new feature: create OSCAL json report from compliance operator evidence #50
Conversation
degenaro
requested review from
alfinkel,
cletomartin and
drsm79
as code owners
There was a problem hiding this comment.
There's over 1000 lines of content here. This should really be pared down to a series of smaller PRs and/or see about making your test fixtures a bit less verbose. Our general guideline is to keep PRs under 500 lines of overall content.
Your commits also need to be signed.
degenaro
force-pushed
the
main
branch
5 times, most recently
from
7e8720f to
9e29062
Compare
Improved doc string, comprising report --details. spit & polish. spit & polish. Support optional config parameters --start and --end copyright remove test fixtures README reduce LOCs README original README report README merge 0.11.0
|
Content pretty close to 500 lines now. Commits signed. |
| @@ -1,3 +1,7 @@ | |||
| # [0.11.0](https://github.com/ComplianceAsCode/auditree-arboretum/releases/tag/v0.11.0) | |||
|
|
|||
| - [ADDED] Kubernetes resources report added. | |||
There was a problem hiding this comment.
| - [ADDED] Kubernetes resources report added. | |
| - [ADDED] Kubernetes Compliance OSCAL Observations harvest report added. |
arboretum/kubernetes/README.md
Outdated
| ``` | ||
|
|
||
| [compliance-oscal-observations]: https://github.com/ComplianceAsCode/auditree-arboretum/blob/main/arboretum/kubernetes/reports/compliance_oscal_observations.py | ||
| [fetch-cluster-resource]: https://github.ibm.com/auditree/auditree-central/blob/master/auditree_central/provider/iks/fetchers/fetch_cluster_resource.py |
| * A report is generated comprising a collection of observations, one for each [XCCDF][xccdf] rule/result pair discovered in the `cluster_resource.json` files with respect to the optional date range. Each observation may be enhanced in accordance with an optional `oscal_metadata.yaml` file. | ||
| * Data files required: | ||
| * `raw/kubernetes/cluster_resource.json`, created by the kubernetes provider [ClusterResourceFetcher][fetch-cluster-resource]. | ||
| * Data files optional: | ||
| * `raw/kubernetes/oscal_metadata.json`, planted by the kubernetes provider account administrator. |
There was a problem hiding this comment.
Is the oscal_metadata.yaml different from the raw/kubernetes/oscal_metadata.json?
There was a problem hiding this comment.
Does whichever file that is going to be planted in the locker need to be treated as evidence? Planting it in the locker implies that it is auditable and will be treated as evidence with a time to live setting.
There was a problem hiding this comment.
There are the 2 files: cluster_resource.json and oscal_metadata.json. They go hand-in-hand. The latter is metadata about the former. If the inventory (e.g. name: ssg-ocp4-ds-cis-10.221.139.105-pod) of the former former adds/deletes/modifies a name, then the latter should change accordingly.
| @@ -0,0 +1,227 @@ | |||
| # -*- mode:python; coding:utf-8 -*- | |||
| # Copyright (c) 2020 IBM Corp. All rights reserved. | |||
| The compliance OSCAL observations report. | ||
|
|
||
| A json report comprising NIST OSCAL Assessment Results Observations generated | ||
| by processing compliance operator fetcher cluster_resource evidence. The |
There was a problem hiding this comment.
| by processing compliance operator fetcher cluster_resource evidence. The | |
| by processing Kubernetes stand-alone cluster resources evidence. The |
There was a problem hiding this comment.
Changed "compliance operator fetcher cluster_resource" to "Kubernetes stand-alone cluster resources" as suggested.
|
|
||
| A json report comprising NIST OSCAL Assessment Results Observations generated | ||
| by processing compliance operator fetcher cluster_resource evidence. The | ||
| embedded XML within the cluster_resource evidence is transformed to produce the |
There was a problem hiding this comment.
| embedded XML within the cluster_resource evidence is transformed to produce the | |
| XML within the cluster resource evidence is transformed to produce the JSON |
There was a problem hiding this comment.
Removed "embedded", removed "_", added "JSON" as suggested.
| A json report comprising NIST OSCAL Assessment Results Observations generated | ||
| by processing compliance operator fetcher cluster_resource evidence. The | ||
| embedded XML within the cluster_resource evidence is transformed to produce the | ||
| report. If an optional oscal_metadata file is specified, then the report is |
There was a problem hiding this comment.
| report. If an optional oscal_metadata file is specified, then the report is | |
| report. If an optional OSCAL metadata file is specified, then the report is |
...again this is confusing. Is this a file or evidence gathered from the locker?
There was a problem hiding this comment.
Changed "oscal_metadata" to "OSCAL metadata". The metadata (if present) makes up for what is lacking in the cluster_resource evidence to produce a better OSCAL. As mentioned in a comment above, the metadata should change over time as the resources contained within the cluster change.
|
|
||
| > harvest report my-repo arboretum compliance_oscal_observations \ | ||
| --config '{ \ | ||
| "cluster_resource":"raw/kubernetes/cluster_resource.json", \ |
There was a problem hiding this comment.
(1) Why would someone need to supply this? AFAICT this evidence should always be processed by the report.
(2) Also, this isn't the evidence file name generated by the fetcher.
There was a problem hiding this comment.
This is to allow flexibility in case the fetcher generated file name changes for any reason.
| format of a single mapping. The items in angle brackets are to be replaced with | ||
| desired values for augmenting the produced OSCAL. | ||
|
|
||
| The mapping whose <name> matches the [metadata][name] in the evidence for the |
There was a problem hiding this comment.
This is confusing. Above you imply that this yaml is evidence as is the cluster resources evidence. If that's the case then you should be clear which evidence you're referring to here.
There was a problem hiding this comment.
Changed to specify "cluster resources evidence" as suggested.
into main # Conflicts: # CHANGES.md
|
Closing due to inactivity |
What
Transform Kubernetes compliance operator evidence from cluster_resource fetcher into a NIST OSCAL Assessment Results collection of Observations in JSON format.
Why
Rationale: standardized version of evidence for multi-cloud and to facilitate creation of NIST OSCAL Assessment Results.
How
Write a harvest report
compliance_oscal_observationsthat consumescluster_resource.jsonevidence and optionaloscal-metadata.yamlto producecompliance_oscal_observations.json.Test
Context