Skip to content

Commit 3c4f554

Browse files
sheriff-rhsheriff-rh
authored
Merge pull request #58995 from sheriff-rh/OCPBUGS-6875
2 parents 7e460b5 + e902e90 commit 3c4f554

File tree

4 files changed

+53
-6
lines changed

4 files changed

+53
-6
lines changed

‎modules/compliance-profiles.adoc

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,8 @@ $ oc get -n openshift-compliance -oyaml profiles.compliance rhcos4-e8
4646
----
4747
+
4848
.Example output
49+
[%collapsible]
50+
====
4951
[source,yaml]
5052
----
5153
apiVersion: compliance.openshift.io/v1alpha1
@@ -129,6 +131,7 @@ rules:
129131
- rhcos4-sysctl-net-core-bpf-jit-harden
130132
title: Australian Cyber Security Centre (ACSC) Essential Eight
131133
----
134+
====
132135
133136
* Run the following command to view the details of the `rhcos4-audit-rules-login-events` rule:
134137
+
@@ -138,6 +141,8 @@ $ oc get -n openshift-compliance -oyaml rules rhcos4-audit-rules-login-events
138141
----
139142
+
140143
.Example output
144+
[%collapsible]
145+
====
141146
[source,yaml]
142147
----
143148
apiVersion: compliance.openshift.io/v1alpha1
@@ -186,4 +191,18 @@ title: Record Attempts to Alter Logon and Logout Events
186191
warning: Manual editing of these files may indicate nefarious activity, such as an
187192
attacker attempting to remove evidence of an intrusion.
188193
----
194+
====
189195
196+
[id="compliance_profile_types{context}"]
197+
== Compliance Operator profile types
198+
199+
There are two types of compliance profiles available: Platform and Node.
200+
201+
Platform:: Platform scans target your {product-title} cluster.
202+
203+
Node:: Node scans target the nodes of the cluster.
204+
205+
[IMPORTANT]
206+
====
207+
For compliance profiles that have Node and Platform applications, such as `pci-dss` compliance profiles, you must run both in your {product-title} environment.
208+
====

‎modules/compliance-supported-profiles.adoc

Lines changed: 25 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -2,114 +2,134 @@
22
//
33
// * security/compliance_operator/
44

5+
:_content-type: CONCEPT
56
[id="compliance-supported-profiles_{context}"]
67
= Compliance profiles
78

89
The Compliance Operator provides the following compliance profiles:
910

1011
.Supported compliance profiles
11-
[cols="10%,40%,10%,40%,10%", options="header"]
12+
[cols="10%,40%,10%,10%,40%,10%", options="header"]
1213

1314
|===
1415
|Profile
1516
|Profile title
17+
|Application
1618
|Compliance Operator version
1719
|Industry compliance benchmark
1820
|Supported architectures
1921

2022
|ocp4-cis
2123
|CIS Red Hat OpenShift Container Platform 4 Benchmark
24+
|Platform
2225
|0.1.39+
23-
|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks ™] footnote:cisbenchmark[To locate the CIS RedHat OpenShift Container Platform v4 Benchmark, go to link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks] and type `Kubernetes` in the search box. Click on *Kubernetes* and then *Download Latest CIS Benchmark*, where you can then register to download the benchmark.]
26+
|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks ™] ^[1]^
2427
|`x86_64`
2528
`ppc64le`
2629
`s390x`
2730

2831
|ocp4-cis-node
2932
|CIS Red Hat OpenShift Container Platform 4 Benchmark
33+
|Node ^[2]^
3034
|0.1.39+
31-
|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks ™] footnote:cisbenchmark[]
35+
|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks ™] ^[1]^
3236
|`x86_64`
3337
`ppc64le`
3438
`s390x`
3539

3640
|ocp4-e8
3741
|Australian Cyber Security Centre (ACSC) Essential Eight
42+
|Platform
3843
|0.1.39+
3944
|link:https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers[ACSC Hardening Linux Workstations and Servers]
4045
|`x86_64`
4146

4247
|ocp4-moderate
4348
|NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level
49+
|Platform
4450
|0.1.39+
4551
|link:https://nvd.nist.gov/800-53/Rev4/impact/moderate[NIST SP-800-53 Release Search]
4652
|`x86_64`
4753

4854
|rhcos4-e8
4955
|Australian Cyber Security Centre (ACSC) Essential Eight
56+
|Node
5057
|0.1.39+
5158
|link:https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers[ACSC Hardening Linux Workstations and Servers]
5259
|`x86_64`
5360

5461
|rhcos4-moderate
5562
|NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS
63+
|Node
5664
|0.1.39+
5765
|link:https://nvd.nist.gov/800-53/Rev4/impact/moderate[NIST SP-800-53 Release Search]
5866
|`x86_64`
5967

6068
|ocp4-moderate-node
6169
|NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level
70+
|Node ^[2]^
6271
|0.1.44+
6372
|link:https://nvd.nist.gov/800-53/Rev4/impact/moderate[NIST SP-800-53 Release Search]
6473
|`x86_64`
6574

6675
|ocp4-nerc-cip
6776
|North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Platform level
77+
|Platform
6878
|0.1.44+
6979
|link:https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx[NERC CIP Standards]
7080
|`x86_64`
7181

7282
|ocp4-nerc-cip-node
7383
|North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for the Red Hat OpenShift Container Platform - Node level
84+
|Node ^[2]^
7485
|0.1.44+
7586
|link:https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx[NERC CIP Standards]
7687
|`x86_64`
7788

7889
|rhcos4-nerc-cip
7990
|North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) cybersecurity standards profile for Red Hat Enterprise Linux CoreOS
91+
|Node
8092
|0.1.44+
8193
|link:https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx[NERC CIP Standards]
8294
|`x86_64`
8395

8496
|ocp4-pci-dss
8597
|PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
98+
|Platform
8699
|0.1.47+
87100
|link:https://www.pcisecuritystandards.org/document_library?document=pci_dss[PCI Security Standards ® Council Document Library]
88101
|`x86_64`
89102
`ppc64le`
90103

91104
|ocp4-pci-dss-node
92105
|PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4
106+
|Node ^[2]^
93107
|0.1.47+
94108
|link:https://www.pcisecuritystandards.org/document_library?document=pci_dss[PCI Security Standards ® Council Document Library]
95109
|`x86_64`
96110
`ppc64le`
97-
111+
98112
|ocp4-high
99113
|NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level
114+
|Platform
100115
|0.1.52+
101116
|link:https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53[NIST SP-800-53 Release Search]
102117
|`x86_64`
103118

104119
|ocp4-high-node
105120
|NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Node level
121+
|Node ^[2]^
106122
|0.1.52+
107123
|link:https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53[NIST SP-800-53 Release Search]
108124
|`x86_64`
109125

110126
|rhcos4-high
111127
|NIST 800-53 High-Impact Baseline for Red Hat Enterprise Linux CoreOS
128+
|Node
112129
|0.1.52+
113130
|link:https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/800-53[NIST SP-800-53 Release Search]
114131
|`x86_64`
115-
|===
132+
|===
133+
[.small]
134+
1. To locate the CIS {product-title} v4 Benchmark, go to link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks] and type `Kubernetes` in the search box. Click on *Kubernetes* and then *Download Latest CIS Benchmark*, where you can then register to download the benchmark.
135+
2. Node profiles must be used with the relevant Platform profile. For more information, see xref:../../security/compliance_operator/compliance-operator-understanding.adoc#compliance_profile_typesunderstanding-compliance[Compliance Operator profile types].

‎security/compliance_operator/compliance-operator-supported-profiles.adoc

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,4 +17,6 @@ include::modules/compliance-supported-profiles.adoc[leveloffset=+1]
1717
[role="_additional-resources"]
1818
== Additional resources
1919

20-
* For more information about viewing the compliance profiles available in your system, see xref:../../security/compliance_operator/compliance-operator-understanding.adoc#compliance_profiles_understanding-compliance[Compliance Operator profiles] in Understanding the Compliance Operator.
20+
* xref:../../security/compliance_operator/compliance-operator-understanding.adoc#compliance_profiles_understanding-compliance[Compliance Operator profiles]
21+
22+
* xref:../../security/compliance_operator/compliance-operator-understanding.adoc#compliance_profile_typesunderstanding-compliance[Compliance Operator profile types]

‎security/compliance_operator/compliance-operator-understanding.adoc

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,3 +14,9 @@ The Compliance Operator is available for {op-system-first} deployments only.
1414
====
1515

1616
include::modules/compliance-profiles.adoc[leveloffset=+1]
17+
18+
[id="additional-resources_compliance-operator-understanding"]
19+
[role="_additional-resources"]
20+
== Additional resources
21+
22+
* xref:../../security/compliance_operator/compliance-operator-supported-profiles.html#compliance-operator-supported-profiles[Supported compliance profiles]

0 commit comments

Comments
 (0)