Merge commit 'fe564d72279f4ab061b961dd528623f0ed272667' as 'cluster-config'

cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scan-setting-binding.yaml

@@ -0,0 +1,19 @@
+apiVersion: compliance.openshift.io/v1alpha1
+kind: ScanSettingBinding
+metadata:
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "1"
+  name: cis-compliance
+  namespace: openshift-compliance
+profiles:
+- apiGroup: compliance.openshift.io/v1alpha1
+  kind: TailoredProfile
+  name: ocp4-cis-node-lab
+- apiGroup: compliance.openshift.io/v1alpha1
+  kind: TailoredProfile
+  name: ocp4-cis-lab
+settingsRef:
+  apiGroup: compliance.openshift.io/v1alpha1
+  kind: ScanSetting
+  name: default

cluster-config/components/compliance-operator/overlays/cis-compliance/cis-compliance-scansetting.yaml

@@ -0,0 +1,37 @@
+apiVersion: compliance.openshift.io/v1alpha1
+kind: ScanSetting
+metadata:
+  name: cis-compliance
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "1"
+rawResultStorage:
+  nodeSelector:
+    node-role.kubernetes.io/master: ""
+  pvAccessModes:
+  - ReadWriteOnce
+  rotation: 3
+  size: 1Gi
+  tolerations:
+  - effect: NoSchedule
+    key: node-role.kubernetes.io/master
+    operator: Exists
+  - effect: NoExecute
+    key: node.kubernetes.io/not-ready
+    operator: Exists
+    tolerationSeconds: 300
+  - effect: NoExecute
+    key: node.kubernetes.io/unreachable
+    operator: Exists
+    tolerationSeconds: 300
+  - effect: NoSchedule
+    key: node.kubernetes.io/memory-pressure
+    operator: Exists
+roles:
+- master
+- worker
+scanTolerations:
+- operator: Exists
+schedule: 0 */3 * * *
+showNotApplicable: false
+strictNodeScan: true

cluster-config/components/compliance-operator/overlays/cis-compliance/kustomization.yaml

@@ -0,0 +1,27 @@
+# Assumes the cluster admin had pre-created the sealed-secrets project and secret.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: openshift-compliance
+
+resources:
+- github.com/redhat-cop/gitops-catalog/compliance-operator/operator/overlays/release-0.1
+- ocp-cis-tailored-profile.yaml
+- ocp-cis-node-tailored-profile.yaml
+- cis-compliance-scan-setting-binding.yaml
+- cis-compliance-scansetting.yaml
+
+patches:
+- patch: |-
+    - op: add
+      path: /metadata/labels
+      value: {"openshift.io/cluster-monitoring": "true"}
+  target:
+    kind: Namespace
+- patch: |-
+    - op: replace
+      path: /spec/channel
+      value: stable
+  target:
+    kind: Subscription
+    name: compliance-operator

cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-node-tailored-profile.yaml

@@ -0,0 +1,18 @@
+apiVersion: compliance.openshift.io/v1alpha1
+kind: TailoredProfile
+metadata:
+  name: ocp4-cis-node-lab
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  extends: ocp4-cis-node
+  description: Lab CIS node profile
+  title: Lab CIS node profile
+  disableRules:
+  - name: ocp4-file-permissions-etcd-data-dir
+    rationale: Default value of `drwxr-xr-x.` is fine
+  - name: ocp4-kubelet-enable-protect-kernel-defaults
+    rationale: Not applicable
+  - name: ocp4-kubelet-enable-protect-kernel-sysctl
+    rationale: Not applicable

cluster-config/components/compliance-operator/overlays/cis-compliance/ocp-cis-tailored-profile.yaml

@@ -0,0 +1,38 @@
+apiVersion: compliance.openshift.io/v1alpha1
+kind: TailoredProfile
+metadata:
+  name: ocp4-cis-lab
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  extends: ocp4-cis
+  description: Lab CIS profile
+  title: Lab CIS profile
+  disableRules:
+  - name: ocp4-api-server-encryption-provider-cipher
+    rationale: Using letsencrypt certificates, not applicable
+  - name: ocp4-audit-log-forwarding-enabled
+    rationale: Homelab so no log forwarding available
+  - name: ocp4-scc-limit-container-allowed-capabilities
+    rationale: Some containers require extra privileges
+  - name: ocp4-configure-network-policies-namespaces
+    rationale: Home lab supports ad-hoc demos
+  - name: ocp4-api-server-audit-log-maxsize
+    rationale: Home lab, no need for auditing
+  - name: ocp4-ocp-api-server-audit-log-maxsize
+    rationale: Home lab, no need for auditing
+  - name: ocp4-audit-profile-set
+    rationale: Home lab, default auditing is sufficient
+  - name: ocp4-ocp-allowed-registries
+    rationale: Home lab, open registries is fine
+  - name: ocp4-ocp-allowed-registries-for-import
+    rationale: Home lab, open registries is fine
+  - name: ocp4-api-server-api-priority-gate-enabled
+    rationale: Need to understand mis-behaving clients in Home lab
+  - name: ocp4-kubelet-configure-tls-cipher-suites-ingresscontroller
+    rationale: Home lab
+  - name: ocp4-api-server-tls-cipher-suites
+    rationale: Home lab
+  - name: ocp4-kubelet-configure-tls-cipher-suites
+    rationale: Home lab