Uploaded image for project: 'Red Hat Advanced Cluster Security'
  1. Red Hat Advanced Cluster Security
  2. ROX-31207

"Negate" policy variable not working as expected

    • False
    • Hide

      None

      Show
      None
    • False

      USER PROBLEM
      What is the user experiencing as a result of the bug? Include steps to reproduce.

      • The needs:  Alerts on deployments using environment variables with keys 'PASSWORD' or 'SECRET', while specifically excluding a known ArgoCD secret path. This policy aims to flag other sensitive secrets or passwords, but ignore the managed ArgoCD secret.
      • Customer used "negate" to get polic to avoid flagging RAW=SECRET=/secret/data/app/argocd/secret$ but the policy is not working as expected.
      • After testing in 4.8.4, recieved this error from the API. 
        {"code":3, "message":"policy invalid error: error validating lifecycle stage error: policy configuration is invalid for deploy time: policy validation error: validation of section \"Don't trigger on Argo Secrets\" error: policy criteria \"Environment Variable\" cannot be negated: invalid arguments", "details":[], "error":"policy invalid error: error validating lifecycle stage error: policy configuration is invalid for deploy time: policy validation error: validation of section \"Don't trigger on Argo Secrets\" error: policy criteria \"Environment Variable\" cannot be negated: invalid arguments"} 
      • Showing that ability is not recognized by RHACS. But "Negate": False shows up in the export function leading users to believe they can set it to true.

      CONDITIONS
      What conditions need to exist for a user to be affected? Is it everyone? Is it only those with a specific integration? Is it specific to someone with particular database content? etc.

      • pending

      ROOT CAUSE
      What is the root cause of the bug?

      • pending

      FIX
      How was the bug fixed (this is more important if a workaround was implemented rather than an actual fix)?

      • Need better error messages for PaC to be functional. 

              bmichael@redhat.com Boaz Michaely
              mfoster@redhat.com Michael Foster
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Created:
                Updated: