ComplianceAsCode / ComplianceAsCode/content

ocp4-api-server-no-adm-ctrl-plugins-disabled incorrectly failing on okd 4.9

Open
#8,085 5 comments 2 reactions 0 assignees View on GitHub
OpenShift
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Description of problem:
The rule ocp4-api-server-no-adm-ctrl-plugins-disabled is reporting as failing on okd 4.9 cluster with no disable-admission-plugins config present in the apiServerArguments config

The output from running the verification command is

`oc -n openshift-kube-apiserver get configmap config -o json | jq -r '[.data."config.yaml" | fromjson | select(.apiServerArguments."disable-admission-plugins"!=["PodSecurity"] and .apiServerArguments."disable-admission-plugins"!=[]) | .apiServerArguments."disable-admission-plugins"]'
[
null
]`

#### SCAP Security Guide Version:
kind: Rule
metadata:
annotations:
compliance.openshift.io/image-digest: pb-ocp4bbb26
compliance.openshift.io/rule: api-server-no-adm-ctrl-plugins-disabled
control.compliance.openshift.io/CIS-OCP: 1.2.13;1.2.14;1.2.15;1.2.16;1.2.17
control.compliance.openshift.io/NERC-CIP: CIP-003-8 R6;CIP-004-6 R3;CIP-007-3
R6.1
control.compliance.openshift.io/NIST-800-53: CM-6;CM-6(1)
control.compliance.openshift.io/PCI-DSS: Req-2.2
policies.open-cluster-management.io/controls: CIP-003-8 R6,CIP-004-6 R3,CIP-007-3
R6.1,CM-6,CM-6(1),Req-2.2,1.2.13,1.2.14,1.2.15,1.2.16,1.2.17
policies.open-cluster-management.io/standards: NERC-CIP,NIST-800-53,PCI-DSS,CIS-OCP

#### Operating System Version:
OKD 4.9 (4.9.0-0.okd-2021-12-12-025847)

#### Steps to Reproduce:

1. deploy okd 4.9 cluster with openshift-compliance operator included
2. verify compliance check results in openshift-compliance project
3. verify that no admission plugins are disabled with command provided in rule ocp4-api-server-no-adm-ctrl-plugins-disabled

#### Actual Results:
compliance check ocp4-api-server-no-adm-ctrl-plugins-disabled fails when no admission plugins are disabled

#### Expected Results:
compliance check passes when no admission plugins are disabled

#### Additional Information/Debugging Steps:

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.