Defined notes and rules for BSI APP.4.4.A18 #12154

benruland · 2024-07-15T13:21:25Z

Description:
Notes / Rules for BSI APP4.4.A17

Rationale:
As we have multiple customers asking for a BSI profile to be included in the compliance-operator, we are contributing a profile. To provide a better review process, the individual controle are implemented as separate PRs.

This is a follow-up of #11659. It was breaken up for better reviewability.

openshift-ci · 2024-07-15T13:21:36Z

Hi @benruland. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2024-07-15T13:24:06Z

Start a new ephemeral environment with changes proposed in this pull request:

ocp4 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-07-15T14:49:28Z

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_network_policies'.
--- xccdf_org.ssgproject.content_rule_configure_network_policies
+++ xccdf_org.ssgproject.content_rule_configure_network_policies
@@ -20,6 +20,9 @@
 
 [reference]:
 APP.4.4.A7
+
+[reference]:
+APP.4.4.A18
 
 [reference]:
 CIP-003-8 R6

New content has different text for rule 'xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces'.
--- xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces
+++ xccdf_org.ssgproject.content_rule_configure_network_policies_namespaces
@@ -23,6 +23,9 @@
 
 [reference]:
 APP.4.4.A7
+
+[reference]:
+APP.4.4.A18
 
 [reference]:
 CIP-003-8 R4

New content has different text for rule 'xccdf_org.ssgproject.content_rule_project_template_network_policy'.
--- xccdf_org.ssgproject.content_rule_project_template_network_policy
+++ xccdf_org.ssgproject.content_rule_project_template_network_policy
@@ -19,6 +19,9 @@
     file.
 
 [reference]:
+APP.4.4.A18
+
+[reference]:
 SRG-APP-000039-CTR-000110
 
 [rationale]:

github-actions · 2024-07-15T15:15:33Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12154
This image was built from commit: 2bb18f7

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12154

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12154 make deploy-local

codeclimate · 2024-07-15T15:34:46Z

Code Climate has analyzed commit 2bb18f7 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

sluetze · 2024-07-16T11:39:51Z

controls/bsi_app_4_4.yml

-    status: pending
-    rules: []
+      In a cluster using a network plugin that supports Kubernetes network policy, network isolation
+      is controlled entirely by NetworkPolicy objects. In OpenShift, the default plugins (OpenShift SDN,


we should remove OpenShift SDN as it is deprecated

sluetze · 2024-07-16T11:42:17Z

applications/openshift/networking/configure_appropriate_network_policies/rule.yml

+    precisely define source and target using label selectors and ports.
+
+    1. Get a list of existing projects(namespaces), exclude default, kube-*, openshift-*
+    <pre>$ oc get namespaces -ojson | jq -r '[.items[] | select((.metadata.name | startswith("openshift") | not) and (.metadata.name | startswith("kube-") | not) and .metadata.name != "default") | .metadata.name]'</pre>


imho we should make the list of exceptions configurable. There are customers, which have applications running which they want to exclude from such a rule or they want to not exclude the default namespaces. Furthermore some of them might install operators to non-default namespaces.

sluetze · 2024-07-16T11:43:10Z

applications/openshift/networking/configure_appropriate_network_policies/rule.yml

+title: 'Ensure appropriate Network Policies are configured'
+
+description: |-
+  Configure Network Policies in any application namespace in an approrpriate way, so that


Suggested change

Configure Network Policies in any application namespace in an approrpriate way, so that

Configure Network Policies in any application namespace in an appropriate way, so that

sluetze · 2024-07-16T11:43:35Z

applications/openshift/networking/configure_appropriate_network_policies/rule.yml

@@ -0,0 +1,43 @@
+documentation_complete: true
+
+title: 'Ensure appropriate Network Policies are configured'


Suggested change

title: 'Ensure appropriate Network Policies are configured'

title: 'Ensure Appropriate Network Policies are Configured'

BhargaviGudi · 2024-08-19T14:11:27Z

applications/openshift/networking/configure_appropriate_network_policies/rule.yml

+    For each non-default namespace in the cluster, review the configured Network Policies
+    and ensure that they only allow the necessary network network connections. They should should
+    precisely define source and target using label selectors and ports.
+


Could you please resolve the typo issue. Should be,
'and ensure that they only allow the necessary network connections. They should
precisely define source and target using label selectors and ports.'

Defined notes and rules for BSI APP.4.4.A18

a7885d5

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jul 15, 2024

Add manual rule for appropriate network policies

2bb18f7

benruland force-pushed the bsi-app-4.4-a18 branch from 2fa7ea1 to 2bb18f7 Compare July 15, 2024 14:45

benruland mentioned this pull request Jul 15, 2024

APP.4.4.A18 sig-bsi-grundschutz/content#44

Open

sluetze reviewed Jul 16, 2024

View reviewed changes

sluetze suggested changes Jul 16, 2024

View reviewed changes

marcusburghardt added OpenShift OpenShift product related. BSI PRs or issues for the BSI profile. labels Jul 31, 2024

BhargaviGudi reviewed Aug 19, 2024

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Defined notes and rules for BSI APP.4.4.A18 #12154

Defined notes and rules for BSI APP.4.4.A18 #12154

benruland commented Jul 15, 2024

openshift-ci bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

codeclimate bot commented Jul 15, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

BhargaviGudi Aug 19, 2024

	Configure Network Policies in any application namespace in an approrpriate way, so that
	Configure Network Policies in any application namespace in an appropriate way, so that

		@@ -0,0 +1,43 @@
		documentation_complete: true

		title: 'Ensure appropriate Network Policies are configured'

Defined notes and rules for BSI APP.4.4.A18 #12154

Are you sure you want to change the base?

Defined notes and rules for BSI APP.4.4.A18 #12154

Conversation

benruland commented Jul 15, 2024

openshift-ci bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

codeclimate bot commented Jul 15, 2024

sluetze Jul 16, 2024

Choose a reason for hiding this comment

sluetze Jul 16, 2024

Choose a reason for hiding this comment

sluetze Jul 16, 2024

Choose a reason for hiding this comment

sluetze Jul 16, 2024

Choose a reason for hiding this comment

BhargaviGudi Aug 19, 2024

Choose a reason for hiding this comment