Merge pull request ComplianceAsCode#12008 from rutvik23/CMP-2548

To fix CMP-2548
a-skr · Jun 25, 2024 · 9758517 · 9758517
2 parents 644de12 + 3beb2f6
commit 9758517
Show file tree

Hide file tree

Showing 13 changed files with 31 additions and 26 deletions.
diff --git a/applications/openshift/controller/controller_rotate_kubelet_server_certs/rule.yml b/applications/openshift/controller/controller_rotate_kubelet_server_certs/rule.yml
@@ -39,7 +39,7 @@ rationale: |-
 
 severity: medium
 
-platform: not ocp4-on-hypershift-hosted
+platform: not ocp4-on-hypershift-hosted and (ocp4.12 or ocp4.13)
 
 ocil_clause: |-
     <tt>RotateKubeletServerCertificate</tt> argument is set to <tt>false</tt> in the
@@ -49,7 +49,7 @@ ocil: |-
     To verify that <tt>RotateKubeletServerCertificate</tt> is configured correctly,
     run the following command:
     <pre>$ oc get configmaps config -n openshift-kube-controller-manager -ojson | jq -r '.data["config.yaml"]' | jq -r '.extendedArguments["feature-gates"]'</pre>
-    The output should return <tt>RotateKubeletServerCertificate=true</tt>.
+    The output should return <tt>RotateKubeletServerCertificate=true</tt>
 
 identifiers:
     cce@ocp4: CCE-83730-2
@@ -58,11 +58,12 @@ warnings:
 - general: |-
     {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}
 - functionality: |-
-    This recommendation only applies if you let kubelets get their
-    certificates from the API Server. In case your certificates come from an
-    outside Certificate Authority/tool (e.g. Vault) then you need to take care
-    of rotation yourself
-
+    In OpenShift 4, the kubelet certification rotation is enabled by default. 
+    Openshift v4 automatically generates a new kube-apiserver-to-kubelet-signer CA certificates at 292
+    days, removes old CA certificate after 365 days, and the kubelet-client, kubelet-server 
+    certs are auto-rotated once every month. Hence, this rule is deprecated and not-applicable. 
+    ref: https://docs.redhat.com/en/documentation/openshift_container_platform/4.15/html/security_and_compliance/certificate-types-and-descriptions#purpose-5
+ 
 references:
     nerc-cip: CIP-003-8 R4.2,CIP-003-8 R6,CIP-004-6 R3,CIP-007-3 R5.1,CIP-007-3 R6.1
     nist: CM-6,CM-6(1),SC-8,SC-8(1)

diff --git a/applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/4.12.yml b/applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/4.12.yml
@@ -0,0 +1,2 @@
+---
+default_result: PASS
diff --git a/applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/4.13.yml b/applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/4.13.yml
@@ -0,0 +1,2 @@
+---
+default_result: PASS
diff --git a/applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/e2e.yml b/applications/openshift/controller/controller_rotate_kubelet_server_certs/tests/ocp4/e2e.yml
@@ -1,2 +1,2 @@
 ---
-default_result: PASS
+default_result: NOT-APPLICABLE
diff --git a/tests/assertions/ocp4/ocp4-high-4.14.yml b/tests/assertions/ocp4/ocp4-high-4.14.yml
@@ -181,8 +181,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-high-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-high-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-high-4.15.yml b/tests/assertions/ocp4/ocp4-high-4.15.yml
@@ -185,8 +185,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-high-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-high-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-high-4.16.yml b/tests/assertions/ocp4/ocp4-high-4.16.yml
@@ -185,8 +185,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-high-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-high-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-moderate-4.14.yml b/tests/assertions/ocp4/ocp4-moderate-4.14.yml
@@ -179,8 +179,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-moderate-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-moderate-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-moderate-4.15.yml b/tests/assertions/ocp4/ocp4-moderate-4.15.yml
@@ -176,8 +176,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-moderate-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-moderate-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-moderate-4.16.yml b/tests/assertions/ocp4/ocp4-moderate-4.16.yml
@@ -179,8 +179,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-moderate-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-moderate-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-stig-4.14.yml b/tests/assertions/ocp4/ocp4-stig-4.14.yml
@@ -158,8 +158,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-stig-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-stig-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-stig-4.15.yml b/tests/assertions/ocp4/ocp4-stig-4.15.yml
@@ -158,8 +158,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-stig-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-stig-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS

diff --git a/tests/assertions/ocp4/ocp4-stig-4.16.yml b/tests/assertions/ocp4/ocp4-stig-4.16.yml
@@ -158,8 +158,8 @@ rule_results:
     default_result: PASS
     result_after_remediation: PASS
   e2e-stig-controller-rotate-kubelet-server-certs:
-    default_result: PASS
-    result_after_remediation: PASS
+    default_result: NOT-APPLICABLE
+    result_after_remediation: NOT-APPLICABLE
   e2e-stig-controller-secure-port:
     default_result: PASS
     result_after_remediation: PASS