Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions cmd/manager/cel_scanner_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -228,7 +228,7 @@ var _ = Describe("getVariablesForProfile", func() {
It("returns empty when profile has no values", func() {
scheme := newTestScheme()
profile := &cmpv1alpha1.Profile{
ObjectMeta: metav1.ObjectMeta{Name: "no-vals", Namespace: "ns"},
ObjectMeta: metav1.ObjectMeta{Name: "no-vals", Namespace: "ns"},
ProfilePayload: cmpv1alpha1.ProfilePayload{},
}
client := fake.NewClientBuilder().WithScheme(scheme).
Expand Down Expand Up @@ -331,14 +331,14 @@ var _ = Describe("celRuleWrapper", func() {
},
}

w := celRuleWrapper{
scannerRule: rule,
payload: &rule.RulePayload,
}
w := celRuleWrapper{
scannerRule: rule,
payload: &rule.RulePayload,
}

Expect(w.scannerRule.Identifier()).To(Equal("my-rule"))
Expect(w.payload.Expression).To(Equal("pods.items.size() > 0"))
Expect(w.payload.FailureReason).To(Equal("no pods"))
Expect(w.scannerRule.Identifier()).To(Equal("my-rule"))
Expect(w.payload.Expression).To(Equal("pods.items.size() > 0"))
Expect(w.payload.FailureReason).To(Equal("no pods"))
})
})

Expand Down
18 changes: 9 additions & 9 deletions pkg/apis/compliance/v1alpha1/rule_scanner_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -12,16 +12,16 @@ var _ = Describe("RulePayload shared helpers", func() {

BeforeEach(func() {
payload = RulePayload{
ID: "test-rule-id",
Title: "Test Rule",
Description: "A test rule description",
Rationale: "Test rationale",
Warning: "Test warning",
Severity: "high",
ID: "test-rule-id",
Title: "Test Rule",
Description: "A test rule description",
Rationale: "Test rationale",
Warning: "Test warning",
Severity: "high",
Instructions: "Test instructions",
CheckType: CheckTypePlatform,
ScannerType: ScannerTypeCEL,
Expression: "pods.items.all(p, p.spec.securityContext != null)",
CheckType: CheckTypePlatform,
ScannerType: ScannerTypeCEL,
Expression: "pods.items.all(p, p.spec.securityContext != null)",
Inputs: []InputPayload{
{
Name: "pods",
Expand Down
1 change: 0 additions & 1 deletion pkg/apis/compliance/v1alpha1/rule_types.go
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@ const (
CheckTypeNone = ""
)


type RulePayload struct {
// The ID of the Rule
ID string `json:"id"`
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/compliancescan/aggregator.go
Original file line number Diff line number Diff line change
Expand Up @@ -76,8 +76,8 @@ func (r *ReconcileComplianceScan) newAggregatorPod(scanInstance *compv1alpha1.Co
},
Containers: []corev1.Container{
{
Name: "aggregator",
Image: utils.GetComponentImage(utils.OPERATOR),
Name: "aggregator",
Image: utils.GetComponentImage(utils.OPERATOR),
ImagePullPolicy: corev1.PullIfNotPresent,
Command: []string{
"compliance-operator", "aggregator",
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -879,4 +879,3 @@ fi`, runtimeDir, configPath, sshdBin, terminationLog)
})
})
})

16 changes: 8 additions & 8 deletions pkg/controller/compliancescan/scan.go
Original file line number Diff line number Diff line change
Expand Up @@ -257,10 +257,10 @@ func newScanPodForNode(scanInstance *compv1alpha1.ComplianceScan, node *corev1.N
VolumeMounts: getLogCollectorVolumeMounts(scanInstance),
},
{
Name: OpenSCAPScanContainerName,
Image: utils.GetComponentImage(utils.OPENSCAP),
Name: OpenSCAPScanContainerName,
Image: utils.GetComponentImage(utils.OPENSCAP),
ImagePullPolicy: corev1.PullIfNotPresent,
Command: []string{OpenScapScriptPath},
Command: []string{OpenScapScriptPath},
SecurityContext: &corev1.SecurityContext{
Privileged: &falseP,
AllowPrivilegeEscalation: &trueP,
Expand Down Expand Up @@ -359,8 +359,8 @@ func addScannerContainer(scanInstance *compv1alpha1.ComplianceScan, pod *corev1.
switch scanInstance.Spec.ScannerType {
case compv1alpha1.ScannerTypeCEL:
pod.Spec.Containers = append(pod.Spec.Containers, corev1.Container{
Name: CELScannerContainerName,
Image: utils.GetComponentImage(utils.OPERATOR),
Name: CELScannerContainerName,
Image: utils.GetComponentImage(utils.OPERATOR),
ImagePullPolicy: corev1.PullIfNotPresent,
Command: []string{
"compliance-operator", "cel-scanner",
Expand Down Expand Up @@ -409,10 +409,10 @@ func addScannerContainer(scanInstance *compv1alpha1.ComplianceScan, pod *corev1.
})
default:
pod.Spec.Containers = append(pod.Spec.Containers, corev1.Container{
Name: OpenSCAPScanContainerName,
Image: utils.GetComponentImage(utils.OPENSCAP),
Name: OpenSCAPScanContainerName,
Image: utils.GetComponentImage(utils.OPENSCAP),
ImagePullPolicy: corev1.PullIfNotPresent,
Command: []string{OpenScapScriptPath},
Command: []string{OpenScapScriptPath},
SecurityContext: &corev1.SecurityContext{
AllowPrivilegeEscalation: &falseP,
ReadOnlyRootFilesystem: &trueP,
Expand Down
4 changes: 2 additions & 2 deletions pkg/controller/compliancesuite/suitererunner_cron_compat.go
Original file line number Diff line number Diff line change
Expand Up @@ -140,8 +140,8 @@ func (r *ReconcileComplianceSuite) getRerunnerPodTemplate(
PriorityClassName: priorityClassName,
Containers: []corev1.Container{
{
Name: "rerunner",
Image: utils.GetComponentImage(utils.OPERATOR),
Name: "rerunner",
Image: utils.GetComponentImage(utils.OPERATOR),
ImagePullPolicy: corev1.PullIfNotPresent,
SecurityContext: &corev1.SecurityContext{
AllowPrivilegeEscalation: &falseP,
Expand Down
70 changes: 35 additions & 35 deletions pkg/controller/customrule/customrule_controller_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -37,13 +37,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
},
Spec: v1alpha1.CustomRuleSpec{
RulePayload: v1alpha1.RulePayload{
ID: "test-rule-1",
Title: "Test Rule",
Description: "A test rule for validation",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "pods.items.all(pod, pod.spec.containers.all(container, container.securityContext.runAsNonRoot == true))",
Inputs: []v1alpha1.InputPayload{
ID: "test-rule-1",
Title: "Test Rule",
Description: "A test rule for validation",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "pods.items.all(pod, pod.spec.containers.all(container, container.securityContext.runAsNonRoot == true))",
Inputs: []v1alpha1.InputPayload{
{
Name: "pods",
KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
Expand All @@ -70,13 +70,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
},
Spec: v1alpha1.CustomRuleSpec{
RulePayload: v1alpha1.RulePayload{
ID: "test-rule-2",
Title: "Invalid Rule",
Description: "A rule with invalid CEL syntax",
Severity: "high",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "this is not &&& valid CEL syntax", // Invalid CEL syntax
Inputs: []v1alpha1.InputPayload{
ID: "test-rule-2",
Title: "Invalid Rule",
Description: "A rule with invalid CEL syntax",
Severity: "high",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "this is not &&& valid CEL syntax", // Invalid CEL syntax
Inputs: []v1alpha1.InputPayload{
{
Name: "test",
KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
Expand All @@ -103,13 +103,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
},
Spec: v1alpha1.CustomRuleSpec{
RulePayload: v1alpha1.RulePayload{
ID: "test-rule-5",
Title: "Multi-input Rule",
Description: "A rule with multiple inputs",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "namespaces.items.all(ns, networkpolicies.items.exists(np, np.metadata.namespace == ns.metadata.name))",
Inputs: []v1alpha1.InputPayload{
ID: "test-rule-5",
Title: "Multi-input Rule",
Description: "A rule with multiple inputs",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "namespaces.items.all(ns, networkpolicies.items.exists(np, np.metadata.namespace == ns.metadata.name))",
Inputs: []v1alpha1.InputPayload{
{
Name: "namespaces",
KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
Expand Down Expand Up @@ -144,13 +144,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
},
Spec: v1alpha1.CustomRuleSpec{
RulePayload: v1alpha1.RulePayload{
ID: "test-rule-5",
Title: "Multi-input Rule",
Description: "A rule with multiple inputs",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "namespaces.items.all(ns, networkpolicies-non-existent.items.exists(np, np.metadata.namespace == ns.metadata.name))",
Inputs: []v1alpha1.InputPayload{
ID: "test-rule-5",
Title: "Multi-input Rule",
Description: "A rule with multiple inputs",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "namespaces.items.all(ns, networkpolicies-non-existent.items.exists(np, np.metadata.namespace == ns.metadata.name))",
Inputs: []v1alpha1.InputPayload{
{
Name: "namespaces",
KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
Expand Down Expand Up @@ -185,13 +185,13 @@ func TestCustomRuleReconciler_Reconcile(t *testing.T) {
},
Spec: v1alpha1.CustomRuleSpec{
RulePayload: v1alpha1.RulePayload{
ID: "test-rule-6",
Title: "Undefined Reference Rule",
Description: "A rule referencing undefined inputs",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "undefinedInput.items.size() > 0", // References 'undefinedInput' not in inputs
Inputs: []v1alpha1.InputPayload{
ID: "test-rule-6",
Title: "Undefined Reference Rule",
Description: "A rule referencing undefined inputs",
Severity: "medium",
ScannerType: v1alpha1.ScannerTypeCEL,
Expression: "undefinedInput.items.size() > 0", // References 'undefinedInput' not in inputs
Inputs: []v1alpha1.InputPayload{
{
Name: "test",
KubernetesInputSpec: v1alpha1.KubernetesInputSpec{
Expand Down
8 changes: 4 additions & 4 deletions pkg/controller/profilebundle/profilebundle_controller.go
Original file line number Diff line number Diff line change
Expand Up @@ -533,8 +533,8 @@ func (r *ReconcileProfileBundle) newWorkloadForBundle(pb *compliancev1alpha1.Pro
},
},
{
Name: "profileparser",
Image: utils.GetComponentImage(utils.OPERATOR),
Name: "profileparser",
Image: utils.GetComponentImage(utils.OPERATOR),
ImagePullPolicy: corev1.PullIfNotPresent,
SecurityContext: &corev1.SecurityContext{
AllowPrivilegeEscalation: &falseP,
Expand Down Expand Up @@ -570,8 +570,8 @@ func (r *ReconcileProfileBundle) newWorkloadForBundle(pb *compliancev1alpha1.Pro
},
Containers: []corev1.Container{
{
Name: "pauser",
Image: utils.GetComponentImage(utils.OPERATOR),
Name: "pauser",
Image: utils.GetComponentImage(utils.OPERATOR),
ImagePullPolicy: corev1.PullIfNotPresent,
SecurityContext: &corev1.SecurityContext{
AllowPrivilegeEscalation: &falseP,
Expand Down
36 changes: 18 additions & 18 deletions pkg/controller/tailoredprofile/tailoredprofile_controller_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -1355,12 +1355,12 @@ var _ = Describe("TailoredprofileController", func() {
},
Spec: compv1alpha1.CustomRuleSpec{
RulePayload: compv1alpha1.RulePayload{
ID: "custom_rule_1",
Title: "Test Custom Rule",
Description: "A test custom rule",
Severity: "medium",
ScannerType: compv1alpha1.ScannerTypeCEL,
Expression: "true",
ID: "custom_rule_1",
Title: "Test Custom Rule",
Description: "A test custom rule",
Severity: "medium",
ScannerType: compv1alpha1.ScannerTypeCEL,
Expression: "true",
Inputs: []compv1alpha1.InputPayload{
{
Name: "pods",
Expand Down Expand Up @@ -1446,12 +1446,12 @@ var _ = Describe("TailoredprofileController", func() {
},
Spec: compv1alpha1.CustomRuleSpec{
RulePayload: compv1alpha1.RulePayload{
ID: "custom_rule_2",
Title: "Test Custom Rule with Error",
Description: "A test custom rule with validation error",
Severity: "high",
ScannerType: compv1alpha1.ScannerTypeCEL,
Expression: "invalid expression",
ID: "custom_rule_2",
Title: "Test Custom Rule with Error",
Description: "A test custom rule with validation error",
Severity: "high",
ScannerType: compv1alpha1.ScannerTypeCEL,
Expression: "invalid expression",
Inputs: []compv1alpha1.InputPayload{
{
Name: "pods",
Expand Down Expand Up @@ -1535,12 +1535,12 @@ var _ = Describe("TailoredprofileController", func() {
},
Spec: compv1alpha1.CustomRuleSpec{
RulePayload: compv1alpha1.RulePayload{
ID: "custom_rule_3",
Title: "Test Custom Rule Pending",
Description: "A test custom rule pending validation",
Severity: "low",
ScannerType: compv1alpha1.ScannerTypeCEL,
Expression: "true",
ID: "custom_rule_3",
Title: "Test Custom Rule Pending",
Description: "A test custom rule pending validation",
Severity: "low",
ScannerType: compv1alpha1.ScannerTypeCEL,
Expression: "true",
Inputs: []compv1alpha1.InputPayload{
{
Name: "pods",
Expand Down
30 changes: 15 additions & 15 deletions pkg/profileparser/cel_content.go
Original file line number Diff line number Diff line change
Expand Up @@ -27,26 +27,26 @@ type CELBundleContent struct {

// CELRuleContent represents a single CEL rule definition in the content file.
type CELRuleContent struct {
Name string `json:"name"`
ID string `json:"id"`
Title string `json:"title"`
Description string `json:"description,omitempty"`
Rationale string `json:"rationale,omitempty"`
Severity string `json:"severity"`
CheckType string `json:"checkType"`
Expression string `json:"expression"`
Inputs []cmpv1alpha1.InputPayload `json:"inputs"`
FailureReason string `json:"failureReason,omitempty"`
Instructions string `json:"instructions,omitempty"`
Name string `json:"name"`
ID string `json:"id"`
Title string `json:"title"`
Description string `json:"description,omitempty"`
Rationale string `json:"rationale,omitempty"`
Severity string `json:"severity"`
CheckType string `json:"checkType"`
Expression string `json:"expression"`
Inputs []cmpv1alpha1.InputPayload `json:"inputs"`
FailureReason string `json:"failureReason,omitempty"`
Instructions string `json:"instructions,omitempty"`
// Variables lists the Variable CR names that this rule depends on.
// Sets the compliance.openshift.io/rule-variable annotation.
// +optional
Variables []string `json:"variables,omitempty"`
Variables []string `json:"variables,omitempty"`
// Controls maps compliance standard names to their control IDs.
// Sets control.compliance.openshift.io/<standard> and RHACM annotations.
// Example: {"NIST-800-53": ["IA-5(f)", "CM-6(a)"], "CIS-OCP": ["1.2.3"]}
// +optional
Controls map[string][]string `json:"controls,omitempty"`
Controls map[string][]string `json:"controls,omitempty"`
}

// CELProfileContent represents a single CEL profile definition in the content file.
Expand All @@ -61,9 +61,9 @@ type CELProfileContent struct {
// Values lists the Variable CR names this profile references.
// Stored in Profile.Values so the CEL scanner can load them.
// +optional
Values []string `json:"values,omitempty"`
Values []string `json:"values,omitempty"`
// +optional
Version string `json:"version,omitempty"`
Version string `json:"version,omitempty"`
}

// ParseCELBundle reads a CEL content YAML file and creates Rule and Profile CRs.
Expand Down
6 changes: 3 additions & 3 deletions tests/e2e/cel_tests/main_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -609,7 +609,7 @@ func TestCustomRuleCheckTypeAndScannerTypeValidation(t *testing.T) {
Title: "Invalid ScannerType Rule",
Description: "This rule has invalid scannerType",
Severity: "low",
CheckType: "Platform", // Valid checkType
CheckType: "Platform", // Valid checkType
ScannerType: compv1alpha1.ScannerTypeOpenSCAP, // This should be rejected
Expression: `pods.items.size() >= 0`,
Inputs: []compv1alpha1.InputPayload{
Expand Down Expand Up @@ -650,7 +650,7 @@ func TestCustomRuleCheckTypeAndScannerTypeValidation(t *testing.T) {
Title: "Valid Rule",
Description: "This rule has valid checkType and scannerType",
Severity: "low",
CheckType: "Platform", // Valid checkType
CheckType: "Platform", // Valid checkType
ScannerType: compv1alpha1.ScannerTypeCEL, // Valid scannerType
Expression: `pods.items.size() >= 0`,
Inputs: []compv1alpha1.InputPayload{
Expand Down Expand Up @@ -1185,4 +1185,4 @@ func TestCustomRuleCascadingStatusUpdate(t *testing.T) {
t.Logf("ScanSettingBinding %s recovered to Ready state", ssbName)

t.Log("CustomRule cascading status update test completed successfully")
}
}
Loading
Loading