Add unique profile ID #502

Vincent056 · 2024-04-12T08:25:06Z

This commit implements unique profile ID feature, we are adding a unique profile ID to Profile, ComplianceScan, and ComplianceCheckResult CRD. The profile UUID is generated from sha1 of <product-id>-<existing-xccdf-profile-id>

ex. ocp4-moderate profile has redhat_openshift_container_platform_4.1 product id and xccdf_org.ssgproject.content_profile_moderate profile id

QA:
What is the reason for this commit?

Provides a unique GID for each profile across all profile bundles/datastream,
so ACS can consume that to filter rules/compliancecheckresult by profile-id.

What is the business value?

Supporting integration with ACS

What would be the impact on the user once this goes live?

No impact should be expected with PR, user will see additional annotations/labels on Profile, ComplianceScan, TailoredProfile CRs.
Added annotations, labels:
"compliance.openshift.io/guid"
"compliance.openshift.io/extended-profile-guid"
it will be internal use for ACS

Would this apply to only new deployments or all the deployments once upgraded?

No impact

Would each user have different profile ID? Why is it good/necessary?

No, they will have the same Profile ID

https://issues.redhat.com/browse/CMP-2452

xiaojiey · 2024-04-16T08:20:00Z

/hold for test

xiaojiey · 2024-04-16T08:20:25Z

/retest-required

xiaojiey · 2024-04-16T11:06:02Z

Verification pass for 4.16.0-0.nightly-2024-04-15-184947 + code in #502:

$ oc get profile ocp4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp4b9qj8",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_4.1",
  "compliance.openshift.io/product-type": "Platform",
  "compliance.openshift.io/unique-id": "85b76bd6-d2c6-5c4e-9766-b4997d8ac7c4"
}
$ oc get profile ocp4-moderate-node -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp4b9qj8",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_node_4",
  "compliance.openshift.io/product-type": "Node",
  "compliance.openshift.io/unique-id": "56d6d196-76b4-5ed5-b721-55cb635cc9f6"
}
$ oc get profile rhcos4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-rhcos4kr8b2",
  "compliance.openshift.io/product": "redhat_enterprise_linux_coreos_4",
  "compliance.openshift.io/product-type": "Node",
  "compliance.openshift.io/unique-id": "54d8e347-d602-5d29-992a-43d65a2b9ee6"
}
$ oc get profile rhcos4-cis -o=jsonpath={.metadata.annotations} | jq -r
Error from server (NotFound): profiles.compliance.openshift.io "rhcos4-cis" not found
$ oc get profile ocp4-cis -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp4b9qj8",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_4.1",
  "compliance.openshift.io/product-type": "Platform",
  "compliance.openshift.io/unique-id": "a65a90a9-9a32-5c81-8ea9-a6eb0eb43a7a"
}
$ oc get profile ocp4-cis-1-4 -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp4b9qj8",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_4.1",
  "compliance.openshift.io/product-type": "Platform",
  "compliance.openshift.io/unique-id": "dcacd354-fecf-5bca-8853-b610e42f389c"
}
$ oc get profile ocp4-cis-1-5 -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp4b9qj8",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_4.1",
  "compliance.openshift.io/product-type": "Platform",
  "compliance.openshift.io/unique-id": "255b2bee-92b4-5ce3-9b55-e8185c52b30b"
}
Trigger a ssb with ocp4-moderate, ocp4-moderate-node and check the labels for the scans:
$ oc get scan --show-labels
NAME                        PHASE   RESULT          LABELS
ocp4-moderate               DONE    NON-COMPLIANT   compliance.openshift.io/suite=test,compliance.openshift.io/unique-id=85b76bd6-d2c6-5c4e-9766-b4997d8ac7c4
ocp4-moderate-node-master   DONE    NON-COMPLIANT   compliance.openshift.io/suite=test,compliance.openshift.io/unique-id=56d6d196-76b4-5ed5-b721-55cb635cc9f6
ocp4-moderate-node-worker   DONE    NON-COMPLIANT   compliance.openshift.io/suite=test,compliance.openshift.io/unique-id=56d6d196-76b4-5ed5-b721-55cb635cc9f6

xiaojiey · 2024-04-16T11:06:10Z

/unhold

xiaojiey · 2024-04-16T11:06:19Z

/label qe-approved

Vincent056 · 2024-04-17T15:20:45Z

/retest

Vincent056 · 2024-04-19T11:46:34Z

/retest

This commit implements unique profile ID feature, we are adding a unique profile ID to Profile, ComplianceScan, and ComplianceCheckResult CRD. The profile UUID is generated from sha1 of <bundlename>-<existing-xccdf-profile-id>

cmd/manager/aggregator.go

pkg/apis/compliance/v1alpha1/profile_types.go

pkg/controller/compliancesuite/compliancesuite_controller.go

tests/e2e/parallel/main_test.go

pkg/xccdf/tailoring.go

pkg/profileparser/profileparser.go

Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>

Add logic to handle tailoredprofile unique profile id, let's generated a unique uuid using tailoredprofile id.

Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>

yuumasato

Nitpick: Should it be ProfileUniqueID or UniqueProfileID ?

pkg/xccdf/tailoring.go

pkg/apis/compliance/v1alpha1/tailoredprofile_types.go

pkg/apis/compliance/v1alpha1/profile_types.go

Vincent056 · 2024-04-23T20:41:39Z

/retest

pkg/apis/compliance/v1alpha1/profile_types.go

Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>

Vincent056 · 2024-04-30T05:54:35Z

@Vincent056 It seems the profile guild from the scan labels is not the same with the guid from the profile itself. Per my understanding, the label for ocp4-moderate scan should be "compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c", instead of "compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1". Could you please help to check? Thanks.

Verified with 4.16.0-0.nightly-2024-04-26-145258 + CO operator built from #502:

$ oc get profile ocp4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "d625badc-92a1-5438-afd7-19526c26b03c",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
$ oc get profile ocp4-moderate-node -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "ef297cbd-f5a0-5c0c-baab-edeebb761e27",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_node_4",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Node"
}
$ oc get profile rhcos4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "eceb9af0-17d4-5c59-9b17-07cfd22a3ba1",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-rhcos49czdp",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_enterprise_linux_coreos_4",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Node"
}
$ oc get profile ocp4-cis -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "a230315d-3e4a-5b58-b00f-f96f1553e036",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
$ oc get profile ocp4-cis-1-5 -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "9a9d06fb-96d6-5b64-ab3a-461fed654d91",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
$ oc get profile ocp4-cis-1-4 -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "f3c248d7-c4f7-5e82-96f4-780483c36a87",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
]$ oc compliance bind -N test profile/ocp4-moderate profile/ocp4-moderate-node profile/rhcos4-moderate
Creating ScanSettingBinding test
$ oc get suite -w
NAME   PHASE   RESULT
test   PENDING   NOT-AVAILABLE
...
test   RUNNING     NOT-AVAILABLE
...
$ oc get scan --show-labels 
NAME                        PHASE     RESULT          LABELS
ocp4-moderate               RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
ocp4-moderate-node-master   DONE      NON-COMPLIANT   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
ocp4-moderate-node-worker   DONE      NON-COMPLIANT   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
rhcos4-moderate-master      DONE      NON-COMPLIANT   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
rhcos4-moderate-worker      DONE      NON-COMPLIANT   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test

[vincent@node cac-content-fork]$ oc get scan --show-labels 
NAME                     PHASE     RESULT           LABELS
ocp4-cis                 RUNNING   NOT-AVAILABLE    compliance.openshift.io/guid=a230315d-3e4a-5b58-b00f-f96f1553e036,compliance.openshift.io/suite=ocp4-moderate-ssb
ocp4-moderate            RUNNING   NOT-AVAILABLE    compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/suite=ocp4-moderate-ssb
rhcos4-moderate-master   DONE      NOT-APPLICABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=ocp4-moderate-ssb
rhcos4-moderate-worker   DONE      NOT-APPLICABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=ocp4-moderate-ssb

could you help to check again, it looks like I am getting the correct result here

BhargaviGudi · 2024-05-02T11:41:10Z

@Vincent056 It seems the profile guild from the scan labels is not the same with the guid from the profile itself. Per my understanding, the label for ocp4-moderate scan should be "compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c", instead of "compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1". Could you please help to check? Thanks.
Verified with 4.16.0-0.nightly-2024-04-26-145258 + CO operator built from #502:

$ oc get profile ocp4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "d625badc-92a1-5438-afd7-19526c26b03c",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
$ oc get profile ocp4-moderate-node -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "ef297cbd-f5a0-5c0c-baab-edeebb761e27",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_node_4",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Node"
}
$ oc get profile rhcos4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "eceb9af0-17d4-5c59-9b17-07cfd22a3ba1",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-rhcos49czdp",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_enterprise_linux_coreos_4",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Node"
}
$ oc get profile ocp4-cis -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "a230315d-3e4a-5b58-b00f-f96f1553e036",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
$ oc get profile ocp4-cis-1-5 -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "9a9d06fb-96d6-5b64-ab3a-461fed654d91",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
$ oc get profile ocp4-cis-1-4 -o=jsonpath={.metadata.annotations} | jq -r
{
  "[compliance.openshift.io/guid](http://compliance.openshift.io/guid)": "f3c248d7-c4f7-5e82-96f4-780483c36a87",
  "[compliance.openshift.io/image-digest](http://compliance.openshift.io/image-digest)": "pb-ocp47x79w",
  "[compliance.openshift.io/product](http://compliance.openshift.io/product)": "redhat_openshift_container_platform_4.1",
  "[compliance.openshift.io/product-type](http://compliance.openshift.io/product-type)": "Platform"
}
]$ oc compliance bind -N test profile/ocp4-moderate profile/ocp4-moderate-node profile/rhcos4-moderate
Creating ScanSettingBinding test
$ oc get suite -w
NAME   PHASE   RESULT
test   PENDING   NOT-AVAILABLE
...
test   RUNNING     NOT-AVAILABLE
...
$ oc get scan --show-labels 
NAME                        PHASE     RESULT          LABELS
ocp4-moderate               RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
ocp4-moderate-node-master   DONE      NON-COMPLIANT   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
ocp4-moderate-node-worker   DONE      NON-COMPLIANT   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
rhcos4-moderate-master      DONE      NON-COMPLIANT   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
rhcos4-moderate-worker      DONE      NON-COMPLIANT   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test

[vincent@node cac-content-fork]$ oc get scan --show-labels 
NAME                     PHASE     RESULT           LABELS
ocp4-cis                 RUNNING   NOT-AVAILABLE    compliance.openshift.io/guid=a230315d-3e4a-5b58-b00f-f96f1553e036,compliance.openshift.io/suite=ocp4-moderate-ssb
ocp4-moderate            RUNNING   NOT-AVAILABLE    compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/suite=ocp4-moderate-ssb
rhcos4-moderate-master   DONE      NOT-APPLICABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=ocp4-moderate-ssb
rhcos4-moderate-worker   DONE      NOT-APPLICABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=ocp4-moderate-ssb

could you help to check again, it looks like I am getting the correct result here

@Vincent056 I have also observed that profile guild from the scan labels is not the same with the guid.
With moderate profile, the label for ocp4-moderate scan should be "compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c", instead of "compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1" and the label for rhcos4-moderate scan should be "compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1", instead of "compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c"

$ oc compliance bind -N test profile/ocp4-moderate profile/ocp4-moderate-node profile/rhcos4-moderate
Creating ScanSettingBinding test
$ oc get scan --show-labels 
NAME                        PHASE     RESULT          LABELS
ocp4-moderate               RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
ocp4-moderate-node-master   RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
ocp4-moderate-node-worker   RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
rhcos4-moderate-master      RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/suite=test
rhcos4-moderate-worker      RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/suite=test

With below ssb, the label for ocp4-moderate scan should be "compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c", instead of "compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1"

$ oc compliance bind -N test profile/ocp4-cis profile/ocp4-moderate profile/ocp4-moderate-node profile/rhcos4-moderate
Creating ScanSettingBinding test
$ oc get scan --show-labels 
NAME                        PHASE     RESULT          LABELS
ocp4-cis                    RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=a230315d-3e4a-5b58-b00f-f96f1553e036,compliance.openshift.io/suite=test
ocp4-moderate               RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
ocp4-moderate-node-master   RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
ocp4-moderate-node-worker   RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
rhcos4-moderate-master      RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
rhcos4-moderate-worker      RUNNING   NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test

Added check to make sure the scan we are going to label for the profile GID come from the actully profile being used for the scan, because two profile can potentially have the same name, we want to take bundle name into consideration

Vincent056 · 2024-05-06T13:14:07Z

oc get scan --show-labels

@BhargaviGudi thanks for the review, could you retest with the latest patch thanks:

[vincent@node compliance-operator]$ oc get scan --show-labels 
NAME                        PHASE         RESULT          LABELS
ocp4-cis                    AGGREGATING   NOT-AVAILABLE   compliance.openshift.io/guid=a230315d-3e4a-5b58-b00f-f96f1553e036,compliance.openshift.io/suite=test
ocp4-moderate               AGGREGATING   NOT-AVAILABLE   compliance.openshift.io/guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/suite=test
ocp4-moderate-node-master   AGGREGATING   NOT-AVAILABLE   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
ocp4-moderate-node-worker   RUNNING       NOT-AVAILABLE   compliance.openshift.io/guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
rhcos4-moderate-master      RUNNING       NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
rhcos4-moderate-worker      RUNNING       NOT-AVAILABLE   compliance.openshift.io/guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test

rhmdnd · 2024-05-06T19:42:31Z

tests/e2e/serial/main_test.go

+	const profileGUIDRHCOSModerate = "eceb9af0-17d4-5c59-9b17-07cfd22a3ba1"
+	const profileGUIDOCPCIS = "a230315d-3e4a-5b58-b00f-f96f1553e036"
+
+	f.AssertProfileGUIDMatches("ocp4-moderate", f.OperatorNamespace, profileGUIDOCPModerate)


If this assertion fails, I don't think it will fail the test.

Most of our assertions return an error (using https://pkg.go.dev/fmt#Errorf). But, I think we need to check for that error and handle the failure.

If we were passing in the test suite, we could have the assertion call t.Fatalf(), but based on the current implementation we're relying on the test to enforce the outcome of the assertion (which I think we could argue that the assertion should handle failing the test, but that would be a broader change we would want to do consistently I think).

That's a good catch!

rhmdnd · 2024-05-06T19:42:47Z

tests/e2e/serial/main_test.go

+	f.AssertScanGUIDMatches("ocp4-cis-node-master", f.OperatorNamespace, profileGUIDOCPCIS)
+	f.AssertScanGUIDMatches("ocp4-cis-node-worker", f.OperatorNamespace, profileGUIDOCPCIS)
+	// check if the profileGUID is correct in the tailored profile's label
+	f.AssertScanGUIDMatches(tpName, f.OperatorNamespace, profileGUIDTP)


Similar comment here as to what's above.

cmd/manager/aggregator.go

pkg/controller/compliancesuite/compliancesuite_controller.go

rhmdnd

This is looking good. I have a couple suggestions for the test, and one ergonomic aspect of reusing the same label across resources.

tests/e2e/serial/main_test.go

xiaojiey · 2024-05-08T12:18:34Z

Verification pass with 4.16.0-0.nightly-2024-05-07-025557 + operator built from #502:

1. profile-guid for profiles:
% oc get profile ocp4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp47zf9s",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_4.1",
  "compliance.openshift.io/product-type": "Platform",
  "compliance.openshift.io/profile-guid": "d625badc-92a1-5438-afd7-19526c26b03c"
}
% oc get profile ocp4-moderate-node -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp47zf9s",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_node_4",
  "compliance.openshift.io/product-type": "Node",
  "compliance.openshift.io/profile-guid": "ef297cbd-f5a0-5c0c-baab-edeebb761e27"
}
% oc get profile rhcos4-moderate -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-rhcos4pmqbv",
  "compliance.openshift.io/product": "redhat_enterprise_linux_coreos_4",
  "compliance.openshift.io/product-type": "Node",
  "compliance.openshift.io/profile-guid": "eceb9af0-17d4-5c59-9b17-07cfd22a3ba1"
}
% oc get profile ocp4-cis -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp47zf9s",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_4.1",
  "compliance.openshift.io/product-type": "Platform",
  "compliance.openshift.io/profile-guid": "a230315d-3e4a-5b58-b00f-f96f1553e036"
}
% oc get profile ocp4-cis-node -o=jsonpath={.metadata.annotations} | jq -r
{
  "compliance.openshift.io/image-digest": "pb-ocp47zf9s",
  "compliance.openshift.io/product": "redhat_openshift_container_platform_node_4",
  "compliance.openshift.io/product-type": "Node",
  "compliance.openshift.io/profile-guid": "fea955f1-9f13-56fd-aacf-868b95b7283f"
}
2. Create a ssb, check the labels for scans and ccrs
$ oc compliance bind -N test profile/ocp4-moderate profile/ocp4-moderate-node profile/rhcos4-moderate
Creating ScanSettingBinding test
$ oc get scan --show-labels
NAME                        PHASE     RESULT          LABELS
ocp4-moderate               RUNNING   NOT-AVAILABLE   compliance.openshift.io/profile-guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/suite=test
ocp4-moderate-node-master   RUNNING   NOT-AVAILABLE   compliance.openshift.io/profile-guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
ocp4-moderate-node-worker   RUNNING   NOT-AVAILABLE   compliance.openshift.io/profile-guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/suite=test
rhcos4-moderate-master      RUNNING   NOT-AVAILABLE   compliance.openshift.io/profile-guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
rhcos4-moderate-worker      RUNNING   NOT-AVAILABLE   compliance.openshift.io/profile-guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/suite=test
$ oc get suite -w
NAME   PHASE     RESULT
test   DONE          NON-COMPLIANT
$ oc get ccr -l compliance.openshift.io/scan-name=ocp4-moderate --show-labels | head -n 3
NAME                                                                    STATUS   SEVERITY   LABELS
ocp4-moderate-accounts-restrict-service-account-tokens                  MANUAL   medium     compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=MANUAL,compliance.openshift.io/profile-guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/scan-name=ocp4-moderate,compliance.openshift.io/suite=test
ocp4-moderate-accounts-unique-service-account                           MANUAL   medium     compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=MANUAL,compliance.openshift.io/profile-guid=d625badc-92a1-5438-afd7-19526c26b03c,compliance.openshift.io/scan-name=ocp4-moderate,compliance.openshift.io/suite=test
$ oc get ccr -l compliance.openshift.io/scan-name=ocp4-moderate-node-master --show-labels | head -n 3
NAME                                                                               STATUS   SEVERITY   LABELS
ocp4-moderate-node-master-directory-access-var-log-kube-audit                      FAIL     medium     compliance.openshift.io/automated-remediation=,compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=FAIL,compliance.openshift.io/profile-guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/scan-name=ocp4-moderate-node-master,compliance.openshift.io/suite=test
ocp4-moderate-node-master-directory-access-var-log-oauth-audit                     FAIL     medium     compliance.openshift.io/automated-remediation=,compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=FAIL,compliance.openshift.io/profile-guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/scan-name=ocp4-moderate-node-master,compliance.openshift.io/suite=test
$ oc get ccr -l compliance.openshift.io/scan-name=ocp4-moderate-node-worker --show-labels | head -n 3
NAME                                                                               STATUS   SEVERITY   LABELS
ocp4-moderate-node-worker-file-groupowner-cni-conf                                 PASS     medium     compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=PASS,compliance.openshift.io/profile-guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/scan-name=ocp4-moderate-node-worker,compliance.openshift.io/suite=test
ocp4-moderate-node-worker-file-groupowner-kubelet-conf                             PASS     medium     compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=PASS,compliance.openshift.io/profile-guid=ef297cbd-f5a0-5c0c-baab-edeebb761e27,compliance.openshift.io/scan-name=ocp4-moderate-node-worker,compliance.openshift.io/suite=test
$ oc get ccr -l compliance.openshift.io/scan-name=rhcos4-moderate-master --show-labels | head -n 3
NAME                                                                                                STATUS   SEVERITY   LABELS
rhcos4-moderate-master-accounts-no-uid-except-zero                                                  PASS     high       compliance.openshift.io/check-severity=high,compliance.openshift.io/check-status=PASS,compliance.openshift.io/profile-guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/scan-name=rhcos4-moderate-master,compliance.openshift.io/suite=test
rhcos4-moderate-master-audit-rules-dac-modification-chmod                                           FAIL     medium     compliance.openshift.io/automated-remediation=,compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=FAIL,compliance.openshift.io/profile-guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/scan-name=rhcos4-moderate-master,compliance.openshift.io/suite=test
$ oc get ccr -l compliance.openshift.io/scan-name=rhcos4-moderate-worker --show-labels | head -n 3
NAME                                                                                                STATUS   SEVERITY   LABELS
rhcos4-moderate-worker-accounts-no-uid-except-zero                                                  PASS     high       compliance.openshift.io/check-severity=high,compliance.openshift.io/check-status=PASS,compliance.openshift.io/profile-guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/scan-name=rhcos4-moderate-worker,compliance.openshift.io/suite=test
rhcos4-moderate-worker-audit-rules-dac-modification-chmod                                           FAIL     medium     compliance.openshift.io/automated-remediation=,compliance.openshift.io/check-severity=medium,compliance.openshift.io/check-status=FAIL,compliance.openshift.io/profile-guid=eceb9af0-17d4-5c59-9b17-07cfd22a3ba1,compliance.openshift.io/scan-name=rhcos4-moderate-worker,compliance.openshift.io/suite=test

xiaojiey · 2024-05-08T12:18:39Z

/unhold

xiaojiey · 2024-05-08T12:18:48Z

/label qe-approved

In order to be able to search a profile easily, let's move the guid as an label in the profile.

pkg/profileparser/profileparser.go

rhmdnd

/lgtm

openshift-ci · 2024-05-15T20:19:43Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: rhmdnd, Vincent056, yuumasato

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Vincent056,rhmdnd]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci bot requested review from BhargaviGudi and xiaojiey April 12, 2024 08:25

openshift-ci bot added the approved label Apr 12, 2024

Vincent056 force-pushed the unique branch from 4ff8c27 to e60932b Compare April 15, 2024 07:10

openshift-ci bot added the do-not-merge/hold label Apr 16, 2024

openshift-ci bot removed the do-not-merge/hold label Apr 16, 2024

openshift-ci bot added the qe-approved label Apr 16, 2024

Vincent056 force-pushed the unique branch 4 times, most recently from 164e6a2 to 6650303 Compare April 16, 2024 11:35

Add unique profile ID

757c9c5

This commit implements unique profile ID feature, we are adding a unique profile ID to Profile, ComplianceScan, and ComplianceCheckResult CRD. The profile UUID is generated from sha1 of <bundlename>-<existing-xccdf-profile-id>

Vincent056 force-pushed the unique branch from 6650303 to 757c9c5 Compare April 19, 2024 12:52

yuumasato reviewed Apr 22, 2024

View reviewed changes

pkg/profileparser/profileparser.go Outdated Show resolved Hide resolved

Vincent056 and others added 3 commits April 23, 2024 00:31

Update cmd/manager/aggregator.go

14b2367

Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>

Fix tp unique uuid

e0d91b5

Add logic to handle tailoredprofile unique profile id, let's generated a unique uuid using tailoredprofile id.

Update pkg/xccdf/tailoring.go

7d994c0

Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>

yuumasato reviewed Apr 23, 2024

View reviewed changes

pkg/xccdf/tailoring.go Outdated Show resolved Hide resolved

pkg/apis/compliance/v1alpha1/tailoredprofile_types.go Outdated Show resolved Hide resolved

pkg/apis/compliance/v1alpha1/profile_types.go Outdated Show resolved Hide resolved

Vincent056 force-pushed the unique branch from 9cdfc2c to cfd233e Compare April 23, 2024 15:16

rhmdnd reviewed Apr 24, 2024

View reviewed changes

pkg/apis/compliance/v1alpha1/profile_types.go Outdated Show resolved Hide resolved

Update tests/e2e/parallel/main_test.go

67cac7e

Co-authored-by: Watson Yuuma Sato <wsato@redhat.com>

Vincent056 force-pushed the unique branch from 43e1232 to 255819f Compare May 6, 2024 11:35

openshift-ci bot removed the lgtm label May 6, 2024

Fix GUID for cross bundle scan

9e31bd1

Added check to make sure the scan we are going to label for the profile GID come from the actully profile being used for the scan, because two profile can potentially have the same name, we want to take bundle name into consideration

Vincent056 force-pushed the unique branch from 255819f to 9e31bd1 Compare May 6, 2024 13:08

rhmdnd reviewed May 6, 2024

View reviewed changes

cmd/manager/aggregator.go Show resolved Hide resolved

rhmdnd reviewed May 6, 2024

View reviewed changes

pkg/controller/compliancesuite/compliancesuite_controller.go Show resolved Hide resolved

rhmdnd requested changes May 6, 2024

View reviewed changes

Vincent056 requested a review from rhmdnd May 7, 2024 15:28

rhmdnd reviewed May 8, 2024

View reviewed changes

tests/e2e/serial/main_test.go Outdated Show resolved Hide resolved

openshift-ci bot removed the do-not-merge/hold label May 8, 2024

openshift-ci bot added the qe-approved label May 8, 2024

Vincent056 force-pushed the unique branch 3 times, most recently from 3d6c18c to 0f66275 Compare May 9, 2024 01:09

Fixing e2e assertion, and use a better name for profile guid lable

44ab8f2

Vincent056 force-pushed the unique branch from 0f66275 to 44ab8f2 Compare May 9, 2024 07:27

Move profile GUID to label

9b7063f

In order to be able to search a profile easily, let's move the guid as an label in the profile.

rhmdnd reviewed May 11, 2024

View reviewed changes

pkg/profileparser/profileparser.go Outdated Show resolved Hide resolved

rhmdnd approved these changes May 15, 2024

View reviewed changes

openshift-ci bot added the lgtm label May 15, 2024

openshift-merge-bot bot merged commit 9e8ea4d into ComplianceAsCode:master May 15, 2024
14 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add unique profile ID #502

Add unique profile ID #502

Vincent056 commented Apr 12, 2024 •

edited

Loading

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

Vincent056 commented Apr 17, 2024

Vincent056 commented Apr 19, 2024

yuumasato left a comment

Vincent056 commented Apr 23, 2024

Vincent056 commented Apr 30, 2024

BhargaviGudi commented May 2, 2024

Vincent056 commented May 6, 2024 •

edited

Loading

rhmdnd May 6, 2024

Vincent056 May 7, 2024

rhmdnd May 6, 2024

rhmdnd left a comment

xiaojiey commented May 8, 2024

xiaojiey commented May 8, 2024

xiaojiey commented May 8, 2024

rhmdnd left a comment

openshift-ci bot commented May 15, 2024

Add unique profile ID #502

Add unique profile ID #502

Conversation

Vincent056 commented Apr 12, 2024 • edited Loading

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

xiaojiey commented Apr 16, 2024

Vincent056 commented Apr 17, 2024

Vincent056 commented Apr 19, 2024

yuumasato left a comment

Choose a reason for hiding this comment

Vincent056 commented Apr 23, 2024

Vincent056 commented Apr 30, 2024

BhargaviGudi commented May 2, 2024

Vincent056 commented May 6, 2024 • edited Loading

rhmdnd May 6, 2024

Choose a reason for hiding this comment

Vincent056 May 7, 2024

Choose a reason for hiding this comment

rhmdnd May 6, 2024

Choose a reason for hiding this comment

rhmdnd left a comment

Choose a reason for hiding this comment

xiaojiey commented May 8, 2024

xiaojiey commented May 8, 2024

xiaojiey commented May 8, 2024

rhmdnd left a comment

Choose a reason for hiding this comment

openshift-ci bot commented May 15, 2024

Vincent056 commented Apr 12, 2024 •

edited

Loading

Vincent056 commented May 6, 2024 •

edited

Loading