[WIP] OSDOCS#3995: ROSA - port 'Security' content from OCP #62384

tmalove · 2023-07-13T18:27:40Z

This PR is to port the "Security and compliance" OCP content to ROSA. Reference that section only for comments, reviews, etc.
OSDOCS-3995

Version(s):

Link to docs preview (local build): https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/index.html (Updated 3/5)

QE review:

QE has approved this change.

ocpdocs-previewbot · 2023-07-19T18:30:10Z

🤖 Fri Feb 09 18:30:23 - Prow CI generated the docs preview: https://62384--ocpdocs-pr.netlify.app

tmalove · 2023-08-01T15:19:48Z

@jaybeeunix @xueli181114 See this spreadsheet of errors I get from testing CLI commands in the security section. This list is still WIP. Thx.
https://docs.google.com/document/d/1EE4o5iF9bXMZS20DeeuJkd-UakZnKssVXcjsaFrPvx4/edit#heading=h.g1x54zpbotj

xiaojiey · 2023-08-10T06:59:41Z

@xingxingxia @geliu2016 @sunilcio @wangke19 Could you please help to review for your components? thanks.
I will check for Compliance Operator, File Integrity Operator and Security Profiles Operator.

xingxingxia · 2023-08-10T07:28:51Z

_topic_maps/_topic_map_rosa.yml

+  - Name: Authenticating the cert-manager Operator for Red Hat OpenShift with GCP Workload Identity
+    File: cert-manager-authenticate-gcp
+  - Name: Authenticating the cert-manager Operator for Red Hat OpenShift on AWS
+    File: cert-manager-authentication-non-sts
+  - Name: Authenticating the cert-manager Operator for Red Hat OpenShift on GCP
+    File: cert-manager-authenticate-non-sts-gcp


It is ROSA document for ROSA cluster, then GCP documents cert-manager-authenticate-gcp and cert-manager-authenticate-non-sts-gcp are not applicable, need be removed.
cert-manager-operator-issuer-acme has GCP ambient credential section, that is also not applicable for ROSA cluster.

wangke19 · 2023-08-10T07:36:05Z

Apiserver topics look good to me. But I checked the link https://file.rdu.redhat.com/tlove/sd-port-security-tlove/upgrading/rosa-upgrading-cluster-prepare.html, we still has this upgrade path, I think that's a problem.

Preparing to upgrade ROSA to 4.9

xiaojiey · 2023-08-10T08:14:38Z

For Compliance Operator, generally it is good. There are minor issues need to be updated:

For important notice in https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/compliance_operator/compliance-operator-supported-profiles.html, better to remove unreleated platforms:
Current: "The Compliance Operator might report incorrect results on managed platforms, such as OpenShift Dedicated, Red Hat OpenShift Service on AWS, and Azure Red Hat OpenShift. For more information, see the Red Hat Knowledgebase Solution #6983418."
Better to be: "The Compliance Operator might report incorrect results on Red Hat OpenShift Service on AWS. For more information, see the Red Hat Knowledgebase Solution #6983418."
For important notice in https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/compliance_operator/compliance-operator-installation.html,
Current: "The Compliance Operator might report incorrect results on managed platforms, such as OpenShift Dedicated, Red Hat OpenShift Service on AWS, and Microsoft Azure Red Hat OpenShift. For more information, see the Red Hat Knowledgebase Solution #6983418."
Better to be: "The Compliance Operator might report incorrect results on Red Hat OpenShift Service on AWS. For more information, see the Red Hat Knowledgebase Solution #6983418."

BhargaviGudi · 2023-08-29T08:37:04Z

For file-integrity-operator, generally it is good. There are minor changes need to be updated:

$ oc get fileintegritynodestatuses -n openshift-file-integrity
NAME                                                              NODE                                         STATUS
worker-fileintegrity-ip-10-0-145-177.us-east-2.compute.internal   ip-10-0-145-177.us-east-2.compute.internal   Succeeded
worker-fileintegrity-ip-10-0-171-252.us-east-2.compute.internal   ip-10-0-171-252.us-east-2.compute.internal   Succeeded
worker-fileintegrity-ip-10-0-193-251.us-east-2.compute.internal   ip-10-0-193-251.us-east-2.compute.internal   Succeeded

Defining a custom File Integrity Operator configuration,https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/file_integrity_operator/file-integrity-operator-configuring.html#file-integrity-operator-defining-custom-config_file-integrity-operator , Step 7 need to update command to create fileintegrity.
Currently only fileintegrity config is given.
Add command: $ oc create -f master-fileintegrity.yaml -n openshift-file-integrity

xiaojiey · 2023-08-29T12:44:26Z

For Compliance Operator, below points are not applicable:

For important notice in https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/compliance_operator/compliance-operator-supported-profiles.html, better to remove unreleated platforms:
Current: "The Compliance Operator might report incorrect results on managed platforms, such as OpenShift Dedicated, Red Hat OpenShift Service on AWS, and Azure Red Hat OpenShift. For more information, see the Red Hat Knowledgebase Solution #6983418."
Better to be: "The Compliance Operator might report incorrect results on Red Hat OpenShift Service on AWS. For more information, see the Red Hat Knowledgebase Solution #6983418."
For important notice in https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/compliance_operator/compliance-operator-installation.html,
Current: "The Compliance Operator might report incorrect results on managed platforms, such as OpenShift Dedicated, Red Hat OpenShift Service on AWS, and Microsoft Azure Red Hat OpenShift. For more information, see the Red Hat Knowledgebase Solution #6983418."
Better to be: "The Compliance Operator might report incorrect results on Red Hat OpenShift Service on AWS. For more information, see the Red Hat Knowledgebase Solution #6983418."
For paragraph below, it is not applicable for ROSA as it is for hypershift hosted cluster only
https://file.rdu.redhat.com/tlove/sd-port-security-tlove/security/compliance_operator/compliance-operator-installation.html#installing-compliance-operator-hcp_compliance-operator-installation
For paragraph below, it is not applicable for ROSA as creating custom mcp will fail. https://docs.openshift.com/container-platform/4.13/security/compliance_operator/compliance-operator-remediation.html#compliance-operator-apply-remediation-for-customized-mcp
https://docs.openshift.com/container-platform/4.13/security/compliance_operator/compliance-operator-remediation.html#compliance-custom-node-pools_compliance-remediation

tmalove · 2023-08-29T21:10:08Z

Apiserver topics look good to me. But I checked the link file.rdu.redhat.com/tlove/sd-port-security-tlove/upgrading/rosa-upgrading-cluster-prepare.html, we still has this upgrade path, I think that's a problem.
Preparing to upgrade ROSA to 4.9 

@wangke19 When this was initially added, the admin acknowledgment was a new requirement. However, all major versions require this now. I will follow up with SRE to confirm. Thanks.

xiaojiey · 2023-08-30T13:17:05Z

Add one more important point for Compliance Operator:
The auto-remediation not works for ROSA(more accurately for all management platforms). Please add important notice in doc.
That means below sections not work for ROSA:
https://docs.openshift.com/container-platform/4.13/security/compliance_operator/compliance-operator-remediation.html#compliance-applying_compliance-remediation
https://docs.openshift.com/container-platform/4.13/security/compliance_operator/compliance-operator-remediation.html#compliance-manual_compliance-remediation
https://docs.openshift.com/container-platform/4.13/security/compliance_operator/compliance-operator-remediation.html#compliance-updating_compliance-remediation
https://docs.openshift.com/container-platform/4.13/security/compliance_operator/compliance-operator-remediation.html#compliance-unapplying_compliance-remediation

tmalove · 2023-08-30T14:41:58Z

@sheriff-rh @bergerhoffer @xenolinux adding you for your awareness.

tmalove · 2024-01-30T16:41:12Z

/test validate-asciidoc

tmalove · 2024-01-31T16:14:22Z

/test validate-asciidoc

tmalove · 2024-01-31T16:15:12Z

/retest

tmalove · 2024-02-01T14:41:45Z

/test validate-asciidoc

tmalove · 2024-02-05T18:22:55Z

/retest

tmalove · 2024-02-06T14:48:32Z

/retest

tmalove · 2024-02-06T15:00:52Z

/retest-required

aireilly · 2024-02-06T20:22:46Z

_topic_maps/_topic_map_rosa.yml

 - Name: Deployments
  Dir: deployments
  Distros: openshift-rosa
-  Topics:


Put back this line. removing it breaks the build

Whole stanza should look like:

Topics: - Name: Deployments Dir: deployments Distros: openshift-rosa Topics: - Name: Custom domains for applications File: osd-config-custom-domains-applications

openshift-ci · 2024-02-09T18:32:08Z

@tmalove: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

tmalove · 2024-02-12T22:31:41Z

@arendej @rhmdnd @BillDett the preview is updated with the removal of the 'Compliance Operator' and 'File Integrity Operator' sections FYI. Thanks!

codymant · 2024-02-28T18:33:50Z

@tmalove the netflix preview link doesn't seem to work any more. Is there another link somewhere? Eric Chapman and Austin Quam would like to review and share feedback if the review window is still open.

https://62384--ocpdocs-pr.netlify.app/openshift-rosa/latest/welcome/index.html

tmalove · 2024-03-05T17:16:48Z

@tmalove the netflix preview link doesn't seem to work any more. Is there another link somewhere? Eric Chapman and Austin Quam would like to review and share feedback if the review window is still open.

62384--ocpdocs-pr.netlify.app/openshift-rosa/latest/welcome/index.html

@codymant An updated preview is available, however VPN/network access is required. Let me know if Eric or Austin cannot access it.

tmalove · 2024-03-11T20:39:03Z

This PR is superseded by #72837. Refer to this PR for the Security porting project.

tmalove · 2024-04-09T17:38:32Z

@rhmdnd @BillDett @arendej @xingxingxia Use this latest PR for updates on the 'Security and compliance' porting.

tmalove · 2024-04-09T17:39:39Z

Refer to the latest PR to continue updates.

xingxingxia · 2024-04-10T03:29:27Z

@rhmdnd @BillDett @arendej @xingxingxia Use this latest #72837 for updates on the 'Security and compliance' porting.

@tmalove got it. For me, what I reviewed was for cert-manager as in my previous comment #62384 (comment) . In the new PR, seems cert-manager doc is totally removed. Anyway nvm, I'm transfering to @lunarwhite to continue review for cert-manager area in the new PR.

openshift-ci bot added the size/L Denotes a PR that changes 100-499 lines, ignoring generated files. label Jul 13, 2023

tmalove force-pushed the sd-port-security-tlove branch from 85e8fba to 11f19ae Compare July 19, 2023 18:20

tmalove force-pushed the sd-port-security-tlove branch from 11f19ae to 02911e0 Compare July 20, 2023 13:49

xingxingxia reviewed Aug 10, 2023

View reviewed changes

tmalove force-pushed the sd-port-security-tlove branch from 02911e0 to 2cdebf9 Compare August 22, 2023 16:11

openshift-merge-robot added needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. and removed needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. labels Aug 22, 2023

openshift-ci bot added size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Aug 23, 2023

tmalove force-pushed the sd-port-security-tlove branch from d07bf0b to aea07ed Compare August 24, 2023 15:11

openshift-ci bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Aug 24, 2023

tmalove force-pushed the sd-port-security-tlove branch 4 times, most recently from 507da05 to 61895ed Compare August 28, 2023 19:53

tmalove force-pushed the sd-port-security-tlove branch 3 times, most recently from 17b9bc2 to 551a033 Compare August 29, 2023 20:49

tmalove changed the title ~~OSDOCS#3995: ROSA - port security content from OCP~~ OSDOCS#3995: ROSA - port 'Security' content from OCP Aug 29, 2023

tmalove force-pushed the sd-port-security-tlove branch from 7a7c941 to d535ea0 Compare January 30, 2024 15:49

tmalove force-pushed the sd-port-security-tlove branch 2 times, most recently from 0feb202 to bf26e79 Compare February 5, 2024 14:33

tmalove force-pushed the sd-port-security-tlove branch from 97ded61 to f07c973 Compare February 6, 2024 14:25

tmalove force-pushed the sd-port-security-tlove branch from f07c973 to fdd4c69 Compare February 6, 2024 15:31

aireilly reviewed Feb 6, 2024

View reviewed changes

tmalove force-pushed the sd-port-security-tlove branch from a81d173 to 43efa43 Compare February 7, 2024 15:10

tmalove and others added 4 commits February 9, 2024 13:04

port security content from ocp

d56a92a

Add line in topic map

194689a

fix spacing issue

f8f8903

Comment out Compliance Operator and File Integrity Operator

b579c62

tmalove force-pushed the sd-port-security-tlove branch from 43efa43 to b579c62 Compare February 9, 2024 18:23

tmalove mentioned this pull request Mar 7, 2024

OCDOCS#3995: Port security and compliance content to the ROSA doc set #72837

Closed

1 task

tmalove closed this Apr 9, 2024

tmalove deleted the sd-port-security-tlove branch April 9, 2024 17:39

[WIP] OSDOCS#3995: ROSA - port 'Security' content from OCP #62384

[WIP] OSDOCS#3995: ROSA - port 'Security' content from OCP #62384

Uh oh!

Conversation

tmalove commented Jul 13, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ocpdocs-previewbot commented Jul 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tmalove commented Aug 1, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xiaojiey commented Aug 10, 2023

Uh oh!

xingxingxia Aug 10, 2023

Choose a reason for hiding this comment

Uh oh!

wangke19 commented Aug 10, 2023

Uh oh!

xiaojiey commented Aug 10, 2023

Uh oh!

BhargaviGudi commented Aug 29, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

xiaojiey commented Aug 29, 2023

Uh oh!

tmalove commented Aug 29, 2023

Uh oh!

xiaojiey commented Aug 30, 2023

Uh oh!

tmalove commented Aug 30, 2023

Uh oh!

tmalove commented Jan 30, 2024

Uh oh!

tmalove commented Jan 31, 2024

Uh oh!

tmalove commented Jan 31, 2024

Uh oh!

tmalove commented Feb 1, 2024

Uh oh!

tmalove commented Feb 5, 2024

Uh oh!

tmalove commented Feb 6, 2024

Uh oh!

tmalove commented Feb 6, 2024

Uh oh!

aireilly Feb 6, 2024

Choose a reason for hiding this comment

Uh oh!

aireilly Feb 6, 2024

Choose a reason for hiding this comment

Uh oh!

openshift-ci bot commented Feb 9, 2024

Uh oh!

tmalove commented Feb 12, 2024

Uh oh!

codymant commented Feb 28, 2024

Uh oh!

tmalove commented Mar 5, 2024

Uh oh!

tmalove commented Mar 11, 2024

Uh oh!

tmalove commented Apr 9, 2024

Uh oh!

tmalove commented Apr 9, 2024

Uh oh!

xingxingxia commented Apr 10, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

14 participants

tmalove commented Jul 13, 2023 •

edited

Loading

ocpdocs-previewbot commented Jul 19, 2023 •

edited

Loading

tmalove commented Aug 1, 2023 •

edited

Loading

BhargaviGudi commented Aug 29, 2023 •

edited

Loading