Merge pull request #11241 from rhmdnd/ocp-profile-version-aliases

Add profile aliases for OpenShift versioned profiles

products/ocp4/profiles/cis-1-4.profile

@@ -0,0 +1,38 @@
+documentation_complete: true
+
+title: 'CIS Red Hat OpenShift Container Platform 4 Benchmark'
+
+platform: ocp4
+
+metadata:
+    SMEs:
+        - JAORMX
+        - mrogers950
+        - jhrozek
+        - rhmdnd
+        - Vincent056
+    version: 1.4.0
+
+description: |-
+    This profile defines a baseline that aligns to the Center for Internet Security®
+    Red Hat OpenShift Container Platform 4 Benchmark™, V1.4.
+
+    This profile includes Center for Internet Security®
+    Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
+
+    Note that this part of the profile is meant to run on the Platform that
+    Red Hat OpenShift Container Platform 4 runs on top of.
+
+    This profile is applicable to OpenShift versions 4.10 and greater.
+
+filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'
+
+selections:
+    - cis_ocp_1_4_0:all
+    ### Variables
+    - var_openshift_audit_profile=WriteRequestBodies
+    - var_event_record_qps=50
+    ### Helper Rules
+    ### This is a helper rule to fetch the required api resource for detecting OCP version
+    - version_detect_in_ocp
+    - version_detect_in_hypershift

products/ocp4/profiles/cis-node-1-4.profile

@@ -0,0 +1,31 @@
+documentation_complete: true
+
+title: 'CIS Red Hat OpenShift Container Platform 4 Benchmark'
+
+platform: ocp4-node
+
+metadata:
+    SMEs:
+        - JAORMX
+        - mrogers950
+        - jhrozek
+        - rhmdnd
+        - Vincent056
+    version: 1.4.0
+
+description: |-
+    This profile defines a baseline that aligns to the Center for Internet Security®
+    Red Hat OpenShift Container Platform 4 Benchmark™, V1.4.
+
+    This profile includes Center for Internet Security®
+    Red Hat OpenShift Container Platform 4 CIS Benchmarks™ content.
+
+    Note that this part of the profile is meant to run on the Operating System that
+    Red Hat OpenShift Container Platform 4 runs on top of.
+
+    This profile is applicable to OpenShift versions 4.10 and greater.
+
+filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms'
+
+selections:
+    - cis_ocp_1_4_0:all

products/ocp4/profiles/cis-node.profile

@@ -25,7 +25,4 @@ description: |-
 
     This profile is applicable to OpenShift versions 4.10 and greater.
 
-filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms'
-
-selections:
-    - cis_ocp_1_4_0:all
+extends: cis-node-1-4

products/ocp4/profiles/cis.profile

@@ -25,14 +25,4 @@ description: |-
 
     This profile is applicable to OpenShift versions 4.10 and greater.
 
-filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'
-
-selections:
-    - cis_ocp_1_4_0:all
-    ### Variables
-    - var_openshift_audit_profile=WriteRequestBodies
-    - var_event_record_qps=50
-    ### Helper Rules
-    ### This is a helper rule to fetch the required api resource for detecting OCP version
-    - version_detect_in_ocp
-    - version_detect_in_hypershift
+extends: cis-1-4

products/ocp4/profiles/high-node-rev-4.profile

@@ -0,0 +1,48 @@
+documentation_complete: true
+
+reference: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/controls?version=5.1&security_baseline=High
+
+title: 'NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Node level'
+
+platform: ocp4-node
+
+metadata:
+    version: Revision 4
+    SMEs:
+        - JAORMX
+        - mrogers950
+        - jhrozek
+
+description: |-
+    This compliance profile reflects the core set of High-Impact Baseline
+    configuration settings for deployment of Red Hat OpenShift Container
+    Platform into U.S. Defense, Intelligence, and Civilian agencies.
+    Development partners and sponsors include the U.S. National Institute
+    of Standards and Technology (NIST), U.S. Department of Defense,
+    the National Security Agency, and Red Hat.
+
+    This baseline implements configuration requirements from the following
+    sources:
+
+    - NIST 800-53 control selections for High-Impact systems (NIST 800-53)
+
+    For any differing configuration requirements, e.g. password lengths, the stricter
+    security setting was chosen. Security Requirement Traceability Guides (RTMs) and
+    sample System Security Configuration Guides are provided via the
+    scap-security-guide-docs package.
+
+    This profile reflects U.S. Government consensus content and is developed through
+    the ComplianceAsCode initiative, championed by the National
+    Security Agency. Except for differences in formatting to accommodate
+    publishing processes, this profile mirrors ComplianceAsCode
+    content as minor divergences, such as bugfixes, work through the
+    consensus and release processes.
+
+# CM-6 CONFIGURATION SETTINGS
+# CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
+extends: cis-node
+
+filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms'
+
+selections:
+    - nist_ocp4:all:high

products/ocp4/profiles/high-node.profile

@@ -40,9 +40,4 @@ description: |-
 
 # CM-6 CONFIGURATION SETTINGS
 # CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
-extends: cis-node
-
-filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms'
-
-selections:
-    - nist_ocp4:all:high
+extends: high-node-rev-4

products/ocp4/profiles/high-rev-4.profile

@@ -0,0 +1,52 @@
+documentation_complete: true
+
+metadata:
+    version: Revision 4
+    SMEs:
+        - JAORMX
+        - mrogers950
+        - jhrozek
+
+reference: https://csrc.nist.gov/Projects/risk-management/sp800-53-controls/release-search#!/controls?version=5.1&security_baseline=High
+
+title: 'NIST 800-53 High-Impact Baseline for Red Hat OpenShift - Platform level'
+
+platform: ocp4
+
+description: |-
+    This compliance profile reflects the core set of High-Impact Baseline
+    configuration settings for deployment of Red Hat OpenShift Container
+    Platform into U.S. Defense, Intelligence, and Civilian agencies.
+    Development partners and sponsors include the U.S. National Institute
+    of Standards and Technology (NIST), U.S. Department of Defense,
+    the National Security Agency, and Red Hat.
+
+    This baseline implements configuration requirements from the following
+    sources:
+
+    - NIST 800-53 control selections for High-Impact systems (NIST 800-53)
+
+    For any differing configuration requirements, e.g. password lengths, the stricter
+    security setting was chosen. Security Requirement Traceability Guides (RTMs) and
+    sample System Security Configuration Guides are provided via the
+    scap-security-guide-docs package.
+
+    This profile reflects U.S. Government consensus content and is developed through
+    the ComplianceAsCode initiative, championed by the National
+    Security Agency. Except for differences in formatting to accommodate
+    publishing processes, this profile mirrors ComplianceAsCode
+    content as minor divergences, such as bugfixes, work through the
+    consensus and release processes.
+
+filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'
+
+# CM-6 CONFIGURATION SETTINGS
+# CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
+extends: cis
+
+selections:
+    - nist_ocp4:all:high
+  ### Helper Rules
+  ### This is a helper rule to fetch the required api resource for detecting OCP version
+    - version_detect_in_ocp
+    - version_detect_in_hypershift

products/ocp4/profiles/high.profile

@@ -38,15 +38,6 @@ description: |-
     content as minor divergences, such as bugfixes, work through the
     consensus and release processes.
 
-filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'
-
 # CM-6 CONFIGURATION SETTINGS
 # CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
-extends: cis
-
-selections:
-    - nist_ocp4:all:high
-  ### Helper Rules
-  ### This is a helper rule to fetch the required api resource for detecting OCP version
-    - version_detect_in_ocp
-    - version_detect_in_hypershift
+extends: high-rev-4

products/ocp4/profiles/moderate-node-rev-4.profile

@@ -0,0 +1,46 @@
+documentation_complete: true
+
+title: 'NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level'
+
+platform: ocp4-node
+
+metadata:
+    version: Revision 4
+    SMEs:
+        - JAORMX
+        - mrogers950
+        - jhrozek
+
+description: |-
+    This compliance profile reflects the core set of Moderate-Impact Baseline
+    configuration settings for deployment of Red Hat OpenShift Container
+    Platform into U.S. Defense, Intelligence, and Civilian agencies.
+    Development partners and sponsors include the U.S. National Institute
+    of Standards and Technology (NIST), U.S. Department of Defense,
+    the National Security Agency, and Red Hat.
+
+    This baseline implements configuration requirements from the following
+    sources:
+
+    - NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
+
+    For any differing configuration requirements, e.g. password lengths, the stricter
+    security setting was chosen. Security Requirement Traceability Guides (RTMs) and
+    sample System Security Configuration Guides are provided via the
+    scap-security-guide-docs package.
+
+    This profile reflects U.S. Government consensus content and is developed through
+    the ComplianceAsCode initiative, championed by the National
+    Security Agency. Except for differences in formatting to accommodate
+    publishing processes, this profile mirrors ComplianceAsCode
+    content as minor divergences, such as bugfixes, work through the
+    consensus and release processes.
+
+# CM-6 CONFIGURATION SETTINGS
+# CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
+extends: cis-node
+
+filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms'
+
+selections:
+    - nist_ocp4:all:moderate

products/ocp4/profiles/moderate-node.profile

@@ -38,9 +38,4 @@ description: |-
 
 # CM-6 CONFIGURATION SETTINGS
 # CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
-extends: cis-node
-
-filter_rules: '"ocp4-node" in platforms or "ocp4-master-node" in platforms or "ocp4-node-on-sdn" in platforms or "ocp4-node-on-ovn" in platforms'
-
-selections:
-    - nist_ocp4:all:moderate
+extends: moderate-node-rev-4

products/ocp4/profiles/moderate-rev-4.profile

@@ -0,0 +1,51 @@
+documentation_complete: true
+
+metadata:
+    version: Revision 4
+    SMEs:
+        - JAORMX
+        - mrogers950
+
+reference: https://nvd.nist.gov/800-53/Rev4/impact/moderate
+
+title: 'NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level'
+
+platform: ocp4
+
+description: |-
+    This compliance profile reflects the core set of Moderate-Impact Baseline
+    configuration settings for deployment of Red Hat OpenShift Container
+    Platform into U.S. Defense, Intelligence, and Civilian agencies.
+    Development partners and sponsors include the U.S. National Institute
+    of Standards and Technology (NIST), U.S. Department of Defense,
+    the National Security Agency, and Red Hat.
+
+    This baseline implements configuration requirements from the following
+    sources:
+
+    - NIST 800-53 control selections for Moderate-Impact systems (NIST 800-53)
+
+    For any differing configuration requirements, e.g. password lengths, the stricter
+    security setting was chosen. Security Requirement Traceability Guides (RTMs) and
+    sample System Security Configuration Guides are provided via the
+    scap-security-guide-docs package.
+
+    This profile reflects U.S. Government consensus content and is developed through
+    the ComplianceAsCode initiative, championed by the National
+    Security Agency. Except for differences in formatting to accommodate
+    publishing processes, this profile mirrors ComplianceAsCode
+    content as minor divergences, such as bugfixes, work through the
+    consensus and release processes.
+
+filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'
+
+# CM-6 CONFIGURATION SETTINGS
+# CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
+extends: cis
+
+selections:
+    - nist_ocp4:all:moderate
+  ### Helper Rules
+  ### This is a helper rule to fetch the required api resource for detecting OCP version
+    - version_detect_in_ocp
+    - version_detect_in_hypershift

products/ocp4/profiles/moderate.profile

@@ -37,15 +37,6 @@ description: |-
     content as minor divergences, such as bugfixes, work through the
     consensus and release processes.
 
-filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms and "ocp4-node-on-sdn" not in platforms and "ocp4-node-on-ovn" not in platforms'
-
 # CM-6 CONFIGURATION SETTINGS
 # CM-6(1) CONFIGURATION SETTINGS | AUTOMATED CENTRAL MANAGEMENT / APPLICATION / VERIFICATION
-extends: cis
-
-selections:
-    - nist_ocp4:all:moderate
-  ### Helper Rules
-  ### This is a helper rule to fetch the required api resource for detecting OCP version
-    - version_detect_in_ocp
-    - version_detect_in_hypershift
+extends: moderate-rev-4

products/ocp4/profiles/pci-dss-3-2.profile

@@ -0,0 +1,29 @@
+documentation_complete: true
+
+platform: ocp4
+
+metadata:
+    version: 3.2.1
+    SMEs:
+        - JAORMX
+        - jhrozek
+        - mrogers950
+
+reference: https://www.pcisecuritystandards.org/documents/PCI_DSS_v3-2-1.pdf
+
+title: 'PCI-DSS v3.2.1 Control Baseline for Red Hat OpenShift Container Platform 4'
+
+description: |-
+    Ensures PCI-DSS v3.2.1 security configuration settings are applied.
+
+filter_rules: '"ocp4-node" not in platforms and "ocp4-master-node" not in platforms'
+
+# Req-2.2
+extends: cis
+
+selections:
+    - pcidss_ocp4:all:base
+  ### Helper Rules
+  ### This is a helper rule to fetch the required api resource for detecting OCP version
+    - version_detect_in_ocp
+    - version_detect_in_hypershift