This PR enables the OCP4 checks for the control-plane components of managed OpenShift services such as HyperShift.
In a managed OpenShift environment, some check target API resources are moved to locations which is not expected in the rules of ComplianceAsCode/content.
This PR solves the issue of the check target location by following changes. After this modification, user can specify the location in XCCDF variables at runtime.
a jinja macro to embed a variable which points to a resource
a jinja macro to specify a variable which points to the filepath for the resource
actural rules for HyperShift clusters
For item 1, as of now, we use a new macro openshift_resource_path_xccdf to embed a reference to a variable.
(This part will be replaced a new code because of the discussion in the other PR)
For the item 2, my PR introduces a new element filepath_xccdf_variable in .templates.yamlfile_value of rule.yml. However, is not smart - filepath is still required to avoid error.
I'd like to start discussion from this topics (comment on the CO repo) about filepath_xccdf_variable - how to avoid using two elements in a single yamlfile_value template?
Rationale
This PR expands the capability of ComplianceAsCode/content and Compliance Operator to various kinds of installations including managed OpenShift Services
tmishina
commented
2 years ago
Description
This PR enables the OCP4 checks for the control-plane components of managed OpenShift services such as HyperShift.
In a managed OpenShift environment, some check target API resources are moved to locations which is not expected in the rules of ComplianceAsCode/content.
This PR solves the issue of the check target location by following changes. After this modification, user can specify the location in XCCDF variables at runtime.
For item 1, as of now, we use a new macro
openshift_resource_path_xccdfto embed a reference to a variable. (This part will be replaced a new code because of the discussion in the other PR)For the item 2, my PR introduces a new element
filepath_xccdf_variablein.templates.yamlfile_valueof rule.yml. However, is not smart -filepathis still required to avoid error.I'd like to start discussion from this topics (comment on the CO repo) about
filepath_xccdf_variable- how to avoid using two elements in a single yamlfile_value template?Rationale
Related Topics