Skip to content

CMP-4119: Use OCP4 CIS control based referencing#14548

Open
yuumasato wants to merge 3 commits intoComplianceAsCode:masterfrom
yuumasato:use_ocp4_cis_control_references
Open

CMP-4119: Use OCP4 CIS control based referencing#14548
yuumasato wants to merge 3 commits intoComplianceAsCode:masterfrom
yuumasato:use_ocp4_cis_control_references

Conversation

@yuumasato
Copy link
Member

@yuumasato yuumasato commented Mar 11, 2026

Description:

  • Enable control based references for OCP CIS v1.9.0.
  • Removes OCP4 CIS from the rules.

Rationale:

  • By using the control based referencing we don't need to maintain them in the rules anymore.
    They are automatically injected into the rule during build time.

Review Hints:

<xccdf-1.2:Rule selected="false" id="xccdf_org.ssgproject.content_rule_api_server_https_for_kubelet_conn" severity="medium">
  <xccdf-1.2:title>Ensure that the --kubelet-https argument is set to true</xccdf-1.2:title>
  <xccdf-1.2:description>The kube-apiserver ensures https to the kubelet by default. The apiserver
....
  <xccdf-1.2:reference href="https://www.cisecurity.org/benchmark/kubernetes/">1.2.2</xccdf-1.2:reference>
  <xccdf-1.2:reference href="https://www.cisecurity.org/benchmark/kubernetes/">1.2</xccdf-1.2:reference>
  <xccdf-1.2:reference href="https://www.cisecurity.org/benchmark/kubernetes/">1</xccdf-1.2:reference>

Note

After feedback that older versions of CIS profiles are not that useful, I have changed this to add references based only on the latest version.

This enables control based referencing, making it easier to maintain the
OCP CIS references.
The references in the rules will track the latest version.
They are not used, and need to be removed so that the build system can
add references from the CIS control file.
Since we are switching to use control based referencing we need to
remove any cis reference in the file.
@yuumasato yuumasato force-pushed the use_ocp4_cis_control_references branch from 1d613a7 to b7c0f6b Compare March 20, 2026 10:01
@yuumasato
Copy link
Member Author

I have dropped support for multiple CIS reference versions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

CIS CIS Benchmark related. OpenShift OpenShift product related.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant