Fixing OCP checks for rh-1.0 (#1259)

cfg/rh-1.0/controlplane.yaml

@@ -40,9 +40,9 @@ groups:
           #To view openshift apiserver log files
           oc adm node-logs --role=master --path=openshift-apiserver/
           #To verify kube apiserver audit config
-          oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig[]'
+          oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig[]?'
           #To verify openshift apiserver audit config
-          oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig[]'
+          oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig[]?'
         type: manual
         remediation: |
           No remediation required.
@@ -52,9 +52,9 @@ groups:
         text: "Ensure that the audit policy covers key security concerns (Manual)"
         audit: |
           #To verify openshift apiserver audit config
-          oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]'
+          oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]?'
           #To verify kube apiserver audit config
-          oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]'
+          oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]?'
         type: manual
         remediation: |
           In OpenShift 4.6 and higher, if appropriate for your needs,

cfg/rh-1.0/etcd.yaml

@@ -57,7 +57,7 @@ groups:
           # Returns 0 if found, 1 if not found
           for i in $(oc get pods -oname -n openshift-etcd)
           do
-            oc exec -n openshift-etcd -c etcd $i -- ps -o command= -C etcd | grep -- --auto-tls=true 2>&1>/dev/null ; echo exit_code=$?
+            oc exec -n openshift-etcd -c etcd $i -- ps -o command= -C etcd | grep -- --auto-tls=true 2>/dev/null ; echo exit_code=$?
           done 2>/dev/null
         use_multiple_values: true
         tests:
@@ -118,7 +118,7 @@ groups:
           # Returns 0 if found, 1 if not found
           for i in $(oc get pods -oname -n openshift-etcd)
           do
-            oc exec -n openshift-etcd -c etcd $i -- ps -o command= -C etcd | grep -- --peer-auto-tls=true 2>&1>/dev/null ; echo exit_code=$?
+            oc exec -n openshift-etcd -c etcd $i -- ps -o command= -C etcd | grep -- --peer-auto-tls=true 2>/dev/null ; echo exit_code=$?
           done 2>/dev/null
         use_multiple_values: true
         tests:

cfg/rh-1.0/master.yaml

@@ -129,7 +129,7 @@ groups:
         scored: false
 
       - id: 1.1.8
-        text: "Ensure that the etcd pod specification file ownership is set to root:root (Automated)"
+        text: "Ensure that the etcd pod specification file ownership is set to root:root (Manual)"
         audit: |
           for i in $( oc get pods -n openshift-etcd -l app=etcd -o name | grep etcd )
           do
@@ -141,7 +141,7 @@ groups:
             - flag: "root:root"
         remediation: |
           No remediation required; file permissions are managed by the operator.
-        scored: true
+        scored: false
 
       - id: 1.1.9
         text: "Ensure that the Container Network Interface file permissions are set to 644 or more restrictive (Manual)"
@@ -316,7 +316,7 @@ groups:
         scored: false
 
       - id: 1.1.19
-        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Automated)"
+        text: "Ensure that the Kubernetes PKI directory and file ownership is set to root:root (Manual)"
         audit: |
           # Should return root:root for all files and directories
           for i in $(oc -n openshift-kube-apiserver get pod -l app=openshift-kube-apiserver -o jsonpath='{.items[*].metadata.name}')
@@ -334,7 +334,7 @@ groups:
             - flag: "root:root"
         remediation: |
           No remediation required; file permissions are managed by the operator.
-        scored: true
+        scored: false
 
       - id: 1.1.20
         text: "Ensure that the OpenShift PKI certificate file permissions are set to 644 or more restrictive (Manual)"
@@ -381,9 +381,9 @@ groups:
         text: "Ensure that anonymous requests are authorized (Manual)"
         audit: |
           # To verify that userGroups include system:unauthenticated
-          oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]'
+          oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]?'
           # To verify that userGroups include system:unauthenticated
-          oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[].userGroups'
+          oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.auditConfig.policyConfiguration.rules[]?.userGroups'
           # To verify RBAC is enabled
           oc get clusterrolebinding
           oc get clusterrole

cfg/rh-1.0/node.yaml

@@ -199,7 +199,7 @@ groups:
         scored: true
 
       - id: 4.2.2
-        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Automated)"
+        text: "Ensure that the --authorization-mode argument is not set to AlwaysAllow (Manual)"
         type: manual
         # Takes a lot of time for connection to fail and
         audit: |
@@ -215,7 +215,7 @@ groups:
             - flag: "Connection timed out"
         remediation: |
           None required. Unauthenticated/Unauthorized users have no access to OpenShift nodes.
-        scored: true
+        scored: false
 
       - id: 4.2.3
         text: "Ensure that the --client-ca-file argument is set as appropriate (Automated)"
@@ -346,7 +346,7 @@ groups:
         scored: false
 
       - id: 4.2.9
-        text: "Ensure that the kubeAPIQPS [--event-qps] argument is set to 0 or a level which ensures appropriate event capture (Automated)"
+        text: "Ensure that the kubeAPIQPS [--event-qps] argument is set to 0 or a level which ensures appropriate event capture (Manual)"
         audit: |
           for node in $(oc get nodes -o jsonpath='{.items[*].metadata.name}');
           do
@@ -359,7 +359,7 @@ groups:
           Follow the documentation to edit kubelet parameters
           https://docs.openshift.com/container-platform/4.5/scalability_and_performance/recommended-host-practices.html#create-a-kubeletconfig-crd-to-edit-kubelet-parameters
           KubeAPIQPS: <QPS>
-        scored: true
+        scored: false
 
       - id: 4.2.10
         text: "Ensure that the --tls-cert-file and --tls-private-key-file arguments are set as appropriate (Automated)"