ComplianceAsCode / ComplianceAsCode/auditree-arboretum
new feature: create OSCAL json report from compliance operator evidence
- Dominant language
- Python
- Stars
- 22
- Forks
- 12
- PR merge metrics
- No merged PRs in 30d
Description
## Overview
Provide a harvest report to transform Kubernetes compliance operator evidence from [cluster_resource](https://github.com/ComplianceAsCode/auditree-arboretum/issues/9) fetcher into a [NIST OSCAL Assessment Results](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/) collection of Observations in JSON format.
Rationale: standardized version of evidence for multi-cloud and to facilitate creation of [NIST OSCAL Assessment Results](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/).
## Requirements
- The [cluster_resource](https://github.com/ComplianceAsCode/auditree-arboretum/issues/9) fetcher produces evidence comprising a JSON file with embedded XML in non-OSCAL format.
- The harvest report is to produce a JSON file comprising [NIST OSCAL Assessment Results](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/) Observations.
- The harvest report is to produce an enhanced JSON file with additional Observation data when an optional oscal-metadata YAML file is specified.
- Employ transformation technology available from [compliance-trestle](https://github.com/IBM/compliance-trestle) open source project.
## Approach
Write a harvest report that consumes [cluster_resource](https://github.com/ComplianceAsCode/auditree-arboretum/issues/9) evidence and optional oscal-metadata.yaml to produce compliance_oscal_observations.json.
Steps:
- read evidence from cluster_resource.json.
- read enhancement data from oscal_metadata.yaml, if exists.
- employ trestle transformer to create list of trestle Observations.
- write trestle Observations JSON as compliance_oscal_observations.json.
## Security and Privacy
N/A
## Test Plan
Employ unit tests comprising representative cluster_resource.json and oscal-metadata.yaml.
Contributor guide
Assessment
This issue has not been assessed yet.