component-definition.json

{
  "component-definition": {
    "uuid": "9b6eb366-0ddf-4f89-94b9-a60bb40acd9a",
    "metadata": {
      "title": "Component Definition for Kube",
      "last-modified": "2024-05-01T18:45:58+00:00",
      "version": "1.0",
      "oscal-version": "1.0.4"
    },
    "components": [
      {
        "uuid": "0e902a4c-1b39-4d0f-a33e-2db458e8a2c3",
        "type": "software",
        "title": "Kubernetes",
        "description": "Kubernetes",
        "props": [
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "advanced-restrict-image-registries",
            "remarks": "rule_set_00"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "In instances where a ClusterPolicy defines all the approved image registries is insufficient, more granular control may be needed to set permitted registries, especially in multi-tenant use cases where some registries may be based on the Namespace. This policy shows an advanced version of the Restrict Image Registries policy which gets a global approved registry from a ConfigMap and, based upon an annotation at the Namespace level, gets the registry approved for that Namespace.",
            "remarks": "rule_set_00"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "allowed-base-images",
            "remarks": "rule_set_01"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Building images which specify a base as their origin is a good start to improving supply chain security, but over time organizations may want to build an allow list of specific base images which are allowed to be used when constructing containers. This policy ensures that a container's base, found in an OCI annotation, is in a cluster-wide allow list.",
            "remarks": "rule_set_01"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "allowed-image-repos",
            "remarks": "rule_set_02"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "In addition to restricting the image registry from which images are pulled, in some cases and for example in some restricted Namespaces. This policy ensures that the only allowed image repositories present in a given Pod, across any container type, come from the designated list.",
            "remarks": "rule_set_02"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "allowed-label-changes",
            "remarks": "rule_set_03"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "In some cases, operations teams need a type of limited access to change resources during troubleshooting or outage mitigation. This policy demonstrates how to prevent modification to labels except one with the key `breakglass`. Changing, adding, or deleting any other labels is denied.",
            "remarks": "rule_set_03"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "allowed-podpriorities",
            "remarks": "rule_set_04"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "A Pod PriorityClass is used to provide a guarantee on the scheduling of a Pod relative to others. In certain cases where not all users in a cluster are trusted, a malicious user could create Pods at the highest possible priorities, causing other Pods to be evicted/not get scheduled. This policy checks the defined `priorityClassName` in a Pod spec to a dictionary of allowable PriorityClasses for the given Namespace stored in a ConfigMap. If the `priorityClassName` is not among them, the Pod is blocked.",
            "remarks": "rule_set_04"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "podsecurity-subrule-baseline",
            "remarks": "rule_set_05"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The baseline profile of the Pod Security Standards is a collection of the most basic and important steps that can be taken to secure Pods. Beginning with Kyverno 1.8, an entire profile may be assigned to the cluster through a single rule. This policy configures the baseline profile through the latest version of the Pod Security Standards cluster wide.",
            "remarks": "rule_set_05"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-cluster-admin-from-ns",
            "remarks": "rule_set_06"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "In some cases we would want to block operations (CREATE/UPDATE/DELETE) of certain privileged users (i.e. cluster-admins), in a specific namespace. In this policy, Kyverno look for all user operations (`CREATE, UPDATE, DELETE`), on every object kind (Pod,Deployment,Route,Service,etc.), in the testnamespace namespace, and for the `clusterRole cluster-admin`. The `subject User testuser` is also mentioned so it won’t include all the cluster-admins in the cluster, but will be flexiable enough to apply only for a sub-group of the cluster-admins in the cluster.",
            "remarks": "rule_set_06"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-ephemeral-containers",
            "remarks": "rule_set_07"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Ephemeral containers, enabled by default in Kubernetes 1.23, allow users to use the `kubectl debug` functionality and attach a temporary container to an existing Pod. This may potentially be used to gain access to unauthorized information executing inside one or more containers in that Pod. This policy blocks the use of ephemeral containers.",
            "remarks": "rule_set_07"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-images-with-volumes",
            "remarks": "rule_set_08"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "OCI images may optionally be built with VOLUME statements which, if run in read-only mode, would still result in write access to the specified location. This may be unexpected and undesirable. This policy checks the contents of every container image and inspects them for such VOLUME statements, then blocks if found.",
            "remarks": "rule_set_08"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-large-images",
            "remarks": "rule_set_09"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Pods which run containers of very large image size take longer to pull and require more space to store. A user may either inadvertently or purposefully name an image which is unusually large to disrupt operations. This policy checks the size of every container image and blocks if it is over 2 Gibibytes.",
            "remarks": "rule_set_09"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "deny-exec-by-namespace-label",
            "remarks": "rule_set_10"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can be useful for troubleshooting purposes, it could represent an attack vector and is discouraged. This policy blocks Pod exec commands based upon a Namespace label `exec=false`.",
            "remarks": "rule_set_10"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "deny-exec-by-namespace-name",
            "remarks": "rule_set_11"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can be useful for troubleshooting purposes, it could represent an attack vector and is discouraged. This policy blocks Pod exec commands to Pods in a Namespace called `pci`.",
            "remarks": "rule_set_11"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "deny-exec-by-pod-and-container",
            "remarks": "rule_set_12"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can be useful for troubleshooting purposes, it could represent an attack vector and is discouraged. This policy blocks Pod exec commands to containers named `nginx` in Pods starting with name `myapp-maintenance`.",
            "remarks": "rule_set_12"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "deny-exec-by-pod-label",
            "remarks": "rule_set_13"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can be useful for troubleshooting purposes, it could represent an attack vector and is discouraged. This policy blocks Pod exec commands to Pods having the label `exec=false`.",
            "remarks": "rule_set_13"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "deny-exec-by-pod-name",
            "remarks": "rule_set_14"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The `exec` command may be used to gain shell access, or run other commands, in a Pod's container. While this can be useful for troubleshooting purposes, it could represent an attack vector and is discouraged. This policy blocks Pod exec commands to Pods beginning with the name `myapp-maintenance-`.",
            "remarks": "rule_set_14"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-stale-images",
            "remarks": "rule_set_15"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Images that are old usually have some open security vulnerabilities which are not patched. This policy checks the contents of every container image and inspects them for the create time. If it finds any image which was built more than 6 months ago this policy blocks the deployment.",
            "remarks": "rule_set_15"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-updates-deletes",
            "remarks": "rule_set_16"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Kubernetes RBAC allows for controls on kinds of resources or those with specific names. But it does not have the type of granularity often required in more complex environments. This policy restricts updates and deletes to any Service resource that contains the label `protected=true` unless by a cluster-admin.",
            "remarks": "rule_set_16"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "block-velero-restore",
            "remarks": "rule_set_17"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Velero allows on backup and restore operations and is designed to be run with full cluster admin permissions. It allows on cross namespace restore operations, which means you can restore backup of namespace A to namespace B. This policy protect restore operation into system or any protected namespaces, listed in deny condition section. It checks the Restore CRD object and its namespaceMapping field. If destination match protected namespace then operation fails and warning message is throw.",
            "remarks": "rule_set_17"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "cert-manager-limit-duration",
            "remarks": "rule_set_18"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Kubernetes managed non-letsencrypt certificates have to be renewed in every 100 days.",
            "remarks": "rule_set_18"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "k10-3-2-1-backup-policy",
            "remarks": "rule_set_19"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "The rule of 3-2-1 recommends that you have at least 3 copies of data, on 2 different storage targets, and 1 being offsite. 3-2-1 ensures a health mix of redundancy options for data recovery of the application for localized & multi-region cloud failures or compromise. In K8s/K10, this translates to the original StatefulSet (the original PersistentVolumeClaim), a backup (a snapshot of the PVC on prod storage), and an export to cloud object storage (a secondary cloud copy of the PVC snapshot).",
            "remarks": "rule_set_19"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "check-deprecated-apis",
            "remarks": "rule_set_20"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "Kubernetes APIs are sometimes deprecated and removed after a few releases. As a best practice, older API versions should be replaced with newer versions. This policy validates for APIs that are deprecated or scheduled for removal.",
            "remarks": "rule_set_20"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "k10-policy-hourly-rpo",
            "remarks": "rule_set_21"
          },
          {
            "name": "Rule_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
            "value": "K10 Policy resources can be educated to adhere to common Recovery Point Objective (RPO) best practices. This policy is advising to use an RPO frequency that with hourly granularity if it has the appPriority: Mission Critical",
            "remarks": "rule_set_21"
          }
        ],
        "control-implementations": [
          {
            "uuid": "398f48b2-2c9f-4586-a983-1266de0b8dff",
            "source": "catalogs/NIST_SP-800-53_rev5_HIGH/NIST_SP-800-53_rev5_HIGH-baseline-resolved-profile_catalog.json",
            "description": "NIST r5 ",
            "implemented-requirements": [
              {
                "uuid": "45b59b0c-5d78-448c-9ded-7d5ba63d00ab",
                "control-id": "cm-8.3",
                "description": "",
                "statements": [
                  {
                    "statement-id": "cm-8.3_smt.a",
                    "uuid": "d7bcf15a-4f4b-4327-97e7-e7f0747948fa",
                    "description": "",
                    "props": [
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "advanced-restrict-image-registries"
                      },
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "allowed-base-images"
                      },
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "allowed-image-repos"
                      }
                    ]
                  }
                ]
              },
              {
                "control-id": "ac-3",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "allowed-label-changes"
                  }
                ]
              },
              {
                "uuid": "eb9a4be2-8bc1-474e-8824-40e0051e9e59",
                "control-id": "ac-6",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "allowed-label-changes"
                  }
                ]
              }
            ]
          },
          {
            "uuid": "d60a6634-c980-4492-94ee-cb455ab2733b",
            "source": "catalogs/NIST_SP-800-53_rev5_HIGH/NIST_SP-800-53_rev5_HIGH-baseline-resolved-profile_catalog.json",
            "description": "NIST r5",
            "implemented-requirements": [
              {
                "uuid": "93bd721b-6ba1-4a6a-89b5-9eaf30ec7bee",
                "control-id": "ac-4",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "allowed-podpriorities"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "podsecurity-subrule-baseline"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-ephemeral-containers"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-images-with-volumes"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-namespace-label"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-namespace-name"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-and-container"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-label"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-name"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-updates-deletes"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-velero-restore"
                  }
                ]
              },
              {
                "uuid": "6358aa48-b95b-4aa4-87eb-d4dafe316e1d",
                "control-id": "ac-6",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "allowed-podpriorities"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "podsecurity-subrule-baseline"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-cluster-admin-from-ns"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-ephemeral-containers"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-namespace-label"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-namespace-name"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-and-container"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-label"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-name"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-updates-deletes"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-velero-restore"
                  }
                ]
              },
              {
                "uuid": "590107c7-69dd-462f-a297-0e58c76fccee",
                "control-id": "ac-3",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "podsecurity-subrule-baseline"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-cluster-admin-from-ns"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-namespace-label"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-namespace-name"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-and-container"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-label"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "deny-exec-by-pod-name"
                  }
                ]
              },
              {
                "uuid": "9545aa69-2560-4112-a6eb-352986e88716",
                "control-id": "ac-2",
                "description": "",
                "statements": [
                  {
                    "statement-id": "ac-2_smt.d",
                    "uuid": "fd819e37-97a3-4e42-b92f-c3f744735fad",
                    "description": "",
                    "props": [
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "block-cluster-admin-from-ns"
                      }
                    ]
                  }
                ]
              },
              {
                "uuid": "dffa0040-b2a9-4f11-9dbf-782bb2e7f0c0",
                "control-id": "ac-5",
                "description": "",
                "statements": [
                  {
                    "statement-id": "ac-5_smt.c",
                    "uuid": "6a075d71-b756-481e-9710-f369dfcb091b",
                    "description": "",
                    "props": [
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "block-cluster-admin-from-ns"
                      }
                    ]
                  }
                ]
              },
              {
                "uuid": "2d345acd-f017-46f7-9adf-c9dadace37e5",
                "control-id": "sc-5",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-large-images"
                  }
                ]
              },
              {
                "uuid": "6dbd96d8-a18b-4de3-941a-00f22995fd82",
                "control-id": "cm-8.3",
                "description": "",
                "statements": [
                  {
                    "statement-id": "cm-8.3_smt.a",
                    "description": "",
                    "props": [
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "block-stale-images"
                      },
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "check-deprecated-apis"
                      }
                    ]
                  }
                ]
              },
              {
                "uuid": "03ba21cb-3b59-4888-b86a-aaf2a07b6e6a",
                "control-id": "si-2.2",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "block-stale-images"
                  },
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "check-deprecated-apis"
                  }
                ]
              },
              {
                "uuid": "3442dd1d-9520-444d-8482-0ddfbe3ad3ef",
                "control-id": "ia-5",
                "description": "",
                "statements": [
                  {
                    "statement-id": "ia-5_smt.g",
                    "uuid": "175411fe-a651-45bf-9a8d-3897f6319f1b",
                    "description": "",
                    "props": [
                      {
                        "name": "Rule_Id",
                        "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                        "value": "cert-manager-limit-duration"
                      }
                    ]
                  }
                ]
              },
              {
                "uuid": "1fdfc201-0783-4cbb-9bb6-0f7cb9a115ce",
                "control-id": "cp-2",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "k10-3-2-1-backup-policy"
                  }
                ]
              },
              {
                "uuid": "36c3f32e-878f-40b3-8cb4-13ebc28e3fe5",
                "control-id": "cp-9",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "k10-3-2-1-backup-policy"
                  }
                ]
              },
              {
                "uuid": "7cca92d8-78b4-4c5a-b418-71f9d197bcfd",
                "control-id": "cp-10",
                "description": "",
                "props": [
                  {
                    "name": "Rule_Id",
                    "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kubernetes",
                    "value": "k10-policy-hourly-rpo"
                  }
                ]
              }
            ]
          }
        ]
      },
      {g
        "uuid": "16e7040e-2a66-462c-bfd2-321ef7a3803a",
        "type": "validation",
        "title": "Kyverno",
        "description": "Kyverno",
        "props": [
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "advanced-restrict-image-registries",
            "remarks": "rule_set_22"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "advanced-restrict-image-registries",
            "remarks": "rule_set_22"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "advanced-restrict-image-registries",
            "remarks": "rule_set_22"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-base-images",
            "remarks": "rule_set_23"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-base-images",
            "remarks": "rule_set_23"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-base-images",
            "remarks": "rule_set_23"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-image-repos",
            "remarks": "rule_set_24"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-image-repos",
            "remarks": "rule_set_24"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-image-repos",
            "remarks": "rule_set_24"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-label-changes",
            "remarks": "rule_set_25"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-label-changes",
            "remarks": "rule_set_25"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-label-changes",
            "remarks": "rule_set_25"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-podpriorities",
            "remarks": "rule_set_26"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-podpriorities",
            "remarks": "rule_set_26"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "allowed-podpriorities",
            "remarks": "rule_set_26"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "podsecurity-subrule-baseline",
            "remarks": "rule_set_27"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "podsecurity-subrule-baseline",
            "remarks": "rule_set_27"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "podsecurity-subrule-baseline",
            "remarks": "rule_set_27"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-cluster-admin-from-ns",
            "remarks": "rule_set_28"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-cluster-admin-from-ns",
            "remarks": "rule_set_28"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-cluster-admin-from-ns",
            "remarks": "rule_set_28"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-ephemeral-containers",
            "remarks": "rule_set_29"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-ephemeral-containers",
            "remarks": "rule_set_29"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-ephemeral-containers",
            "remarks": "rule_set_29"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-images-with-volumes",
            "remarks": "rule_set_30"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-images-with-volumes",
            "remarks": "rule_set_30"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-images-with-volumes",
            "remarks": "rule_set_30"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-large-images",
            "remarks": "rule_set_31"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-large-images",
            "remarks": "rule_set_31"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-large-images",
            "remarks": "rule_set_31"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-namespace-label",
            "remarks": "rule_set_32"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-namespace-label",
            "remarks": "rule_set_32"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-namespace-label",
            "remarks": "rule_set_32"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-namespace-name",
            "remarks": "rule_set_33"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-namespace-name",
            "remarks": "rule_set_33"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-namespace-name",
            "remarks": "rule_set_33"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-and-container",
            "remarks": "rule_set_34"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-and-container",
            "remarks": "rule_set_34"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-and-container",
            "remarks": "rule_set_34"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-label",
            "remarks": "rule_set_35"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-label",
            "remarks": "rule_set_35"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-label",
            "remarks": "rule_set_35"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-name",
            "remarks": "rule_set_36"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-name",
            "remarks": "rule_set_36"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "deny-exec-by-pod-name",
            "remarks": "rule_set_36"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-stale-images",
            "remarks": "rule_set_37"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-stale-images",
            "remarks": "rule_set_37"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-stale-images",
            "remarks": "rule_set_37"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-updates-deletes",
            "remarks": "rule_set_38"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-updates-deletes",
            "remarks": "rule_set_38"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-updates-deletes",
            "remarks": "rule_set_38"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-velero-restore",
            "remarks": "rule_set_39"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-velero-restore",
            "remarks": "rule_set_39"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "block-velero-restore",
            "remarks": "rule_set_39"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "cert-manager-limit-duration",
            "remarks": "rule_set_40"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "cert-manager-limit-duration",
            "remarks": "rule_set_40"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "cert-manager-limit-duration",
            "remarks": "rule_set_40"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "k10-3-2-1-backup-policy",
            "remarks": "rule_set_41"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "k10-3-2-1-backup-policy",
            "remarks": "rule_set_41"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "k10-3-2-1-backup-policy",
            "remarks": "rule_set_41"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "check-deprecated-apis",
            "remarks": "rule_set_42"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "check-deprecated-apis",
            "remarks": "rule_set_42"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "check-deprecated-apis",
            "remarks": "rule_set_42"
          },
          {
            "name": "Rule_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "k10-policy-hourly-rpo",
            "remarks": "rule_set_43"
          },
          {
            "name": "Check_Id",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "k10-policy-hourly-rpo",
            "remarks": "rule_set_43"
          },
          {
            "name": "Check_Description",
            "ns": "http://ibm.github.io/compliance-trestle/schemas/oscal/cd/kyverno",
            "value": "k10-policy-hourly-rpo",
            "remarks": "rule_set_43"
          }
        ],
        "control-implementations": []
      }
    ]
  }
}