add rule to check for sandboxed containers config

applications/openshift/general/sandboxed_containers_operator_configured/rule.yml

@@ -0,0 +1,41 @@
+
+title: Ensure that Sandboxed Containers Operator is Configured
+
+description: |-
+    {{{ weblink(link="https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/1.7",
+                text="The Sandboxed Containers Operator") }}}
+    provides containers with a dedicated kernel by running them in a virtual machine. This allows for extended separation, as no kernel is shared. This is done by using RHCOS cluster extension and is only available on RHCOS nodes.
+
+    It is only active, if it is correctly configured with a KataConfig AND you configured each pod spec with <pre>runtimeClassName: kata</pre>.
+
+    Be advised, that on AWS, Azure, IBM Z and IBM LinuxOne you need to enable PeerPods and confiugre additional resources.
+
+rationale: |-
+    Using separate kernels for each container provides for better isolation, and makes it harder for adveseries to move laterally to other containers or the container-host.
+
+severity: medium
+
+identifiers:
+    cce@ocp4: CCE-87430-5
+
+ocil_clause: 'Sandboxed Containers Operator is not configured'
+
+ocil: |-
+    Run the following command to check if a KataConfig for the cluster exists:
+    <pre>$ oc get kataconfigs openshift-sandboxed-containers-operator</pre>
+    Make sure at least one KataConfig exists.
+
+warnings:
+- general: |-
+    {{{ openshift_cluster_setting("/apis/kataconfiguration.openshift.io/v1/kataconfigs?limit=5") | indent(4) }}}
+
+template:
+    name: yamlfile_value
+    vars:
+        ocp_data: "true"
+        filepath: /apis/kataconfiguration.openshift.io/v1/kataconfigs?limit=5
+        yamlpath: ".items[:].metadata.name"
+        entity_check: "at least one"
+        values:
+            - value: ".*"
+              operation: "pattern match"

applications/openshift/general/sandboxed_containers_operator_configured/tests/ocp4/e2e-remediation.sh

@@ -0,0 +1,27 @@
+#!/bin/bash
+set -xe
+
+echo "installing sandboxed-containers-operator"
+oc apply -f ${ROOT_DIR}/ocp-resources/e2e/sandboxed-containers-install.yaml --server-side=true
+
+sleep 30
+
+echo "waiting for sandboxed-containers-operator deployment to exist"
+while [ -z "$(oc get -n openshift-sandboxed-containers-operator --ignore-not-found deployment/controller-manager)" ]; do
+    sleep 3
+done
+
+# we need to wait for the pods to be ready, otherwise there is no webhook endpoint
+# for the kataconfig
+echo "waiting for sandboxed-containers-operator pods to be ready"
+oc wait -n openshift-sandboxed-containers-operator --for=condition=ContainersReady=true \
+--timeout=300s pods -l control-plane=controller-manager
+
+echo "configuring kataconfig"
+oc apply -f ${ROOT_DIR}/ocp-resources/e2e/sandboxed-containers-instance.yaml --server-side=true
+
+echo "check, that the mcp was updated"
+oc wait --for=condition=Updated --timeout=3600s machineconfigpool/kata-oc
+
+echo "waiting for the cluster to become stable"
+oc adm wait-for-stable-cluster --minimum-stable-period 1m

applications/openshift/general/sandboxed_containers_operator_configured/tests/ocp4/e2e.yml

@@ -0,0 +1,3 @@
+---
+default_result: FAIL
+result_after_remediation: PASS

applications/openshift/general/sandboxed_containers_operator_exists/rule.yml

@@ -7,7 +7,7 @@ description: |-
     provides containers with a dedicated kernel by running them in a virtual machine. This allows for extended separation, as no kernel is shared. This is done by using RHCOS cluster extension and is only available on RHCOS nodes.
 
 rationale: |-
-    Using separate Kernels for each container provides for better isolation, and makes it harder for adveseries to move laterally to other containers or the host.
+    Using separate kernels for each container provides for better isolation, and makes it harder for adveseries to move laterally to other containers or the container-host.
 
 severity: medium
 

ocp-resources/e2e/sandboxed-containers-instance.yaml

@@ -0,0 +1,12 @@
+apiVersion: kataconfiguration.openshift.io/v1
+kind: KataConfig
+metadata:
+  name: example-kataconfig
+spec:
+  checkNodeEligibility: false
+  enablePeerPods: false
+  kataConfigPoolSelector:
+    matchExpressions:
+      - key: node-role.kubernetes.io/worker
+        operator: Exists
+  logLevel: info

shared/references/cce-redhat-avail.txt

@@ -520,7 +520,6 @@ CCE-87419-8
 CCE-87422-2
 CCE-87426-3
 CCE-87427-1
-CCE-87430-5
 CCE-87431-3
 CCE-87432-1
 CCE-87434-7