SYS.1.6.A12

[benruland]

The sources of images that have been classified as trusted and SHOULD be adequately documented along with the corresponding reasons.

This requirement needs to be adressed on an organizational level.

Eine Idee für eine Regel:

• Erlaubte Registries im Cluster prüfen: image.config.openshift.io/cluster prüfen, ob dort registrySources.allowedRegistries gepflegt ist

In addition, the process of how images or the software components contained in an image are obtained from trusted sources and eventually deployed to a productive environment SHOULD be adequately documented.

This requirement needs to be adressed on an organizational level.

Images used SHOULD have metadata that makes their function and history traceable.

This requirement can not be checked using the compliance operator. However, the existance of certain image labels should be checked with a container security solution.

signatures SHOULD secure each image against modification.

Signierte Images: Können wir hier etwas prüfen?

[sluetze]

signatures SHOULD secure each image against modification.

we could create a rule which checks if the openshift cluster is configured to reject unsigned images: https://docs.openshift.com/container-platform/4.14/security/container_security/security-container-signature.html

[ermeratos]

applications/openshift/integrity/

rules:
- reject_unsigned_images_by_default

[lichtblaugue]

Pushed new branch https://github.com/sig-bsi-grundschutz/content/commit/db3cb46e8c4ebe85f9f4496fcc511c5943e2b5cf

[lichtblaugue]

Create a new branch, now based on master https://github.com/sig-bsi-grundschutz/content/tree/sys-1-6-A12-A13

[lichtblaugue]

correct link https://github.com/sig-bsi-grundschutz/content/tree/sys-1-6-A12-A13new

[sluetze]

https://github.com/ComplianceAsCode/content/pull/12370