Uploaded image for project: 'OpenShift Bugs'
  1. OpenShift Bugs
  2. OCPBUGS-9382

can't disable rule ocp4-kubeadmin-removed

XMLWordPrintable

    • Quality / Stability / Reliability
    • None
    • None
    • 5
    • Moderate
    • None
    • All
    • None
    • None
    • None
    • CMP Sprint 63, CMP Sprint 64, CMP Sprint 65, CMP Sprint 66, CMP Sprint 67, CMP Sprint 68, CMP Sprint 69, CMP Sprint 70, CMP Sprint 71, CMP Sprint 72, CMP Sprint 73, CMP Sprint 74, CMP Sprint 75
    • 13
    • None
    • If docs needed, set a value
    • None
    • None
    • None
    • None
    • None

      Description of problem:

      can't disable rule ocp4-kubeadmin-removed, this bug has been opened to get information about how to get the rule disabled.

      Version-Release number of selected component (if applicable):
      OCP 4.x
      Compliance Operator 1.52

      How reproducible:

      Steps to Reproduce:
      1. Create the tailored profiles:

      $ oc get tailoredprofiles.compliance.openshift.io
      NAME STATE
      ocp4-cis-kubeadmin-disable READY ---> tailored profile for ocp4-kubeadmin-remove rule
      ocp4-cis-modified READY ---> tailored profile to disable others plataform rules
      ocp4-cis-node-modified READY ---> tailored profile to disable ocp4-cis-node rules

      2. Create the ssb :
      $ cat tailoring-scansettingbinging-v2.yaml
      apiVersion: compliance.openshift.io/v1alpha1
      kind: ScanSettingBinding
      metadata:
      name: rh-benchmark-tailored
      profiles:

      • apiGroup: compliance.openshift.io/v1alpha1
        kind: TailoredProfile
        name: ocp4-cis-modified
      • apiGroup: compliance.openshift.io/v1alpha1
        kind: TailoredProfile
        name: ocp4-cis-node-modified
      • apiGroup: compliance.openshift.io/v1alpha1
        kind: TailoredProfile
        name: ocp4-cis-kubeadmin-disable
        settingsRef:
        apiGroup: compliance.openshift.io/v1alpha1
        kind: ScanSetting
        name: rhocp-benchmark-1-1
        $ oc create -f tailoring-scansettingbinging-v2.yaml

      $ oc get suites
      NAME PHASE RESULT
      rh-benchmark-tailored DONE NON-COMPLIANT

      3. Verify if rule was disabled:
      $ oc get ccr | grep removed
      ocp4-cis-modified-kubeadmin-removed FAIL medium

      Actual results:
      The rule is reported as FAIL

      Expected results:
      The should not appear

              lbragsta@redhat.com Lance Bragstad
              rhn-support-pescorza Pamela Lizeth Escorza Gil
              None
              None
              None
              None
              Red Hat Employee
              Votes:
              0 Vote for this issue
              Watchers:
              5 Start watching this issue

                Created:
                Updated:
                Resolved: