new feature: check for compliance operator result

[tmishina]

Overview

Compliance Operator is a tool to validate that a cluster infrastructure complies with standard such as NIST SP 800-53, HIPAA or CIS Benchmark. It performs openscap command, and the command generates result report in XML format. Compliance Operator embeds the reoprt into .spec.data of a ConfigMap resource in the cluster, and therefore a consumer of the validation result needs to parse the XML data in the ConfigMap resource to show the details of the validation result.

This issue focuses on a check which generates a report by analyzing the XML report of Compliance Operator stored in a ConfigMap resource.

Requirements

• The check should generate a report showing compliance state of each control (identified by control ID) specified in an auditree config file linked with actual validation result (identified by XCCDF ID)
  • for example, a cluster infrastructure complies with NIST SP 800-53 control CA-3(5) if all of the following tests are PASS: xccdf_org.ssgproject.content_rule_set_firewalld_default_zone, xccdf_org.ssgproject.content_rule_configure_firewalld_ports

Approach

The check consumes ConfigMap resources fetched by cluster resource fetcher. The check extracts XML data from the ConfigMap resources, and then parses the XML to enumerate the result of each XCCDF test. Finally, the check decides whether a control is compliant or not by mapping the XCCDF results in XML to the control specified in an auditree config.

Security and Privacy

TBD

Test Plan

The test will be done against one public cluster service both for vanilla kube logic and public cloud logic.

[alfinkel]

Which check category folder do you expect this check to live in or will it be a new category?

[tmishina]

@alfinkel for this check, I would like to create a new category like compliance_operator, or openshift because the compliance operator is hosted in openshift organization.

[alfinkel]

Would the existing kubernetes category work here?

[tmishina]

Yes. I will use kubernetes.