-
Story
-
Resolution: Done
-
Normal
-
None
-
None
-
2
-
False
-
-
False
-
?
-
?
-
OSPRH-10439 - Compliance Scanning of RHOSO 18.0 - Control Plane [FR2]
-
?
-
?
-
-
-
DFG Security: UC Sprint 100, DFG Security: UC Sprint 101
The compliance operator cannot be used to run compliance scans against nodes that are not part of the openshift cluster (oc get nodes). Instead, we need to use standard RHEL mechanisms to run the scans against the compute nodes. This can help us determine what hardenings we will be able to use for compute nodes.
In fact, at some point, we can consider using some previously hardened OS images.
In the real world, a customer would likely manage scans with something like satellite - and we might even suggest this at some point.
For development purposes, though, as a first pass, we want to just run the scans in CI against at least one of the compute nodes. As they are all the same, this may be sufficient.
So, this task is to:
1. add code that runs in CI that starts a scan of a compute-node using something like in https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/scanning-the-system-for-configuration-compliance-and-vulnerabilities_security-hardening#configuration-compliance-tools-in-rhel_scanning-the-system-for-configuration-compliance-and-vulnerabilities
For example: (local command)
sudo oscap xccdf eval --report report.html --results stig-results.xml --profile xccdf_org.ssgproject.content_profile_stig /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
May be able to run remotely.