ComplianceAsCode / ComplianceAsCode/auditree-arboretum

new feature: create OSCAL json report from compliance operator evidence

Open
#49 0 comments 0 reactions 1 assignee Claimed by @degenaro View on GitHub
documentation enhancement harvest report
Dominant language
Python
Stars
22
Forks
12
PR merge metrics
No merged PRs in 30d

Description

## Overview

Provide a harvest report to transform Kubernetes compliance operator evidence from [cluster_resource](https://github.com/ComplianceAsCode/auditree-arboretum/issues/9) fetcher into a [NIST OSCAL Assessment Results](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/) collection of Observations in JSON format.

Rationale: standardized version of evidence for multi-cloud and to facilitate creation of [NIST OSCAL Assessment Results](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/).

## Requirements

- The [cluster_resource](https://github.com/ComplianceAsCode/auditree-arboretum/issues/9) fetcher produces evidence comprising a JSON file with embedded XML in non-OSCAL format.
- The harvest report is to produce a JSON file comprising [NIST OSCAL Assessment Results](https://pages.nist.gov/OSCAL/documentation/schema/assessment-results-layer/assessment-results/) Observations.
- The harvest report is to produce an enhanced JSON file with additional Observation data when an optional oscal-metadata YAML file is specified.
- Employ transformation technology available from [compliance-trestle](https://github.com/IBM/compliance-trestle) open source project.

## Approach

Write a harvest report that consumes [cluster_resource](https://github.com/ComplianceAsCode/auditree-arboretum/issues/9) evidence and optional oscal-metadata.yaml to produce compliance_oscal_observations.json.

Steps:
- read evidence from cluster_resource.json.
- read enhancement data from oscal_metadata.yaml, if exists.
- employ trestle transformer to create list of trestle Observations.
- write trestle Observations JSON as compliance_oscal_observations.json.

## Security and Privacy

N/A

## Test Plan

Employ unit tests comprising representative cluster_resource.json and oscal-metadata.yaml.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.