Uploaded image for project: 'Red Hat OpenStack Services on OpenShift'
  1. Red Hat OpenStack Services on OpenShift
  2. OSPRH-9346

Run compliance scans against the compute node(s) in CI

XMLWordPrintable

    • 2
    • False
    • Hide

      None

      Show
      None
    • False
    • ?
    • ?
    • OSPRH-10439 - Compliance Scanning of RHOSO 18.0 - Control Plane [FR2]
    • ?
    • ?
    • DFG Security: UC Sprint 100, DFG Security: UC Sprint 101

      The compliance operator cannot be used to run compliance scans against nodes that are not part of the openshift cluster (oc get nodes). Instead, we need to use standard RHEL mechanisms to run the scans against the compute nodes. This can help us determine what hardenings we will be able to use for compute nodes.

      In fact, at some point, we can consider using some previously hardened OS images.

      In the real world, a customer would likely manage scans with something like satellite - and we might even suggest this at some point.

      For development purposes, though, as a first pass, we want to just run the scans in CI against at least one of the compute nodes. As they are all the same, this may be sufficient.

      So, this task is to:
      1. add code that runs in CI that starts a scan of a compute-node using something like in https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/security_hardening/scanning-the-system-for-configuration-compliance-and-vulnerabilities_security-hardening#configuration-compliance-tools-in-rhel_scanning-the-system-for-configuration-compliance-and-vulnerabilities

      For example: (local command)
      sudo oscap xccdf eval --report report.html --results stig-results.xml --profile xccdf_org.ssgproject.content_profile_stig /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml

      May be able to run remotely.

              rhn-gps-alee Ade Lee
              rhn-gps-alee Ade Lee
              rhos-dfg-security
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated:
                Resolved: