Bump OCP4 STIG from V2R2/V2R3 to V2R6 - #15042
Conversation
Update the STIG control file version, profile metadata, and reference XCCDF to align with DISA STIG V2R6 for Red Hat OpenShift Container Platform 4. Changes: - Control file version V2R2 -> V2R6 - CNTR-OS-000090 title updated to V2R6 wording - CNTR-OS-000630 title updated to V2R6 wording - New V2R6 versioned snapshot profiles (stig-v2r6, stig-node-v2r6) - V2R3 snapshots marked deprecated - Tip profiles (stig, stig-node) now extend V2R6 snapshots - Reference XCCDF updated from V2R3 to V2R6 Closes: CMP-4615 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The rule provides OCIL manual check instructions for verifying AlertManager receivers are configured. Status set to manual per CMP-2437 findings: the DISA Check/Fix text involves Web Console actions and the related SRGs are manual/does-not-meet. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The rule has an automated OVAL check that verifies edge-terminated routes use TLS (insecureEdgeTerminationPolicy is None or Redirect). Status set to partial because passthrough TLS still requires application-level verification. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The rhcos4 STIG reference was a symlink to the ocp4 reference file. Update it to point to the V2R6 file, create a V2R6 profile snapshot, deprecate V2R3, and update the tip profile to extend V2R6. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
…ofiles Kubevirt rules were added to the STIG control file in V2R6 and are scanned by the stig-virt CEL profile. Add filter_rules to exclude them from V2R3 snapshots, V2R6 platform profile, and RHCOS profiles where they are not applicable. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Delete ocp4 stig-v2r2, stig-node-v2r2, and rhcos4 stig-v2r2 profile snapshots since they are two versions behind V2R6. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
|
Updated the PR with two new commits:
|
|
@yuumasato: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
3 participants
Summary
CMP-4615
controls/stig_ocp4.ymlversion from V2R2 to V2R6, with minor title wording fixes for CNTR-OS-000090 and CNTR-OS-000630shared/references/disa-stig-ocp4-v2r3-xccdf-manual.xmlwith V2R6 reference XCCDFdisa-stig-rhcos4-v2r3-xccdf-manual.xmlsymlink — create V2R6 symlink pointing todisa-stig-ocp4-v2r6-xccdf-manual.xmlstig-v2r6.profile,stig-node-v2r6.profile) for ocp4 and rhcos4stig-v2r2,stig-node-v2r2,rhcos4/stig-v2r2)filter_rulesto V2R3, V2R6 platform, and RHCOS profiles to exclude kubevirt rules (added in V2R6, scanned by thestig-virtCEL profile in Map OCP Virtualization rules to STIG controls and add stig-virt CEL profile #15043)alert_receiver_configuredto CNTR-OS-000690 (statuspending→manual, per CMP-2437)routes_protected_by_tlsto CNTR-OS-000820 (statusmanual→partial— covers edge-terminated routes; passthrough TLS still needs app-level checks)Test plan
./build_product ocp4 --datastreamsucceeds./build_product rhcos4 --datastreamsucceeds🤖 Generated with Claude Code