CMP-4654: Update CIS Red Hat OpenShift Container Platform 4 Benchmark to v2.0.0 - #15093
Merged
Merged
Conversation
Add CIS Red Hat OpenShift Container Platform 4 Benchmark v2.0.0 content and profiles (cis-2-0 / cis-node-2-0, control cis_ocp_200), and deprecate v1.9.0. - Deprecate cis-1-9 / cis-node-1-9 (status: deprecated); move the 'cis' reference_type from cis_ocp_190 to cis_ocp_200 so only the current control owns it (two active controls sharing a reference_type double-list every rec). - Repoint the unversioned cis / cis-node profiles to extend v2.0.0. - Remove the previously-deprecated v1.7.0 profiles (cis-1-7 / cis-node-1-7); the cis_ocp control file is retained (PCI-DSS 4.0 depends on it). - Update the konflux Containerfile downstream list: add the v2.0.0 pair, remove the v1.7.0 pair. The benchmark delta is structural: all changed recommendations are no-op for our content, so no rule content changed. One control-node title synced (1.1.10).
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
List abushkin-redhat under maintainers in the v2.0.0 platform/node profiles and the unversioned cis / cis-node profiles that extend them.
abushkin-redhat
marked this pull request as ready for review
September 4, 2026 11:36
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
and deprecate v1.9.0.
Structural changes
controls/cis_ocp_200.yml+controls/cis_ocp_200/section-*.yml.products/ocp4/profiles/cis-2-0.profile(platform) andcis-node-2-0.profile(node), selectingcis_ocp_200:all.cis-1-9/cis-node-1-9) viastatus: deprecated— still shipped for users pinned to that version.cisreference ownership to the current version: droppedreference_type: cisfromcontrols/cis_ocp_190.yml(now deprecated) so onlycontrols/cis_ocp_200.ymlcarries it. Two active control files sharing a reference type would double-list every rule's control reference; this matches the existing precedent where the supersededcis_ocp(1.7.0) control carries noreference_type.cis-1-7/cis-node-1-7) per the ticket's acceptance criteria (older deprecated profiles are dropped when a new version lands). Nothing referenced these profiles (no tests, no data). Note: thecontrols/cis_ocp(1.7.0) control file is intentionally retained — it is not orphaned; the PCI-DSS 4.0 profile depends on it viacis_ocp:all:level_2incontrols/pcidss_4_ocp4.yml. Only the profiles are removed.cis/cis-node) to extend the new v2.0.0 profiles.Dockerfiles/compliance-operator-content-konflux.Containerfile: added the new v2.0.0 pair (cis-2-0/cis-node-2-0) to the shippeddocumentation_completelist and removed the v1.7.0 pair (the deprecated v1.9.0 pair stays, as it did while it was current).Rule-level changes (0)
Control-file title updates (1)
1.1.10(controls/cis_ocp_200/section-1.yml): "Ensure that the Container Network Interface file ownership is set to root:root" → "Ensure that the Container Network Interface file ownership is set to openvswitch:openvswitch"Recommendation scope
Rationale: