Defined notes and rules for BSI APP.4.4.A19 #12155

benruland · 2024-07-15T13:27:38Z

Description:
Notes / Rules for BSI APP4.4.A19

Rationale:
As we have multiple customers asking for a BSI profile to be included in the compliance-operator, we are contributing a profile. To provide a better review process, the individual controle are implemented as separate PRs.

This is a follow-up of #11659. It was breaken up for better reviewability.

openshift-ci · 2024-07-15T13:27:49Z

Hi @benruland. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2024-07-15T13:31:30Z

Start a new ephemeral environment with changes proposed in this pull request:

ocp4 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

github-actions · 2024-07-15T13:51:55Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12155
This image was built from commit: 8f3cabb

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12155

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12155 make deploy-local

Rules include OpenShift node high availability and spreading over zones, and Anti-Affinity/TopologySpreadConstraints for Workload

codeclimate · 2024-07-15T15:20:42Z

Code Climate has analyzed commit 8f3cabb and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

sluetze · 2024-07-16T11:46:14Z

controls/bsi_app_4_4.yml

      applications of the clusters, and the pods of the applications SHOULD be distributed across
      several fire zones based on the location data of the corresponding nodes so that the failure of a
      fire zone will not lead to the failure of an application.
    notes: >-
-      TBD
+      Section 1: OpenShift support topology labels to differentiate between failure zones. To achieve


Suggested change

Section 1: OpenShift support topology labels to differentiate between failure zones. To achieve

Section 1: OpenShift supports topology labels to differentiate between failure zones. To achieve

sluetze · 2024-07-16T11:48:29Z

controls/bsi_app_4_4.yml

+      distribution across nodes and zones needs to be configured during deployment using affinity /
+      anti-affinity rules or topology spread constraints.
+
+      Single Node OpenShift (SNO) is not highly available and therefore incompliant to this control.
    status: pending


Suggested change

status: pending

status: automated

This seems to be pretty automated. Automated is also applicable, if all technical feasible checks are done.

sluetze · 2024-07-16T11:51:03Z

...nshift/high-availability/anti_affinity_or_topology_spread_constraints_in_deployment/rule.yml

+    This approach ensures that a single node or AZ failure does not lead to total application
+    downtime, as workloads are balanced and resources are efficiently utilized.
+
+identifiers: {}


unique identifier is missing, add it by using
./utils/rule_dir_json.py followed by python utils/fix_rules.py --product products/ocp4/product.yml add-cce --cce-pool redhat anti_affinity_or_topology_spread_constraints_in_deployment

sluetze · 2024-07-16T11:51:39Z

...nshift/high-availability/anti_affinity_or_topology_spread_constraints_in_deployment/rule.yml

@@ -0,0 +1,83 @@
+documentation_complete: true
+
+title: 'Ensure deployments have either anti-affinity rules or topology spread constraints'


Suggested change

title: 'Ensure deployments have either anti-affinity rules or topology spread constraints'

title: 'Ensure Deployments have either Anti-Affinity Rules or Topology Spread Constraints'

as of style guide

sluetze · 2024-07-16T11:52:38Z

...nshift/high-availability/anti_affinity_or_topology_spread_constraints_in_deployment/rule.yml

+
+    There might be deployments, that do not require high availability or spreading across nodes.
+    To limit the number of false positives, this rule only checks deployments with a replica count
+    of more than one. For deployments with one replica neither anti-affinity rules nor topology


Suggested change

of more than one. For deployments with one replica neither anti-affinity rules nor topology

of more than one. For deployments with one replica, neither anti-affinity rules nor topology

a comma that helps readability

sluetze · 2024-07-16T12:09:55Z

applications/openshift/high-availability/three_control_plane_nodes/rule.yml

+    To ensure, that the OpenShift control plane stays accessible on outage of a single master node, a 
+    number of 3 control plane nodes is required.


Suggested change

To ensure, that the OpenShift control plane stays accessible on outage of a single master node, a

number of 3 control plane nodes is required.

To ensure, that the OpenShift control plane stays accessible on outage of a single master node,

three control plane nodes are required.

sluetze · 2024-07-16T12:10:17Z

applications/openshift/high-availability/three_control_plane_nodes/rule.yml

+    number of 3 control plane nodes is required.
+
+rationale: |-
+    A highly-available OpenShift control plane requires 3 control plane nodes. This allows etcd to have


Suggested change

A highly-available OpenShift control plane requires 3 control plane nodes. This allows etcd to have

A high available OpenShift control plane requires three control plane nodes. This allows etcd to have

sluetze · 2024-07-16T12:10:31Z

applications/openshift/high-availability/three_control_plane_nodes/rule.yml

+    A highly-available OpenShift control plane requires 3 control plane nodes. This allows etcd to have
+    a functional quorum state, when a single control plane node is unavailable.
+
+identifiers: {}


unique identifier is missing, add it by using
./utils/rule_dir_json.py followed by python utils/fix_rules.py --product products/ocp4/product.yml add-cce --cce-pool redhatthree_control_plane_nodes

sluetze · 2024-07-16T12:11:07Z

applications/openshift/high-availability/worker_nodes_in_two_zones_or_more/rule.yml

@@ -0,0 +1,52 @@
+documentation_complete: true
+
+title: 'Ensure worker nodes are distribute across three failure zones'


Suggested change

title: 'Ensure worker nodes are distribute across three failure zones'

title: 'Ensure Worker Nodes are Distributed Across Three Failure Zones'

sluetze · 2024-07-16T12:11:33Z

applications/openshift/high-availability/worker_nodes_in_two_zones_or_more/rule.yml

+    This label is automatically assigned to each node by cloud providers but might need to be managed
+    manually in other environments
+
+identifiers: {}


unique identifier is missing, add it by using
./utils/rule_dir_json.py followed by python utils/fix_rules.py --product products/ocp4/product.yml add-cce --cce-pool redhat worker_nodes_in_two_zones_or_more

yuumasato · 2024-09-17T14:07:54Z

@benruland Hi, do you plan to act on @sluetze's feedback?
What should we do here?

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label Jul 15, 2024

benruland force-pushed the bsi-app-4.4-a19 branch 2 times, most recently from 6b090f8 to 3b28165 Compare July 15, 2024 14:35

Defined notes and created new rules for BSI APP.4.4.A19

8f3cabb

Rules include OpenShift node high availability and spreading over zones, and Anti-Affinity/TopologySpreadConstraints for Workload

benruland force-pushed the bsi-app-4.4-a19 branch from 3b28165 to 8f3cabb Compare July 15, 2024 14:38

benruland mentioned this pull request Jul 15, 2024

APP.4.4.A19 sig-bsi-grundschutz/content#45

Open

sluetze suggested changes Jul 16, 2024

View reviewed changes

marcusburghardt added OpenShift OpenShift product related. BSI PRs or issues for the BSI profile. labels Jul 31, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Defined notes and rules for BSI APP.4.4.A19 #12155

Defined notes and rules for BSI APP.4.4.A19 #12155

benruland commented Jul 15, 2024

openshift-ci bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024 •

edited

Loading

codeclimate bot commented Jul 15, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

sluetze Jul 16, 2024

yuumasato commented Sep 17, 2024

	Section 1: OpenShift support topology labels to differentiate between failure zones. To achieve
	Section 1: OpenShift supports topology labels to differentiate between failure zones. To achieve

		@@ -0,0 +1,83 @@
		documentation_complete: true

		title: 'Ensure deployments have either anti-affinity rules or topology spread constraints'

	of more than one. For deployments with one replica neither anti-affinity rules nor topology
	of more than one. For deployments with one replica, neither anti-affinity rules nor topology

		To ensure, that the OpenShift control plane stays accessible on outage of a single master node, a
		number of 3 control plane nodes is required.

	A highly-available OpenShift control plane requires 3 control plane nodes. This allows etcd to have
	A high available OpenShift control plane requires three control plane nodes. This allows etcd to have

		@@ -0,0 +1,52 @@
		documentation_complete: true

		title: 'Ensure worker nodes are distribute across three failure zones'

Defined notes and rules for BSI APP.4.4.A19 #12155

Are you sure you want to change the base?

Defined notes and rules for BSI APP.4.4.A19 #12155

Conversation

benruland commented Jul 15, 2024

openshift-ci bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024

github-actions bot commented Jul 15, 2024 • edited Loading

codeclimate bot commented Jul 15, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yuumasato commented Sep 17, 2024

github-actions bot commented Jul 15, 2024 •

edited

Loading