OCPBUGS-32551: swap token inactivity timeout rule #11870

yuumasato · 2024-04-23T11:01:42Z

Description:

Let's use oauth_or_oauthclient_inactivity_timeout instead of oautclient_inactivity_timeout.

Rationale:

The former rule checks for server and client token timeout configuration is multiple places and remediates the server OAuth config.
The latter only checks for the client token timeout and doesn't have a remediation.
Rule oauthclient_inactivity_timeout doesn't have remediation and stayed in FAIL result.

Review Hints:

Check that oauth_or_oauthclient_inactivity_timeout is passing on STIG profile after remediation.

github-actions · 2024-04-23T11:03:11Z

Start a new ephemeral environment with changes proposed in this pull request:

Fedora Environment

Oracle Linux 8 Environment

yuumasato · 2024-04-23T11:03:27Z

/test

openshift-ci · 2024-04-23T11:03:31Z

@yuumasato: The /test command needs one or more targets.
The following commands are available to trigger required jobs:

/test 4.13-e2e-aws-ocp4-cis
/test 4.13-e2e-aws-ocp4-cis-node
/test 4.13-e2e-aws-ocp4-e8
/test 4.13-e2e-aws-ocp4-high
/test 4.13-e2e-aws-ocp4-high-node
/test 4.13-e2e-aws-ocp4-moderate
/test 4.13-e2e-aws-ocp4-moderate-node
/test 4.13-e2e-aws-ocp4-pci-dss
/test 4.13-e2e-aws-ocp4-pci-dss-node
/test 4.13-e2e-aws-ocp4-stig
/test 4.13-e2e-aws-ocp4-stig-node
/test 4.13-e2e-aws-rhcos4-e8
/test 4.13-e2e-aws-rhcos4-high
/test 4.13-e2e-aws-rhcos4-moderate
/test 4.13-e2e-aws-rhcos4-stig
/test 4.13-images
/test 4.14-images
/test 4.15-e2e-aws-ocp4-cis
/test 4.15-e2e-aws-ocp4-cis-node
/test 4.15-e2e-aws-ocp4-e8
/test 4.15-e2e-aws-ocp4-high
/test 4.15-e2e-aws-ocp4-high-node
/test 4.15-e2e-aws-ocp4-moderate
/test 4.15-e2e-aws-ocp4-moderate-node
/test 4.15-e2e-aws-ocp4-pci-dss
/test 4.15-e2e-aws-ocp4-pci-dss-node
/test 4.15-e2e-aws-ocp4-stig
/test 4.15-e2e-aws-ocp4-stig-node
/test 4.15-e2e-aws-rhcos4-e8
/test 4.15-e2e-aws-rhcos4-high
/test 4.15-e2e-aws-rhcos4-moderate
/test 4.15-e2e-aws-rhcos4-stig
/test 4.15-images
/test 4.16-e2e-aws-ocp4-cis
/test 4.16-e2e-aws-ocp4-cis-node
/test 4.16-e2e-aws-ocp4-e8
/test 4.16-e2e-aws-ocp4-high
/test 4.16-e2e-aws-ocp4-high-node
/test 4.16-e2e-aws-ocp4-moderate
/test 4.16-e2e-aws-ocp4-moderate-node
/test 4.16-e2e-aws-ocp4-pci-dss
/test 4.16-e2e-aws-ocp4-pci-dss-node
/test 4.16-e2e-aws-ocp4-stig
/test 4.16-e2e-aws-ocp4-stig-node
/test 4.16-e2e-aws-rhcos4-e8
/test 4.16-e2e-aws-rhcos4-high
/test 4.16-e2e-aws-rhcos4-moderate
/test 4.16-e2e-aws-rhcos4-stig
/test 4.16-images
/test e2e-aws-ocp4-cis
/test e2e-aws-ocp4-cis-node
/test e2e-aws-ocp4-e8
/test e2e-aws-ocp4-high
/test e2e-aws-ocp4-high-node
/test e2e-aws-ocp4-moderate
/test e2e-aws-ocp4-moderate-node
/test e2e-aws-ocp4-pci-dss
/test e2e-aws-ocp4-pci-dss-node
/test e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig-node
/test e2e-aws-rhcos4-e8
/test e2e-aws-rhcos4-high
/test e2e-aws-rhcos4-moderate
/test e2e-aws-rhcos4-stig
/test images

Use /test all to run the following jobs that were automatically triggered:

pull-ci-ComplianceAsCode-content-master-4.13-images
pull-ci-ComplianceAsCode-content-master-4.14-images
pull-ci-ComplianceAsCode-content-master-4.15-images
pull-ci-ComplianceAsCode-content-master-4.16-images
pull-ci-ComplianceAsCode-content-master-images

In response to this:

/test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

yuumasato · 2024-04-23T11:04:11Z

/test 4.15-e2e-aws-ocp4-stig
/test e2e-aws-ocp4-stig

github-actions · 2024-04-23T11:08:43Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:11870
This image was built from commit: 18844e6

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:11870

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:11870 make deploy-local

yuumasato · 2024-04-23T15:02:29Z

/jira refresh

xiaojiey · 2024-04-26T09:38:26Z

/hold for test

xiaojiey · 2024-04-26T11:19:19Z

Pre-merge verification pass with 4.16.0-0.nightly-2024-04-23-032717 + ghcr.io/complianceascode/k8scontent:11870:

1. Check rule available in the ocp4-stig profile:
% oc get profile upstream-ocp4-stig -o yaml | grep oauth-or-oauthclient-inactivity-timeout

- upstream-ocp4-oauth-or-oauthclient-inactivity-timeout

2. Create a ssb with default-auto-apply ss:
% cat ssb_stig.yaml

apiVersion: compliance.openshift.io/v1alpha1

kind: ScanSettingBinding

metadata:

  name: ocp4-stig-compliance

  namespace: openshift-compliance

profiles:

  - name: upstream-ocp4-stig

    kind: Profile

    apiGroup: compliance.openshift.io/v1alpha1

settingsRef:

  name: default-auto-apply

  kind: ScanSetting

  apiGroup: compliance.openshift.io/v1alpha1


% oc apply -f ssb_stig.yaml

scansettingbinding.compliance.openshift.io/ocp4-stig-compliance created

% oc get suite

NAME                   PHASE   RESULT

ocp4-stig-compliance   DONE    NON-COMPLIANT

% oc get cr

NAME                                                              STATE

upstream-ocp4-stig-api-server-encryption-provider-cipher          Applied

upstream-ocp4-stig-audit-profile-set                              Applied

upstream-ocp4-stig-oauth-or-oauthclient-inactivity-timeout        Applied

upstream-ocp4-stig-oauth-or-oauthclient-token-maxage              Applied

upstream-ocp4-stig-project-config-and-template-network-policy     Applied

upstream-ocp4-stig-project-config-and-template-network-policy-1   Applied

upstream-ocp4-stig-project-config-and-template-resource-quota     Applied

upstream-ocp4-stig-project-config-and-template-resource-quota-1   Applied

% oc get cr upstream-ocp4-stig-oauth-or-oauthclient-inactivity-timeout -o=jsonpath={.spec} | jq -r

{

  "apply": true,

  "current": {

    "object": {

      "apiVersion": "config.openshift.io/v1",

      "kind": "OAuth",

      "metadata": {

        "name": "cluster"

      },

      "spec": {

        "tokenConfig": {

          "accessTokenInactivityTimeout": "10m0s"

        }

      }

    }

  },

  "outdated": {},

  "type": "Configuration"

}

% oc get suite

NAME                   PHASE   RESULT

ocp4-stig-compliance   DONE    NON-COMPLIANT

3. Trigger rescan

% oc annotate compliancescan/upstream-ocp4-stig compliance.openshift.io/rescan=

compliancescan.compliance.openshift.io/upstream-ocp4-stig annotated

% oc get scan -w

NAME                 PHASE     RESULT

upstream-ocp4-stig   RUNNING   NOT-AVAILABLE

upstream-ocp4-stig   AGGREGATING   NOT-AVAILABLE

upstream-ocp4-stig   DONE          NON-COMPLIANT

% oc get ccr | grep oauth-or-oauthclient-inactivity-timeout

upstream-ocp4-stig-oauth-or-oauthclient-inactivity-timeout                   PASS     medium

xiaojiey · 2024-04-26T11:19:25Z

/unhold

xiaojiey · 2024-04-26T11:19:30Z

/lgtm

rhmdnd

/lgtm

Nice find. Thanks!

Let's use oauth_or_oauthclient_inactivity_timeout instead of oautclient_inactivity_timeout. The former rule checks for server and client token timeout configuration is multiple places and remediates the server OAuth config. The latter only checks for the client token timeout and doesn't have a remediation.

codeclimate · 2024-06-24T11:17:15Z

Code Climate has analyzed commit 18844e6 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

yuumasato · 2024-06-24T14:55:42Z

Just rebased on top of latest master

yuumasato · 2024-06-27T14:09:39Z

Merging based on Dev and QE approvals.

marcusburghardt added the OpenShift OpenShift product related. label Apr 26, 2024

openshift-ci bot added the do-not-merge/hold Used by openshift-ci-robot bot. label Apr 26, 2024

openshift-ci bot removed the do-not-merge/hold Used by openshift-ci-robot bot. label Apr 26, 2024

yuumasato requested review from Vincent056 and rhmdnd May 3, 2024 09:09

rhmdnd approved these changes Jun 21, 2024

View reviewed changes

yuumasato force-pushed the OCPBUGS-32551-use-oauth_or_oauthclient_inactivity_timeout branch from 9160fed to 18844e6 Compare June 24, 2024 10:32

yuumasato assigned rhmdnd Jun 25, 2024

yuumasato added this to the 0.1.74 milestone Jun 25, 2024

yuumasato merged commit f0c15b2 into ComplianceAsCode:master Jun 27, 2024
92 of 93 checks passed

yuumasato deleted the OCPBUGS-32551-use-oauth_or_oauthclient_inactivity_timeout branch July 1, 2024 08:32

yuumasato mentioned this pull request Jul 9, 2024

Update OCP profile assertion files #12141

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-32551: swap token inactivity timeout rule #11870

OCPBUGS-32551: swap token inactivity timeout rule #11870

yuumasato commented Apr 23, 2024

github-actions bot commented Apr 23, 2024

yuumasato commented Apr 23, 2024

openshift-ci bot commented Apr 23, 2024

yuumasato commented Apr 23, 2024

github-actions bot commented Apr 23, 2024 •

edited

Loading

yuumasato commented Apr 23, 2024 •

edited

Loading

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

rhmdnd left a comment

codeclimate bot commented Jun 24, 2024

yuumasato commented Jun 24, 2024

yuumasato commented Jun 27, 2024

OCPBUGS-32551: swap token inactivity timeout rule #11870

OCPBUGS-32551: swap token inactivity timeout rule #11870

Conversation

yuumasato commented Apr 23, 2024

Description:

Rationale:

Review Hints:

github-actions bot commented Apr 23, 2024

yuumasato commented Apr 23, 2024

openshift-ci bot commented Apr 23, 2024

yuumasato commented Apr 23, 2024

github-actions bot commented Apr 23, 2024 • edited Loading

yuumasato commented Apr 23, 2024 • edited Loading

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

xiaojiey commented Apr 26, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

codeclimate bot commented Jun 24, 2024

yuumasato commented Jun 24, 2024

yuumasato commented Jun 27, 2024

github-actions bot commented Apr 23, 2024 •

edited

Loading

yuumasato commented Apr 23, 2024 •

edited

Loading