Add al2023 product #12006

hipponix · 2024-05-20T08:44:57Z

Description:

Add AL2023 Product
Add CIS level 1 and level 2 controls

Rationale:

AWS is now supporting AL2023 and announced is end of life for AL2
Al2023 product is missing in the existing catalog

Review Hints:

./build_product -j 8 al2023

openshift-ci · 2024-05-20T08:45:09Z

Hi @hipponix. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

github-actions · 2024-05-20T08:46:35Z

Start a new ephemeral environment with changes proposed in this pull request:

al2023 (from CTF) Environment (using Fedora as testing environment)

Fedora Testing Environment

Oracle Linux 8 Environment

hipponix · 2024-05-29T09:20:43Z

@marcusburghardt should you need more work here from my end or even split it into multiple PRs to ease you review process, just let me know.
This is my first PR here and might have (mistakenly) skipped needed practices.
Best
Mirco

marcusburghardt · 2024-05-29T09:33:45Z

@marcusburghardt should you need more work here from my end or even split it into multiple PRs to ease you review process, just let me know. This is my first PR here and might have (mistakenly) skipped needed practices. Best Mirco

Hi @hipponix , first thanks for the contribution.
I didn't have a time to review this PR (likely others project maintainers neither). We should manage it soon.

github-actions · 2024-05-29T09:33:55Z

🤖 A k8s content image for this PR is available at:
ghcr.io/complianceascode/k8scontent:12006
This image was built from commit: 1324b12

Click here to see how to deploy it

If you alread have Compliance Operator deployed:
utils/build_ds_container.py -i ghcr.io/complianceascode/k8scontent:12006

Otherwise deploy the content and operator together by checking out ComplianceAsCode/compliance-operator and:
CONTENT_IMAGE=ghcr.io/complianceascode/k8scontent:12006 make deploy-local

hipponix · 2024-05-29T11:57:17Z

@marcusburghardt should you need more work here from my end or even split it into multiple PRs to ease you review process, just let me know. This is my first PR here and might have (mistakenly) skipped needed practices. Best Mirco

Hi @hipponix , first thanks for the contribution. I didn't have a time to review this PR (likely others project maintainers neither). We should manage it soon.

no intent to put some pressure here, thanks @marcusburghardt ! I noticed there are quite a few PRs to be processed so you maintainers might be very busy.

Mab879

Thanks for the PR.

Please take a look at my comments. They boil down the following:

Ensure fully qualified collection name (FCQN) for Ansible
If you don't want rules in a profile backed by a control file, it might be bested to move them to the related_rules section on each control.

products/al2023/profiles/cis.profile

linux_os/guide/system/software/updating/ensure_amazon_gpgkey_installed/ansible/shared.yml

products/al2023/profiles/cis_server_l1.profile

dodys

you will need to rebase your branch as it has a bunch of commits from master on it.

dodys · 2024-05-31T13:22:11Z

@hipponix do not merge master into your feature branch, that creates unnecessary commits, please rebase your branch instead

dodys · 2024-06-05T08:12:09Z

/packit build

Mab879 · 2024-06-10T15:31:44Z

@hipponix a quick rebase on master to resolve the conflicts in .github/workflows/gate_fedora.yml should get this a good state for a full review.

Xeicker

No extra comments, apart from already suggested changes it LGTM

dodys

a few minor things to fix

dodys · 2024-06-11T13:42:38Z

build_product

@@ -378,6 +378,7 @@ all_cmake_products=(
 	MACOS1015
 	OPENEMBEDDED
 	OPENEULER2203
+  AL2023


indentation issue and also not alphabetically ordered.

Done - Thanks!

dodys · 2024-06-11T13:43:28Z

CMakeLists.txt

@@ -466,6 +468,9 @@ endif()
 if(SSG_PRODUCT_UOS20)
    add_subdirectory("products/uos20" "uos20")
 endif()
+if(SSG_PRODUCT_AL2023)


needs to be sorted alphabetically

Done - Thanks!

dodys · 2024-06-11T13:43:58Z

.github/workflows/gate_fedora.yml

-                        ocp4
+                        ocp4 \
+                        uos20 \
+                        al2023


needs to be sorted alphabetically and is including twice the uos20

Done - Thanks!

dodys · 2024-06-11T13:44:11Z

.github/workflows/gate.yaml

@@ -170,7 +170,8 @@ jobs:
                rhel9 \
                rhel10 \
                uos20 \
-                ocp4
+                ocp4 \


needs to be sorted alphabetically

Done - Thanks!

…nstalled/ansible/shared.yml thanks Co-authored-by: Matthew Burket <[email protected]>

…inting to aws servers

…nf by pointing to aws servers" This reverts commit e745325.

… file - Add build/.gitkeep back - Remove AL2023 from building derivates

hipponix · 2024-06-25T11:34:56Z

Thanks @Mab879 and @0intro for supporting here.
It should be ok now .. and if not, let me know.
Waiting for your feedback!

codeclimate · 2024-06-26T23:41:21Z

Code Climate has analyzed commit 1324b12 and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 59.4% (0.0% change).

View more on Code Climate.

Mab879

LGTM.

Thanks for the hard work.

I am waving the following tests:

Automatus Ubuntu 22.04 - not related to this PR
Compare DS / Generate Diff - new product, nothing to compare
Automatus CS8 - expected, not related to this PR
Automatus CS9 - rule for amazon linux not found, expected
Automatus Fedora - rule for amazon linux not found, expected
Automatus SLE15 - rule for amazon linux not found, expected
Build, Test on Fedora Rawhide - expected

Mab879 · 2024-06-27T00:33:50Z

@dodys You still have request for changes out.

Everything look good to you?

dodys

lgtm, thanks!
and thanks @0intro and @hipponix for working together on it!

openshift-ci bot added the needs-ok-to-test Used by openshift-ci bot. label May 20, 2024

hipponix mentioned this pull request May 20, 2024

Scap Security Guide for Amazon Linux 2/ 2023 versions #11785

Open

marcusburghardt added the New Product Issues or pull requests related to new Products. label May 21, 2024

Mab879 self-assigned this May 29, 2024

Mab879 added this to the 0.1.74 milestone May 29, 2024

Mab879 requested changes May 29, 2024

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label May 30, 2024

hipponix requested review from a team as code owners May 31, 2024 10:03

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label May 31, 2024

dodys requested changes May 31, 2024

View reviewed changes

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jun 3, 2024

hipponix force-pushed the 11785-create-al2023-product branch from 4d98497 to 49176c4 Compare June 4, 2024 10:50

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jun 4, 2024

openshift-merge-robot added the needs-rebase Used by openshift-ci bot. label Jun 7, 2024

Xeicker approved these changes Jun 10, 2024

View reviewed changes

hipponix force-pushed the 11785-create-al2023-product branch from 49176c4 to 498ef66 Compare June 11, 2024 11:59

openshift-merge-robot removed the needs-rebase Used by openshift-ci bot. label Jun 11, 2024

dodys requested changes Jun 11, 2024

View reviewed changes

hipponix and others added 22 commits June 25, 2024 11:32

Complete al2023 setup (add components, controls, linux_os)

58ad915

Add aws fingerprint and fix ensure_amazon_gpgkey_installed

3d60664

fix a typo in cis.profile

ff39928

fix a typo in cis_server_l1.profile

472659c

Update linux_os/guide/system/software/updating/ensure_amazon_gpgkey_i…

170ae4f

…nstalled/ansible/shared.yml thanks Co-authored-by: Matthew Burket <[email protected]>

Update linux_os/guide/system/software/updating/ensure_amazon_gpgkey_i…

4435892

…nstalled/ansible/shared.yml thanks Co-authored-by: Matthew Burket <[email protected]>

Update linux_os/guide/system/software/updating/ensure_amazon_gpgkey_i…

32686e4

…nstalled/ansible/shared.yml thanks Co-authored-by: Matthew Burket <[email protected]>

Update linux_os/guide/system/software/updating/ensure_amazon_gpgkey_i…

73a1121

…nstalled/ansible/shared.yml thanks Co-authored-by: Matthew Burket <[email protected]>

Update linux_os/guide/system/software/updating/ensure_amazon_gpgkey_i…

f362c43

…nstalled/ansible/shared.yml thanks Co-authored-by: Matthew Burket <[email protected]>

remove not needed controls from cis profiles - fix chronyd conf by po…

067ac60

…inting to aws servers

Add AL2023 product

668b829

Fix os version check/name on AL2023

7ff54a7

fix conflicts

f59006f

Revert "remove not needed controls from cis profiles - fix chronyd co…

2f2fe79

…nf by pointing to aws servers" This reverts commit e745325.

Fix indentation/sorting issues

33d926c

bring cis_al2023.yml back

b376bf7

fix and test on al2023 / add minor changes

d20eb65

Replace cis_al2023.yml with a previous version - Rename CIS 2 profile…

2a46058

… file - Add build/.gitkeep back - Remove AL2023 from building derivates

fix syntaxt and CIS content errors

d0055a5

address additional syntax settings

3532dd8

Fix typos

5892000

fix cis_al2023.yml and its manual settings

1324b12

hipponix force-pushed the 11785-create-al2023-product branch from 8e44b5c to 1324b12 Compare June 25, 2024 11:33

Mab879 added the Highlight This PR/Issue should make it to the featured changelog. label Jun 26, 2024

Mab879 approved these changes Jun 27, 2024

View reviewed changes

dodys approved these changes Jun 27, 2024

View reviewed changes

Mab879 merged commit e2a9877 into ComplianceAsCode:master Jun 27, 2024
81 of 88 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add al2023 product #12006

Add al2023 product #12006

hipponix commented May 20, 2024 •

edited

Loading

openshift-ci bot commented May 20, 2024

github-actions bot commented May 20, 2024

hipponix commented May 29, 2024

marcusburghardt commented May 29, 2024

github-actions bot commented May 29, 2024 •

edited

Loading

hipponix commented May 29, 2024

Mab879 left a comment

dodys left a comment

dodys commented May 31, 2024

dodys commented Jun 5, 2024

Mab879 commented Jun 10, 2024

Xeicker left a comment

dodys left a comment

dodys Jun 11, 2024

hipponix Jun 12, 2024

dodys Jun 11, 2024

hipponix Jun 12, 2024

dodys Jun 11, 2024

hipponix Jun 12, 2024

dodys Jun 11, 2024

hipponix Jun 12, 2024

hipponix commented Jun 25, 2024

codeclimate bot commented Jun 26, 2024

Mab879 left a comment

Mab879 commented Jun 27, 2024

dodys left a comment

Add al2023 product #12006

Add al2023 product #12006

Conversation

hipponix commented May 20, 2024 • edited Loading

Description:

Rationale:

Review Hints:

openshift-ci bot commented May 20, 2024

github-actions bot commented May 20, 2024

hipponix commented May 29, 2024

marcusburghardt commented May 29, 2024

github-actions bot commented May 29, 2024 • edited Loading

hipponix commented May 29, 2024

Mab879 left a comment

Choose a reason for hiding this comment

dodys left a comment

Choose a reason for hiding this comment

dodys commented May 31, 2024

dodys commented Jun 5, 2024

Mab879 commented Jun 10, 2024

Xeicker left a comment

Choose a reason for hiding this comment

dodys left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

hipponix commented Jun 25, 2024

codeclimate bot commented Jun 26, 2024

Mab879 left a comment

Choose a reason for hiding this comment

Mab879 commented Jun 27, 2024

dodys left a comment

Choose a reason for hiding this comment

hipponix commented May 20, 2024 •

edited

Loading

github-actions bot commented May 29, 2024 •

edited

Loading