Skip to content

Commit 56f6866

Browse files
ppc64le-cloud-botppc64le-cloud-bot
authored
Merge pull request #110 from AniruddhaNayek/disa_stig
Automate DISA-STIG profiles in CO
2 parents 233892c + 67bcc95 commit 56f6866

File tree

18 files changed

+1115
-0
lines changed

18 files changed

+1115
-0
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ This repository consists of additional ansible playbooks for the following:
4848
1. Validate Scheduler-Plugins
4949
1. Deploy Ingress Firewall Operator and run e2e.
5050
1. Validate CPU manager feature and run e2e.
51+
1. Enable DISA-STIG profiles for CO on P and remediate various rules
5152

5253
## Assumptions:
5354

‎examples/all.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -314,6 +314,14 @@ sso_github_username: ""
314314
sso_github_token: ""
315315
sso_cleanup: true
316316

317+
# ocp-disa-stig vars
318+
stig_compliance_enabled: false
319+
compliance_catalogsource: "redhat-operators"
320+
compliance_upgrade_channel: "stable"
321+
rhcos4_contentfile: "ssg-rhcos4-ds.xml"
322+
ocp4_contentfile: "ssg-ocp4-ds.xml"
323+
content_image: "ghcr.io/complianceascode/k8scontent:latest"
324+
317325
#ocp-verification-tests vars
318326
verification_enabled: false
319327
verification_dir: "/root/verification-tests"

‎examples/ocp_disa_stig_vars.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
# ocp-disa-stig vars
3+
stig_compliance_enabled: false
4+
compliance_catalogsource: "redhat-operators"
5+
compliance_upgrade_channel: "stable"
6+
rhcos4_contentfile: "ssg-rhcos4-ds.xml"
7+
ocp4_contentfile: "ssg-ocp4-ds.xml"
8+
content_image: "ghcr.io/complianceascode/k8scontent:latest"

‎playbooks/main.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,9 @@
6868
- import_playbook: ocp-compliance.yml
6969
when: compliance_enabled is defined and compliance_enabled
7070

71+
- import_playbook: ocp-disa-stig-compliance.yml
72+
when: stig_compliance_enabled is defined and stig_compliance_enabled
73+
7174
- import_playbook: hypershift.yml
7275
when: >
7376
(hypershift_install is defined and hypershift_install) or

‎playbooks/ocp-disa-stig-compliance.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# ocp-disa-stig-compliance
2+
---
3+
- name: Validate stig profiles
4+
hosts: bastion
5+
roles:
6+
- ocp-disa-stig-compliance

‎playbooks/roles/ocp-disa-stig-compliance/README.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
ocp-disa-stig-compliance
2+
========================
3+
4+
The Compliance Operator lets OpenShift Container Platform administrators describe the required compliance state of a cluster and provides them with an overview of gaps and ways to remediate them. The Compliance Operator assesses compliance of both the Kubernetes API resources of OpenShift Container Platform, as well as the nodes running the cluster. The Compliance Operator uses OpenSCAP, a NIST-certified tool, to scan and enforce security policies provided by the content.
5+
6+
This playbook installs Compliance Operator and enables:
7+
Various rhcos4 and ocp4 disa-stig profiles
8+
Remediate various rules under these profiles to make them compliant, ensuring validation of these profiles for CO on Power.
9+
10+
Requirements
11+
------------
12+
13+
- Access to the cluster as a user with the cluster-admin role.
14+
- The cluster is in a known good state, without any errors.
15+
- Default StorageClass must be configured
16+
17+
Role Variables
18+
--------------
19+
20+
Role Variables
21+
--------------
22+
| Variable | Required | Default | Comments |
23+
|--------------------------------|----------|-------------|------------------------------------------------|
24+
| stig_compliance_enabled | no | false | Set it to true to run this playbook |
25+
| compliance_catalogsource | yes | "redhat-operators" | Catlog source index image. default `redhat-operators` catalog source will be used |
26+
| compliance_upgrade_channel | yes | stable | Channel version for the compliance operator |
27+
| rhcos4_contentfile | yes | "ssg-rhcos4-ds.xml" | Location of the file containing the rhcos4 compliance content |
28+
| ocp4_contentfile | yes | "ssg-ocp4-ds.xml" | Location of the file containing the ocp4 compliance content |
29+
| content_image | yes | "ghcr.io/complianceascode/k8scontent:latest" | Content image location |
30+
31+
32+
Example Playbook
33+
----------------
34+
35+
```
36+
- name: Validate stig profiles
37+
hosts: bastion
38+
roles:
39+
- ocp-disa-stig-compliance
40+
```
41+
42+
Steps to run playbook
43+
----------------------
44+
45+
- Copy `ocp4-playbooks-extras/examples/inventory` file to the home or working directory and modify it to add a remote host
46+
- Copy the `ocp4-playbooks-extras/examples/ocp_disa_stig_vars.yaml` to the home or working directory and set the role variables for `roles/ocp-disa-stig-compliance` with the custom inputs.
47+
- To execute the playbook run the below sample command
48+
49+
50+
Sample Command
51+
---------------
52+
53+
ansible-playbook -i inventory -e @ocp_disa_stig_vars.yaml ~/ocp4-playbooks-extras/playbooks/ocp-disa-stig-compliance.yml
54+
55+
License
56+
-------
57+
58+
See LICENCE.txt
59+
60+
Author Information
61+
------------------
62+
63+
[email protected]

‎playbooks/roles/ocp-disa-stig-compliance/defaults/main.yml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
---
2+
# defaults file for playbooks/roles/ocp-disa-stig-compliance
3+
stig_compliance_enabled: false
4+
compliance_catalogsource: "redhat-operators"
5+
compliance_upgrade_channel: "stable"
6+
rhcos4_contentfile: "ssg-rhcos4-ds.xml"
7+
ocp4_contentfile: "ssg-ocp4-ds.xml"
8+
content_image: "ghcr.io/complianceascode/k8scontent:latest"

‎playbooks/roles/ocp-disa-stig-compliance/files/MC1.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
apiVersion: machineconfiguration.openshift.io/v1
2+
kind: MachineConfig
3+
metadata:
4+
labels:
5+
machineconfiguration.openshift.io/role: worker
6+
name: 80-worker-extensions
7+
spec:
8+
config:
9+
ignition:
10+
version: 3.1.0
11+
extensions:
12+
- usbguard

‎playbooks/roles/ocp-disa-stig-compliance/files/MC2.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
apiVersion: machineconfiguration.openshift.io/v1
2+
kind: MachineConfig
3+
metadata:
4+
name: 75-master-worker-enable
5+
labels:
6+
machineconfiguration.openshift.io/role: worker
7+
spec:
8+
config:
9+
ignition:
10+
version: 3.1.0
11+
systemd:
12+
units:
13+
- name: usbguard.service
14+
enabled: true

‎playbooks/roles/ocp-disa-stig-compliance/files/MC3.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
apiVersion: machineconfiguration.openshift.io/v1
2+
kind: MachineConfig
3+
metadata:
4+
name: 99-worker-usbguard-rules-conf
5+
labels:
6+
machineconfiguration.openshift.io/role: worker
7+
spec:
8+
config:
9+
ignition:
10+
version: 3.2.0
11+
storage:
12+
files:
13+
- path: /etc/usbguard/rules.conf
14+
contents:
15+
source: data:text/plain;charset=utf-8;base64,IyBSVUxFUwphbGxvdyB3aXRoLWludGVyZmFjZSBtYXRjaC1hbGwgeyAwMzoqOiogMDk6MDA6KiB9Cg==
16+
mode: 0600

0 commit comments

Comments
 (0)