add rule to check for sandboxed containers

applications/openshift/general/sandboxed_containers_operator_exists/rule.yml

@@ -0,0 +1,38 @@
+
+title: Ensure that Sandboxed Containers Operator exists in the cluster
+
+description: |-
+    {{{ weblink(link="https://docs.redhat.com/en/documentation/openshift_sandboxed_containers/1.7",
+                text="The Sandboxed Containers Operator") }}}
+    provides containers with a dedicated kernel by running them in a virtual machine. This allows for extended separation, as no kernel is shared. This is done by using RHCOS cluster extension and is only available on RHCOS nodes.
+
+rationale: |-
+    Using separate Kernels for each container provides for better isolation, and makes it harder for adveseries to move laterally to other containers or the host.
+
+severity: medium
+
+identifiers:
+    cce@ocp4: CCE-86496-7
+
+ocil_clause: 'Sandboxed Containers Operator is not installed'
+
+ocil: |-
+    Run the following command to check if a subscription for the operator exists in the system:
+    <pre>$ oc get sub -n openshift-sandboxed-containers-operator</pre>
+    Make sure the Sandboxed Containers Operator is installed.
+
+warnings:
+- general: |-
+    {{{ openshift_cluster_setting("/apis/operators.coreos.com/v1alpha1/subscriptions") | indent(4) }}}
+
+template:
+  name: yamlfile_value
+  vars:
+    ocp_data: "true"
+    filepath: '/apis/operators.coreos.com/v1alpha1/subscriptions'
+    yamlpath: ".items[:].status.installedCSV"
+    check_existence: "at_least_one_exists"
+    values:
+    - value: "sandboxed-containers-operator.*"
+      operation: "pattern match"
+      entity_check: "at least one"

applications/openshift/general/sandboxed_containers_operator_exists/tests/ocp4/e2e-remediation.sh

@@ -0,0 +1,16 @@
+#!/bin/bash
+set -xe
+
+echo "installing sandboxed-containers-operator"
+oc apply -f ${ROOT_DIR}/ocp-resources/e2e/sandboxed-containers-install.yaml --server-side=true
+
+sleep 30
+
+echo "waiting for sandboxed-containers-operator deployment to exist"
+while [ -z "$(oc get -n openshift-sandboxed-containers-operator --ignore-not-found deployment/controller-manager)" ]; do
+    sleep 3
+done
+
+echo "waiting for sandboxed-containers-operator deployment to be ready"
+oc wait -n openshift-sandboxed-containers-operator --for=condition=Available  --timeout=300s \
+    deployment/controller-manager

applications/openshift/general/sandboxed_containers_operator_exists/tests/ocp4/e2e.yml

@@ -0,0 +1,3 @@
+---
+default_result: FAIL
+result_after_remediation: PASS

ocp-resources/e2e/sandboxed-containers-install.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: openshift-sandboxed-containers-operator
+  labels:
+    openshift.io/cluster-monitoring: "true"
+---
+apiVersion: operators.coreos.com/v1
+kind: OperatorGroup
+metadata:
+  name: sandboxed-containers-operator-group
+  namespace: openshift-sandboxed-containers-operator
+spec:
+  targetNamespaces:
+  - openshift-sandboxed-containers-operator
+---
+apiVersion: operators.coreos.com/v1alpha1
+kind: Subscription
+metadata:
+  name: "sandboxed-containers-operator"
+  namespace: "openshift-sandboxed-containers-operator"
+spec:
+  channel: stable
+  installPlanApproval: Automatic
+  name: sandboxed-containers-operator
+  source: redhat-operators
+  sourceNamespace: openshift-marketplace

shared/references/cce-redhat-avail.txt

@@ -55,7 +55,6 @@ CCE-86484-3
 CCE-86492-6
 CCE-86493-4
 CCE-86494-2
-CCE-86496-7
 CCE-86497-5
 CCE-86498-3
 CCE-86499-1