Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update assertions for PCI-DSS profile #12362

Conversation

rhmdnd
Copy link
Collaborator

@rhmdnd rhmdnd commented Sep 3, 2024

We recently updated the PCI-DSS profile to use 4.0 by default, but
didn't update the default assertions. This commit updates the assertions
so that the versionless profile name includes assertions for rules in
the v4.0 profile.

Copy link

github-actions bot commented Sep 3, 2024

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment
Open in Gitpod

Oracle Linux 8 Environment
Open in Gitpod

@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 3, 2024

/test

Copy link

openshift-ci bot commented Sep 3, 2024

@rhmdnd: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

  • /test 4.12-e2e-aws-ocp4-cis
  • /test 4.12-e2e-aws-ocp4-cis-node
  • /test 4.12-e2e-aws-ocp4-e8
  • /test 4.12-e2e-aws-ocp4-high
  • /test 4.12-e2e-aws-ocp4-high-node
  • /test 4.12-e2e-aws-ocp4-moderate
  • /test 4.12-e2e-aws-ocp4-moderate-node
  • /test 4.12-e2e-aws-ocp4-pci-dss
  • /test 4.12-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.12-e2e-aws-ocp4-pci-dss-node
  • /test 4.12-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.12-e2e-aws-ocp4-stig
  • /test 4.12-e2e-aws-ocp4-stig-node
  • /test 4.12-e2e-aws-rhcos4-e8
  • /test 4.12-e2e-aws-rhcos4-high
  • /test 4.12-e2e-aws-rhcos4-moderate
  • /test 4.12-e2e-aws-rhcos4-stig
  • /test 4.12-images
  • /test 4.13-e2e-aws-ocp4-bsi
  • /test 4.13-e2e-aws-ocp4-bsi-node
  • /test 4.13-e2e-aws-ocp4-cis
  • /test 4.13-e2e-aws-ocp4-cis-node
  • /test 4.13-e2e-aws-ocp4-e8
  • /test 4.13-e2e-aws-ocp4-high
  • /test 4.13-e2e-aws-ocp4-high-node
  • /test 4.13-e2e-aws-ocp4-moderate
  • /test 4.13-e2e-aws-ocp4-moderate-node
  • /test 4.13-e2e-aws-ocp4-pci-dss
  • /test 4.13-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.13-e2e-aws-ocp4-pci-dss-node
  • /test 4.13-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.13-e2e-aws-ocp4-stig
  • /test 4.13-e2e-aws-ocp4-stig-node
  • /test 4.13-e2e-aws-rhcos4-bsi
  • /test 4.13-e2e-aws-rhcos4-e8
  • /test 4.13-e2e-aws-rhcos4-high
  • /test 4.13-e2e-aws-rhcos4-moderate
  • /test 4.13-e2e-aws-rhcos4-stig
  • /test 4.13-images
  • /test 4.14-e2e-aws-ocp4-bsi
  • /test 4.14-e2e-aws-ocp4-bsi-node
  • /test 4.14-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.14-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.14-e2e-aws-rhcos4-bsi
  • /test 4.14-images
  • /test 4.15-e2e-aws-ocp4-bsi
  • /test 4.15-e2e-aws-ocp4-bsi-node
  • /test 4.15-e2e-aws-ocp4-cis
  • /test 4.15-e2e-aws-ocp4-cis-node
  • /test 4.15-e2e-aws-ocp4-e8
  • /test 4.15-e2e-aws-ocp4-high
  • /test 4.15-e2e-aws-ocp4-high-node
  • /test 4.15-e2e-aws-ocp4-moderate
  • /test 4.15-e2e-aws-ocp4-moderate-node
  • /test 4.15-e2e-aws-ocp4-pci-dss
  • /test 4.15-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.15-e2e-aws-ocp4-pci-dss-node
  • /test 4.15-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.15-e2e-aws-ocp4-stig
  • /test 4.15-e2e-aws-ocp4-stig-node
  • /test 4.15-e2e-aws-rhcos4-bsi
  • /test 4.15-e2e-aws-rhcos4-e8
  • /test 4.15-e2e-aws-rhcos4-high
  • /test 4.15-e2e-aws-rhcos4-moderate
  • /test 4.15-e2e-aws-rhcos4-stig
  • /test 4.15-e2e-rosa-ocp4-cis-node
  • /test 4.15-e2e-rosa-ocp4-pci-dss-node
  • /test 4.15-images
  • /test 4.16-e2e-aws-ocp4-bsi
  • /test 4.16-e2e-aws-ocp4-bsi-node
  • /test 4.16-e2e-aws-ocp4-cis
  • /test 4.16-e2e-aws-ocp4-cis-node
  • /test 4.16-e2e-aws-ocp4-e8
  • /test 4.16-e2e-aws-ocp4-high
  • /test 4.16-e2e-aws-ocp4-high-node
  • /test 4.16-e2e-aws-ocp4-moderate
  • /test 4.16-e2e-aws-ocp4-moderate-node
  • /test 4.16-e2e-aws-ocp4-pci-dss
  • /test 4.16-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.16-e2e-aws-ocp4-pci-dss-node
  • /test 4.16-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.16-e2e-aws-ocp4-stig
  • /test 4.16-e2e-aws-ocp4-stig-node
  • /test 4.16-e2e-aws-rhcos4-bsi
  • /test 4.16-e2e-aws-rhcos4-e8
  • /test 4.16-e2e-aws-rhcos4-high
  • /test 4.16-e2e-aws-rhcos4-moderate
  • /test 4.16-e2e-aws-rhcos4-stig
  • /test 4.16-images
  • /test 4.17-e2e-aws-ocp4-bsi
  • /test 4.17-e2e-aws-ocp4-bsi-node
  • /test 4.17-e2e-aws-ocp4-cis
  • /test 4.17-e2e-aws-ocp4-cis-node
  • /test 4.17-e2e-aws-ocp4-e8
  • /test 4.17-e2e-aws-ocp4-high
  • /test 4.17-e2e-aws-ocp4-high-node
  • /test 4.17-e2e-aws-ocp4-moderate
  • /test 4.17-e2e-aws-ocp4-moderate-node
  • /test 4.17-e2e-aws-ocp4-pci-dss
  • /test 4.17-e2e-aws-ocp4-pci-dss-4-0
  • /test 4.17-e2e-aws-ocp4-pci-dss-node
  • /test 4.17-e2e-aws-ocp4-pci-dss-node-4-0
  • /test 4.17-e2e-aws-ocp4-stig
  • /test 4.17-e2e-aws-ocp4-stig-node
  • /test 4.17-e2e-aws-rhcos4-bsi
  • /test 4.17-e2e-aws-rhcos4-e8
  • /test 4.17-e2e-aws-rhcos4-high
  • /test 4.17-e2e-aws-rhcos4-moderate
  • /test 4.17-e2e-aws-rhcos4-stig
  • /test 4.17-images
  • /test e2e-aws-ocp4-bsi
  • /test e2e-aws-ocp4-bsi-node
  • /test e2e-aws-ocp4-cis
  • /test e2e-aws-ocp4-cis-node
  • /test e2e-aws-ocp4-e8
  • /test e2e-aws-ocp4-high
  • /test e2e-aws-ocp4-high-node
  • /test e2e-aws-ocp4-moderate
  • /test e2e-aws-ocp4-moderate-node
  • /test e2e-aws-ocp4-pci-dss
  • /test e2e-aws-ocp4-pci-dss-4-0
  • /test e2e-aws-ocp4-pci-dss-node
  • /test e2e-aws-ocp4-pci-dss-node-4-0
  • /test e2e-aws-ocp4-stig
  • /test e2e-aws-ocp4-stig-node
  • /test e2e-aws-rhcos4-bsi
  • /test e2e-aws-rhcos4-e8
  • /test e2e-aws-rhcos4-high
  • /test e2e-aws-rhcos4-moderate
  • /test e2e-aws-rhcos4-stig
  • /test images

Use /test all to run the following jobs that were automatically triggered:

  • pull-ci-ComplianceAsCode-content-master-4.12-images
  • pull-ci-ComplianceAsCode-content-master-4.13-images
  • pull-ci-ComplianceAsCode-content-master-4.14-images
  • pull-ci-ComplianceAsCode-content-master-4.15-images
  • pull-ci-ComplianceAsCode-content-master-4.16-images
  • pull-ci-ComplianceAsCode-content-master-4.17-images
  • pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 3, 2024

/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.17-e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.17-e2e-aws-ocp4-pci-dss

Copy link

github-actions bot commented Sep 3, 2024

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12362
This image was built from commit: 640d221

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12362

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12362 make deploy-local

We recently updated the PCI-DSS profile to use 4.0 by default, but
didn't update the default assertions. This commit updates the assertions
so that the versionless profile name includes assertions for rules in
the v4.0 profile.
@rhmdnd rhmdnd force-pushed the update-assertions-for-pci-dss-profile branch from eaecea1 to 95b59c6 Compare September 3, 2024 20:58
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 3, 2024

/test 4.17-e2e-aws-ocp4-pci-dss

@rhmdnd rhmdnd added this to the 0.1.75 milestone Sep 3, 2024
Copy link

openshift-ci bot commented Sep 3, 2024

@rhmdnd: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name Commit Details Required Rerun command
ci/prow/4.17-e2e-aws-ocp4-pci-dss 95b59c6 link true /test 4.17-e2e-aws-ocp4-pci-dss

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

@marcusburghardt marcusburghardt added the OpenShift OpenShift product related. label Sep 4, 2024
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 4, 2024

The 4.17 rules are failing because we didn't include the assertions after adding a handful of rules to 4.17 - #12311

We recently enabled these rules for 4.17, but didn't update the 4.17
PCI-DSS assertion files for them. This commit does that so that.
@rhmdnd
Copy link
Collaborator Author

rhmdnd commented Sep 4, 2024

/test 4.17-e2e-aws-ocp4-pci-dss

Copy link

codeclimate bot commented Sep 4, 2024

Code Climate has analyzed commit 640d221 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.5% (0.0% change).

View more on Code Climate.

Copy link
Member

@yuumasato yuumasato left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@yuumasato yuumasato self-assigned this Sep 4, 2024
@yuumasato yuumasato merged commit 9a56b78 into ComplianceAsCode:master Sep 4, 2024
100 of 101 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
OpenShift OpenShift product related.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants