > metadata:
      >   name: testprofile
      >   namespace: openshift-compliance
      > spec:
      >   description: test
      >   title: test
      >   enableRules:
      >     - name: ocp4-kubelet-anonymous-auth
      >       rationale: test
      >     - name: ocp4-kubelet-authorization-mode
      >       rationale: test
      >     - name: ocp4-kubelet-configure-client-ca
      >       rationale: test
      >     - name: ocp4-kubelet-configure-event-creation
      >       rationale: test
      >     - name: ocp4-kubelet-configure-tls-cipher-suites
      >       rationale: test
      >     - name: ocp4-kubelet-enable-cert-rotation
      >       rationale: test
      >     - name: ocp4-kubelet-enable-iptables-util-chains
      >       rationale: test
      >     - name: ocp4-kubelet-enable-server-cert-rotation
      >       rationale: test
      >     - name: ocp4-kubelet-enable-streaming-connections
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-hard-imagefs-available
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-hard-imagefs-inodesfree
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-hard-memory-available
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-hard-nodefs-available
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-hard-nodefs-inodesfree
      >       rationale: test
            rationale: test
          - name: ocp4-kubelet-eviction-thresholds-set-soft-imagefs-inodesfree
      >     - name: ocp4-kubelet-eviction-thresholds-set-soft-imagefs-available
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-soft-imagefs-inodesfree
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-soft-memory-available
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-soft-nodefs-available
      >       rationale: test
      >     - name: ocp4-kubelet-eviction-thresholds-set-soft-nodefs-inodesfree
      >       rationale: test
      >   setValues:
      >     - name: ocp4-var-streaming-connection-timeouts
      >       value: "5h0m0s"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionhard-imagefs-available
      >       value: "15%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionhard-imagefs-inodesfree
      >       value: "5%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionhard-memory-available
      >       value: "300Mi"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionhard-nodefs-available
            rationale: test
      >       value: "10%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionhard-nodefs-inodesfree
      >       value: "5%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionsoft-imagefs-available
      >       value: "15%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionsoft-imagefs-inodesfree
      >       value: "11%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionsoft-memory-available
      >       value: "600Mi"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionsoft-nodefs-available
      >       value: "10%"
      >       rationale: test
      >     - name: ocp4-var-kubelet-evictionsoft-nodefs-inodesfree
      >       value: "5%"
      >       rationale: test
      >       setValues:
      >     - name: ocp4-var-kubelet-tls-cipher-suites-regex
      >       rationale: Node
      >       value: '^(TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256)$'
      >     - name: ocp4-var-kubelet-tls-cipher-suites
      >       rationale: Platform
      >       value: "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"
      > EOF
      oc get ttailoredprofile.compliance.openshift.io/testprofile created
      
      3. crate a ssb with the tailored profile:
      # oc apply -f -<<EOF
      > apiVersion: compliance.openshift.io/v1alpha1
      > kind: ScanSettingBinding
      > metadata:
      >   name: my-ssb-r
      > profiles:
      >   - name: testprofile
      >     kind: TailoredProfile
      >     apiGroup: compliance.openshift.io/v1alpha1
      > settingsRef:
      >   name: default-auto-apply
      >   kind: ScanSetting
      >   apiGroup: compliance.openshift.io/v1alpha1
      > EOF
      scansettingbinding.compliance.openshift.io/my-ssb-r created
      
      # oc get suite -w
      NAME       PHASE     RESULT
      my-ssb-r   RUNNING   NOT-AVAILABLE
      my-ssb-r   AGGREGATING   NOT-AVAILABLE
      my-ssb-r   DONE          NON-COMPLIANT
      ^C
       

      Actual results:

      Check ComplianceCheckResult
      
      # oc get ccr
      NAME                                                                  STATUS   SEVERITY
      testprofile-kubelet-configure-event-creation                          PASS     medium
      testprofile-kubelet-eviction-thresholds-set-hard-imagefs-available    PASS     medium
      testprofile-kubelet-eviction-thresholds-set-hard-imagefs-inodesfree   FAIL     medium
      testprofile-kubelet-eviction-thresholds-set-hard-memory-available     FAIL     medium
      testprofile-kubelet-eviction-thresholds-set-hard-nodefs-available     PASS     medium
      testprofile-kubelet-eviction-thresholds-set-hard-nodefs-inodesfree    PASS     medium
      testprofile-kubelet-eviction-thresholds-set-soft-imagefs-available    FAIL     medium
      testprofile-kubelet-eviction-thresholds-set-soft-imagefs-inodesfree   FAIL     medium
      testprofile-kubelet-eviction-thresholds-set-soft-memory-available     FAIL     medium
      testprofile-kubelet-eviction-thresholds-set-soft-nodefs-available     FAIL     medium
      testprofile-kubelet-eviction-thresholds-set-soft-nodefs-inodesfree    FAIL     medium
      
      Following are the 8 missing CCR:
      testprofile-kubelet-anonymous-auth                                         medium
      testprofile-kubelet-authorization-mode                                     medium
      testprofile-kubelet-configure-client-ca                                    medium
      testprofile-kubelet-configure-tls-cipher-suites                            medium
      testprofile-kubelet-enable-cert-rotation                                   medium
      testprofile-kubelet-enable-iptables-util-chains                            medium
      testprofile-kubelet-enable-server-cert-rotation                            medium
      testprofile-kubelet-enable-streaming-connections                           medium 

      Expected results:

      ComplianceCheckResult should be available for all the rules specified in TailoredProfile

      Additional info:

      Must gather logs:https://drive.google.com/file/d/1VD0x09eltT_zFkhEMKZAShU2iY9nKlth/view?usp=share_link

            wenshen@redhat.com Vincent Shen
            vahirwad Varad Ahirwadkar
            Xiaojie Yuan Xiaojie Yuan
            Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

              Created:
              Updated:
              Resolved: