diff --git a/applications/openshift/general/acs_sensor_exists/rule.yml b/applications/openshift/general/acs_sensor_exists/rule.yml new file mode 100644 index 00000000000..19b6fb1fac2 --- /dev/null +++ b/applications/openshift/general/acs_sensor_exists/rule.yml @@ -0,0 +1,59 @@ + +title: Ensure that Advanced Cluster Security (ACS) Sensor is deployed + +description: |- + Red Hat Advanced Cluster Security (ACS) for Kubernetes provides comprehensive security + for containerized environments. It offers deep visibility into deployed resources + across Kubernetes clusters, enabling teams to detect vulnerabilities in all images, + manage compliance, and enforce security policies. By integrating ACS into the Kubernetes + environment, organizations can automate security checks and configurations, ensuring that every + deployed application is scanned and secured according to best practices and organizational policies. + + Sensor is the service responsible for analyzing and monitoring the cluster. Sensor + listens to the OpenShift Container Platform or Kubernetes API and Collector events + to report the current state of the cluster. Sensor also triggers deploy-time and + runtime violations based on RHACS Cloud Service policies. In addition, Sensor is + responsible for all cluster interactions, such as applying network policies, + initiating reprocessing of RHACS Cloud Service policies, and interacting with + the Admission controller. + + +rationale: |- + ACS provides a method to continuously monitor and protect the Kubernetes environment against vulnerabilities + and misconfigurations. This ensures that the infrastructure and applications are compliant + with security standards and regulations, reducing the risk of security breaches. + +identifiers: + cce@ocp4: CCE-86171-6 + +references: + pcidss: Req-6.3.2,Req-11.3.1.1,Req-11.5.1.1 + +ocil_clause: 'ACS Sensor is not deployed' + +{{% set jqfilter = '[ .items[] | select(.metadata.name == "sensor" and .metadata.labels["app.kubernetes.io/name"] == "stackrox") | .status.availableReplicas]' %}} + +ocil: |- + Run the following command to check if the ACS Sensor is deployed: + 
$ oc get Deployment --all-namespaces -o json | jq '{{ jqfilter }}'
+ The output should return a non-zero value. + + +severity: medium + +warnings: +- general: |- + {{{ openshift_filtered_cluster_setting({'/apis/apps/v1/deployments?limit=500': jqfilter}) | indent(4) }}} + +template: + name: yamlfile_value + vars: + ocp_data: "true" + filepath: |- + {{{ openshift_filtered_path('/apis/apps/v1/deployments?limit=500', jqfilter) }}} + yamlpath: "[:]" + check_existence: "all_exist" + entity_check: "all" + values: + - value: "0" + operation: "not equal" diff --git a/applications/openshift/general/acs_sensor_exists/tests/ocp4/e2e-remediation.sh b/applications/openshift/general/acs_sensor_exists/tests/ocp4/e2e-remediation.sh new file mode 100755 index 00000000000..021c3ac11ef --- /dev/null +++ b/applications/openshift/general/acs_sensor_exists/tests/ocp4/e2e-remediation.sh @@ -0,0 +1,16 @@ +#!/bin/bash +set -xe + +echo "Mimicking the behavior of a deployed scanner" +oc apply -f ${ROOT_DIR}/ocp-resources/e2e/acs-sensor-install.yaml --server-side=true + +sleep 30 + +echo "waiting for gitops deployment to exist" +while [ -z "$(oc wait -n stackrox --for=condition=Available --timeout=300s deployment/sensor)" ]; do + sleep 3 +done + +echo "waiting for gitops deployment to be ready" +oc wait -n stackrox --for=condition=Available --timeout=300s \ + deployment/sensor diff --git a/applications/openshift/general/acs_sensor_exists/tests/ocp4/e2e.yml b/applications/openshift/general/acs_sensor_exists/tests/ocp4/e2e.yml new file mode 100644 index 00000000000..fd9b313e87b --- /dev/null +++ b/applications/openshift/general/acs_sensor_exists/tests/ocp4/e2e.yml @@ -0,0 +1,3 @@ +--- +default_result: FAIL +result_after_remediation: PASS diff --git a/controls/pcidss_4_ocp4.yml b/controls/pcidss_4_ocp4.yml index 5d2ca090835..f2a7db91df0 100644 --- a/controls/pcidss_4_ocp4.yml +++ b/controls/pcidss_4_ocp4.yml @@ -1309,10 +1309,12 @@ controls: it will be required and must be fully considered during a PCI DSS assessment. levels: - base - status: pending + status: automated notes: |- This requirement is a best practice until 31 March 2025, after which it will be required and must be fully considered during a PCI DSS assessment. + rules: + - acs_sensor_exists - id: 6.3.3 title: All system components are protected from known vulnerabilities by installing @@ -2714,7 +2716,9 @@ controls: the entity's vulnerability risk rankings defined at Requirement 6.3.1) are managed levels: - base - status: pending + status: automated + rules: + - acs_sensor_exists - id: 11.3.1.2 title: Internal vulnerability scans are performed via authenticated scanning. @@ -2825,10 +2829,12 @@ controls: must be fully considered during a PCI DSS assessment. levels: - base - status: pending + status: automated notes: |- The policy is not explicit about any specific solution. The solution might vary depending on site policies. + rules: + - acs_sensor_exists - id: 11.5.2 title: A change-detection mechanism (for example, file integrity monitoring tools) is deployed. diff --git a/ocp-resources/e2e/acs-sensor-install.yaml b/ocp-resources/e2e/acs-sensor-install.yaml new file mode 100644 index 00000000000..ebc3cf313bb --- /dev/null +++ b/ocp-resources/e2e/acs-sensor-install.yaml @@ -0,0 +1,36 @@ +--- +apiVersion: v1 +kind: Namespace +metadata: + name: stackrox + annotations: + openshift.io/node-selector: "" + labels: + openshift.io/cluster-monitoring: "true" +--- +apiVersion: apps/v1 +kind: Deployment +metadata: + name: sensor + namespace: stackrox + labels: + app: sensor + "app.kubernetes.io/name": stackrox +spec: + replicas: 1 + minReadySeconds: 15 + selector: + matchLabels: + app: sensor + strategy: + type: Recreate + template: + metadata: + labels: + app: sensor + spec: + containers: + - image: quay.io/fedora/fedora-toolbox + imagePullPolicy: Always + name: sensor + command: ["/bin/sh", "-c", "while true; do echo 'Hello, StackRox!'; sleep 3600; done"] diff --git a/shared/references/cce-redhat-avail.txt b/shared/references/cce-redhat-avail.txt index 8e0a04672c4..392c2dad191 100644 --- a/shared/references/cce-redhat-avail.txt +++ b/shared/references/cce-redhat-avail.txt @@ -15,7 +15,6 @@ CCE-86167-4 CCE-86168-2 CCE-86169-0 CCE-86170-8 -CCE-86171-6 CCE-86174-0 CCE-86178-1 CCE-86179-9