Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CMP-2130: Implement support for profile versioning #425

Merged
merged 1 commit into from
Nov 3, 2023
+77 −14
Merged

CMP-2130: Implement support for profile versioning #425

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ Versioning](https://semver.org/spec/v2.0.0.html).
more ergonomic to pause scans during maintenance periods. See the
[enhancement](https://github.com/ComplianceAsCode/compliance-operator/pull/375)
for more details.
- Implemented support for an optional `version` attribute on `Profile` custom
resources.

### Fixes

Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_compliancecheckresults.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: compliancecheckresults.compliance.openshift.io
spec:
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_complianceremediations.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: complianceremediations.compliance.openshift.io
spec:
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_compliancescans.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: compliancescans.compliance.openshift.io
spec:
Expand Down
7 changes: 6 additions & 1 deletion bundle/manifests/compliance.openshift.io_compliancesuites.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: compliancesuites.compliance.openshift.io
spec:
Expand Down Expand Up @@ -323,6 +323,11 @@ spec:
scheduled scans will start running only after the initial results
are ready.
type: string
suspend:
default: false
description: Defines if a schedule should be suspended and is a boolean
value, defaulting to False.
type: boolean
required:
- scans
type: object
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_profilebundles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: profilebundles.compliance.openshift.io
spec:
Expand Down
14 changes: 12 additions & 2 deletions bundle/manifests/compliance.openshift.io_profiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: profiles.compliance.openshift.io
spec:
Expand All @@ -17,7 +17,14 @@ spec:
singular: profile
scope: Namespaced
versions:
- name: v1alpha1
- additionalPrinterColumns:
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
- jsonPath: .version
name: Version
type: string
name: v1alpha1
schema:
openAPIV3Schema:
description: Profile is the Schema for the profiles API
Expand Down Expand Up @@ -55,13 +62,16 @@ spec:
nullable: true
type: array
x-kubernetes-list-type: atomic
version:
type: string
required:
- description
- id
- title
type: object
served: true
storage: true
subresources: {}
status:
acceptedNames:
kind: ""
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: rules.compliance.openshift.io
spec:
Expand Down
10 changes: 8 additions & 2 deletions bundle/manifests/compliance.openshift.io_scansettingbindings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: scansettingbindings.compliance.openshift.io
spec:
Expand All @@ -16,7 +16,11 @@ spec:
singular: scansettingbinding
scope: Namespaced
versions:
- name: v1alpha1
- additionalPrinterColumns:
- jsonPath: .status.phase
name: Status
type: string
name: v1alpha1
schema:
openAPIV3Schema:
description: ScanSettingBinding is the Schema for the scansettingbindings
Expand Down Expand Up @@ -124,6 +128,8 @@ spec:
- name
type: object
x-kubernetes-map-type: atomic
phase:
type: string
type: object
type: object
served: true
Expand Down
7 changes: 6 additions & 1 deletion bundle/manifests/compliance.openshift.io_scansettings.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: scansettings.compliance.openshift.io
spec:
Expand Down Expand Up @@ -247,6 +247,11 @@ spec:
be strict and error out. `false` means that we don't need to be strict
and we can proceed.
type: boolean
suspend:
default: false
description: Defines if a schedule should be suspended and is a boolean
value, defaulting to False.
type: boolean
timeout:
default: 30m
description: Timeout is the maximum amount of time the scan can run. If
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_tailoredprofiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: tailoredprofiles.compliance.openshift.io
spec:
Expand Down
2 changes: 1 addition & 1 deletion bundle/manifests/compliance.openshift.io_variables.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
annotations:
controller-gen.kubebuilder.io/version: v0.11.3
controller-gen.kubebuilder.io/version: v0.13.0
creationTimestamp: null
name: variables.compliance.openshift.io
spec:
Expand Down
12 changes: 11 additions & 1 deletion config/crd/bases/compliance.openshift.io_profiles.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,14 @@ spec:
singular: profile
scope: Namespaced
versions:
- name: v1alpha1
- additionalPrinterColumns:
- jsonPath: .metadata.creationTimestamp
name: Age
type: date
- jsonPath: .version
name: Version
type: string
name: v1alpha1
schema:
openAPIV3Schema:
description: Profile is the Schema for the profiles API
Expand Down Expand Up @@ -55,10 +62,13 @@ spec:
nullable: true
type: array
x-kubernetes-list-type: atomic
version:
type: string
required:
- description
- id
- title
type: object
served: true
storage: true
subresources: {}
4 changes: 4 additions & 0 deletions pkg/apis/compliance/v1alpha1/profile_types.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,12 +35,16 @@ type ProfilePayload struct {
// +optional
// +listType=atomic
Values []ProfileValue `json:"values,omitempty"`
// +optional
Version string `json:"version"`
rhmdnd marked this conversation as resolved.
Show resolved Hide resolved
}

// +kubebuilder:object:root=true

// Profile is the Schema for the profiles API
// +kubebuilder:resource:path=profiles,scope=Namespaced,shortName=profs;prof
// +kubebuilder:printcolumn:name="Age",type="date",JSONPath=".metadata.creationTimestamp"
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

wondering if we update the profile, do we still have the old creationTimestamp

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think it would, since this patch isn't changing the behavior of the creation time.

Do you think that behavior needs to be different.

In my thinking, the profiles are still created from the profile parsers. Multiple versions of the same profile will have the same creation timestamp since they're all created when the profile parser runs. We don't support a way to update a profile besides uploading a new content image, which creates a new profile, right?

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From today's discussion during sync up meeting, I think adding age here makes sense, because we had shown age in the past, and adding this here preserve such behavior.

// +kubebuilder:printcolumn:name="Version",type="string",JSONPath=`.version`
type Profile struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`
Expand Down
6 changes: 6 additions & 0 deletions pkg/profileparser/profileparser.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -311,6 +311,11 @@ func parseProfileFromNode(profileRoot *xmlquery.Node, pb *cmpv1alpha1.ProfileBun
if description == nil {
return LogAndReturnError("no description in profile")
}
v := profileObj.SelectElement("xccdf-1.2:version")
var version string
if v != nil {
version = v.InnerText()
}
log.Info("Found profile", "id", id)

// In case the profile sets its own CPE string
Expand Down Expand Up @@ -362,6 +367,7 @@ func parseProfileFromNode(profileRoot *xmlquery.Node, pb *cmpv1alpha1.ProfileBun
Description: utils.XmlNodeAsMarkdown(description),
Rules: selectedrules,
Values: selectedvalues,
Version: version,
},
}

Expand Down
15 changes: 15 additions & 0 deletions tests/e2e/parallel/main_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,21 @@ func TestMain(m *testing.M) {
os.Exit(exitCode)
}

func TestProfileVersion(t *testing.T) {
t.Parallel()
f := framework.Global

profile := &compv1alpha1.Profile{}
// We know this profile has a version and it's set in the ComplianceAsCode/content
profileName := "ocp4-cis"
if err := f.Client.Get(context.TODO(), types.NamespacedName{Namespace: f.OperatorNamespace, Name: profileName}, profile); err != nil {
t.Fatalf("failed to get profile %s: %s", profileName, err)
}
if profile.Version == "" {
t.Fatalf("expected profile %s to have version set", profileName)
}
}

func TestProfileModification(t *testing.T) {
t.Parallel()
f := framework.Global
Expand Down