diff --git a/_topic_maps/_topic_map.yml b/_topic_maps/_topic_map.yml index f3cadae08b7..d468ee57588 100644 --- a/_topic_maps/_topic_map.yml +++ b/_topic_maps/_topic_map.yml @@ -1226,6 +1226,8 @@ Topics: Topics: - Name: Supported compliance profiles File: compliance-operator-supported-profiles + - Name: OpenShift Virtualization CIS extension profiles + File: compliance-operator-ocp-virt-cis-profile - Name: Compliance Operator scans File: compliance-scans - Name: Propagating custom metadata to ComplianceCheckResult objects diff --git a/modules/compliance-ocp-virt-cis-profile.adoc b/modules/compliance-ocp-virt-cis-profile.adoc new file mode 100644 index 00000000000..788b798bcf1 --- /dev/null +++ b/modules/compliance-ocp-virt-cis-profile.adoc @@ -0,0 +1,44 @@ +// Module included in the following assemblies: +// +// * security/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc + +:_mod-docs-content-type: CONCEPT +[id="compliance_ocp_virt_cis_profile_{context}"] += About CIS Virtualization extension profiles + +[role="_abstract"] +To assess {VirtProductName} workloads against CIS controls that apply when virtualization is installed, use the `ocp4-cis-vm-extension` and `ocp4-cis-vm-extension-node` profiles with the Compliance Operator. + +The OpenShift Virtualization CIS extension profiles extend the base CIS profiles with checks for {VirtProductName} components, such as KubeVirt and HyperConverged cluster configuration. The platform profile uses Common Expression Language (CEL) rules. The node profile uses XCCDF rules. + +Use these profiles on clusters where you run {VirtProductName}. They complement, but do not replace, the base `ocp4-cis` and `ocp4-cis-node` profiles. + +[id="compliance-ocp-virt-profile-prereqs_{context}"] +== Prerequisites + +* You have installed the Compliance Operator on the cluster. +* You have installed Compliance Operator 1.10 or later on the cluster that runs the scan. +* You have installed {VirtProductName} if you expect platform extension checks to pass. Without {VirtProductName}, CEL rules that target virtualization custom resources can report an `ERROR` result because the required API objects are not present. +* You have installed optional operators referenced by individual rules, such as the SR-IOV Network Operator, for those rules to pass instead of reporting `ERROR`. + +[id="compliance-ocp-virt-profile-pairing_{context}"] +== Profile pairing + +Run the extension profiles together with the base CIS profiles and pair platform and node profiles: + +* `ocp4-cis` with `ocp4-cis-vm-extension` (platform) +* `ocp4-cis-node` with `ocp4-cis-vm-extension-node` (node) + +Node profiles must be used with the relevant Platform profile. + +[id="compliance-ocp-virt-profile-rhacs_{context}"] +== Scheduling scans from Red Hat Advanced Cluster Security + +Red Hat Advanced Cluster Security for Kubernetes discovers Compliance Operator profiles on secured clusters. After Compliance Operator 1.10 delivers the extension profiles, you can add `ocp4-cis-vm-extension` and `ocp4-cis-vm-extension-node` to a Red Hat Advanced Cluster Security scan configuration for a cluster that runs {VirtProductName}. + +In the Red Hat Advanced Cluster Security web console, the profiles appear under the existing **CIS** compliance tab. Red Hat Advanced Cluster Security does not provide a separate tab for virtualization profiles. + +[NOTE] +==== +Scan results for virtualization extension rules are visible in Red Hat Advanced Cluster Security compliance coverage when the Compliance Operator integration is healthy on the secured cluster. +==== diff --git a/modules/compliance-supported-profiles.adoc b/modules/compliance-supported-profiles.adoc index 96f76a69484..e607ce0200d 100644 --- a/modules/compliance-supported-profiles.adoc +++ b/modules/compliance-supported-profiles.adoc @@ -68,12 +68,33 @@ The following tables reflect the latest available profiles in the Compliance Ope `aarch64` |{product-rosa} with {hcp} (ROSA HCP) +|ocp4-cis-vm-extension ^[5]^ +|CIS Red{nbsp}Hat {product-title} Benchmark — {VirtProductName} extension +|Platform +|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks ™] ^[4]^ +|`x86_64` + `ppc64le` + `s390x` + `aarch64` +| + +|ocp4-cis-vm-extension-node ^[5]^ +|CIS Red{nbsp}Hat {product-title} Benchmark — {VirtProductName} extension +|Node ^[2]^ +|link:https://www.cisecurity.org/cis-benchmarks/[CIS Benchmarks ™] ^[4]^ +|`x86_64` + `ppc64le` + `s390x` + `aarch64` +| + |=== [.small] 1. The `ocp4-cis` and `ocp4-cis-node` profiles maintain the most up-to-date version of the CIS benchmark as it becomes available in the Compliance Operator. If you want to adhere to a specific version, such as CIS v1.9.0, use the `ocp4-cis-1-9` and `ocp4-cis-node-1-9` profiles. 2. Node profiles must be used with the relevant Platform profile. For more information, see _Compliance Operator profile types_. 3. All earlier CIS profiles are superceded by CIS v1.9.0. It is recommended to apply the latest profile to your environment. 4. To locate the CIS {product-title} v4 Benchmark, go to link:https://www.cisecurity.org/benchmark/kubernetes[CIS Benchmarks] and click *Download Latest CIS Benchmark*, where you can then register to download the benchmark. +5. OpenShift Virtualization extension profiles extend the base `ocp4-cis` and `ocp4-cis-node` profiles. Run them together on clusters that use {VirtProductName}. For more information, see _OpenShift Virtualization CIS extension profiles_. [id="bsi-profiles_{context}"] == BSI Profile Support diff --git a/security/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc b/security/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc new file mode 100644 index 00000000000..97d491df3c5 --- /dev/null +++ b/security/compliance_operator/co-scans/compliance-operator-ocp-virt-cis-profile.adoc @@ -0,0 +1,20 @@ +:_mod-docs-content-type: ASSEMBLY +[id="compliance-operator-ocp-virt-cis-profile"] += OpenShift Virtualization CIS extension profiles +include::_attributes/common-attributes.adoc[] +:context: compliance-ocp-virt-cis-profile + +toc::[] + +[role="_abstract"] +Use Compliance Operator CIS extension profiles to assess {VirtProductName} configuration on {product-title} clusters, and schedule those profiles from Red Hat Advanced Cluster Security when the Compliance Operator integration is enabled. + +include::modules/compliance-ocp-virt-cis-profile.adoc[leveloffset=+1] + +[role="_additional-resources"] +[id="additional-resources_{context}"] +== Additional resources + +* xref:compliance-operator-supported-profiles.adoc#cis-profiles_compliance-operator-supported-profiles[CIS compliance profiles] +* xref:../co-concepts/compliance-operator-understanding.adoc#compliance_profile_types_understanding-compliance[Compliance Operator profile types] +* link:https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/html/operating/managing-compliance[Managing compliance in Red Hat Advanced Cluster Security for Kubernetes] diff --git a/security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc b/security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc index 06156bcd34f..a50e95de63c 100644 --- a/security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc +++ b/security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc @@ -24,5 +24,6 @@ include::modules/compliance-profile-types.adoc[leveloffset=+2] [id="additional-resources_{context}"] == Additional resources +* xref:compliance-operator-ocp-virt-cis-profile.adoc#compliance-operator-ocp-virt-cis-profile[OpenShift Virtualization CIS extension profiles] * link:https://access.redhat.com/solutions/6983418[Red Hat Knowledgebase Solution #6983418] * link:https://access.redhat.com/compliance[Product Compliance]