Open git4rk opened 1 year ago
@edburns Please review the requirement and design for this feature request and provide sizing for these items so that we can plan the release (feel free to edit the list):
One question:
In section VM Images, CIS compliant RHEL 8.x is required for VM image. I tried to create a VM using CIS compliant RHEL 8.x and it will have additional charge for CIS Red Hat Enterprise Linux 8 Benchmark L1 by Center For Internet Security, Inc. (see screenshot below as an example), as CIS compliant RHEL 8.x is a Marketplace image. Is it OK?
@majguo @edburns Sorry, it took some time to finalize on this and it will undo some of the work that you have done. We have concluded that instead of using CIS image, we will use non-CIS VM and apply CIS rules to that VM.
The cost of CIS images might deter customers from using the VM Image offering. Here is the cost comparison for few VM types
Offering separate CIS and non-CIS Images will increase our dev and maintenance cost.
I investigated other options to use the non-CIS image and apply CIS rules to them. I found an open source tool from Red Hat, called openSCAP, which evaluates and remediates the CIS rules.
The tool reported 85% compatibility for CIS image from CIS Inc.
The tool reported 65% compatibility for RHEL 9.x image
After running the tool with remediation, the compatibility went up to 92%
oscap xccdf eval --remediate --profile xccdf_org.ssgproject.content_profile_cis_workstation_l1 --fetch-remote-resources --results scan_results.xml --report scan_report.html /usr/share/xml/scap/ssg/content/ssg-rhel9-ds.xml
The tool is available under LGPL 2.1 license and ok for us to use to build the image.
I have updated the issue detail based on this investigation.
Discussed this with @majguo last night. This looks solid and perfectly implementable.
@git4rk I judge this can be closed.
Goal
Provide tWAS VM Images Azure Marketplace offering for customers to create a customized tWAS Cluster/Single Server env on their own.
User experience
Deliverables
Requirement/Design
VM Images
virtualimage.properties
which will have products installed and their location on the VMMarketplace offerings
Test
Image and offering updates
Documentation
GTM
Additional tasks (should be handled separate from this feature)