OCPBUGS-53041: Fix multi-platform support for OVS rules #13201
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
/test |
|
@rhmdnd: The Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test e2e-aws-ocp4-cis-node |
|
Both of the following rules pass on Specifically the |
rhmdnd
commented
Mar 19, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_lock_not_s390x/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
commented
Mar 19, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_s390x/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
commented
Mar 19, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_x86/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
commented
Mar 25, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_x86/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
force-pushed
the
OCPBUGS-53041
branch
3 times, most recently
from
c504136 to
b69553d
Compare
|
/test e2e-aws-ocp4-cis-node |
rhmdnd
commented
Mar 25, 2025
| @@ -0,0 +1,37 @@ | |||
| documentation_complete: true | |||
|
|
|||
| platform: ocp4-node and aarch64_arch | |||
There was a problem hiding this comment.
Strange - this rule isn't even getting reported in the results:
There was a problem hiding this comment.
Grab the html report from the ARF results and see why this failed.
There was a problem hiding this comment.
Suggested change
| platform: ocp4-node and aarch64_arch | |
| platforms: | |
| - ocp4-node | |
| - aarch64_arch |
There is an issue with the filter_rules where when the platforms is defined within a single line the comparison will fail thinking that ocp4-node is not part of the platforms, like this:
>>> platforms = {'ocp4-node and aarch64_arch'}
>>> "ocp4-node" in platforms
False
There was a problem hiding this comment.
😮💨 thanks for the help, that worked!
There was a problem hiding this comment.
One thing I noticed with this is that it works for running the rule on aarch64. But, if I apply the same technique to other rules intended for x86 or s390x, they will still get selected and run in the profile:
$ oc get ccr | grep ovs-conf-db-
upstream-ocp4-cis-node-master-file-groupowner-ovs-conf-db-aarch64 PASS medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-conf-db-s390x PASS medium
upstream-ocp4-cis-node-master-file-groupowner-ovs-conf-db-x86-64 FAIL medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-conf-db-aarch64 PASS medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-conf-db-s390x PASS medium
upstream-ocp4-cis-node-worker-file-groupowner-ovs-conf-db-x86-64 FAIL medium
It appears the x86 and s390x rules are not filtered out at run time, which is interesting because I think we do something similar with ocp4-node-on-sdn and ocp4-node-on-ovs for example.
There was a problem hiding this comment.
The ovs and sdn filters are leveraged in https://github.com/ComplianceAsCode/content/blob/master/products/ocp4/profiles/cis-node-1-7.profile#L26
rhmdnd
commented
Mar 28, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_s390x/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
commented
Mar 28, 2025
utils/build_ds_container.py
Outdated
| @@ -143,7 +143,7 @@ def build_container_image(): | |||
| REPO_PATH, '/Dockerfiles/compliance_operator_content.Dockerfile') | |||
| command = [ | |||
| 'podman', 'build', '-f', dockerfile_path, '-t', | |||
| 'localcontentbuild:latest', '.'] | |||
| 'localcontentbuild:latest', '--platform', 'linux/arm64', '.'] | |||
There was a problem hiding this comment.
Should pull this out into its own change.
|
unique-cces is failing |
|
/test e2e-aws-ocp4-cis-node |
|
Latest testing shows the current PR is pulling in rules it shouldn't be on aarch64: |
|
/test e2e-aws-ocp4-cis-node |
1 similar comment
|
/test e2e-aws-ocp4-cis-node |
|
ci/prow/e2e-aws-ocp4-cis-node ci/prow/e2e-aws-ocp4-cis-node-arm it looks like the test is working as expected |
|
/test e2e-aws-ocp4-cis-node |
rhmdnd
commented
Apr 1, 2025
controls/nist_ocp4.yml
Outdated
| @@ -1092,14 +1092,14 @@ controls: | |||
| - id: AC-6(8) | |||
| status: supported | |||
| notes: |- | |||
| Red Hat OpenShift provides security context constraints (SCC) [1] that control permissions for actions that a pod can perform and what resources a pod can access. | |||
| Red Hat OpenShift provides security context constraints (SCC) [1] that control permissions for actions that a pod can perform and what resources a pod can access. | |||
There was a problem hiding this comment.
Fixing all these random whitespace issues in #13261
|
/test |
|
@rhmdnd: The Use In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
/test e2e-aws-ocp4-moderate-node-arm |
rhmdnd
changed the title
rhmdnd
commented
Apr 1, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_lock_openvswitch/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
commented
Apr 1, 2025
applications/openshift/master/file_groupowner_ovs_conf_db_openvswitch/rule.yml
Outdated
Show resolved
Hide resolved
rhmdnd
commented
Apr 1, 2025
rhmdnd
commented
Apr 1, 2025
rhmdnd
commented
Apr 1, 2025
|
/test e2e-aws-ocp4-cis-node |
rhmdnd
commented
Apr 1, 2025
The approach we're using with OVAL to select rules based on conditions doesn't work for multi-arch checks. Instead, the rule always passes even when it's checking a platform that has `openvswitch` for the group owner instead of `hugetlbfs`. This commit attempts to simplify the rule by removing the complexity of OVAL and relying on individual rules, one for checking group ownership for openvswitch and the other for hugetlbfs. It also uses the platform consistently, instead of using platforms, which expects a list of conditions. Using platform is more straightforward, and incorporates the architecture CPE into the evaluation at runtime.
|
Code Climate has analyzed commit 8e54261 and detected 0 issues on this pull request. The test coverage on the diff in this pull request is 100.0% (50% is the threshold). This pull request will bring the total coverage in the repository to 61.9% (0.0% change). View more on Code Climate. |
|
/test e2e-aws-ocp4-cis-node |
|
Rerunning testing farm because of the following timeouts: Which seems unrelated to this change. @Mab879 are you seeing this crop up in other patches? |
|
Verified on a x86 clsuter + 4.19.0-0.nightly-2025-03-31-174812 + content from #13201: For ARM, checked below test result form e2e-aws-ocp4-cis-node-arm job, which is expected: |
|
/lgtm |
Vincent056
approved these changes
Apr 2, 2025
rhmdnd
added a commit
to rhmdnd/content
that referenced
this pull request
Apr 3, 2025
There were added initially in ComplianceAsCode#13201 but were added for the platform profiles in addition to the node profiles.
rhmdnd
added a commit
to rhmdnd/content
that referenced
this pull request
Apr 3, 2025
There were added initially in ComplianceAsCode#13201 but were added for the platform profiles in addition to the node profiles.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.