Port oc compliance to compliance operator - #1329
Conversation
Add k8s.io/cli-runtime, k8s.io/kubectl/pkg/cmd/cp, and github.com/pkg/browser to support the oc-compliance CLI tool being ported into this repository. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the shared utilities from oc-compliance into this repository. This includes constants, Kubernetes client abstractions, input validation, YAML serialization, and profile/suite helpers that all subcommands depend on. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the main CLI entry point and the bind subcommand from oc-compliance. The bind command creates ScanSettingBinding objects for given Profiles or TailoredProfiles, with optional dry-run output. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the controls subcommand from oc-compliance. This command reports which compliance controls a profile fulfills by inspecting rule annotations, with output rendered as a merged table grouped by benchmark. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the rerun-now subcommand from oc-compliance. This command forces ComplianceScans to re-trigger by setting the rescan annotation, supporting ComplianceScan, ComplianceSuite, and ScanSettingBinding targets. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the fetch-fixes subcommand entry point, the shared FixPersister, and the ExtraManifestBuilder framework (default and ArgoCD) from oc-compliance. The object type helpers follow in the next commit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the Rule, Profile, and ComplianceRemediation helpers for the fetch-fixes subcommand. These handle fetching available fixes from each object type and persisting them as YAML files. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the fetch-raw subcommand entry point and the ComplianceSuite and ScanSettingBinding helpers from oc-compliance. The ComplianceScan helper that handles PVC extraction follows in the next commit. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the ComplianceScan helper that extracts raw ARF results from PVCs by creating an extractor pod, using kubectl cp to copy results, and optionally generating HTML reports via oscap. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the view-result subcommand from oc-compliance. This command displays detailed information about a ComplianceCheckResult by traversing the owner chain to find the relevant rule, profile, and remediation. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Port the end-to-end tests from oc-compliance. These tests cover all subcommands: bind, controls, fetch-fixes, fetch-raw, rerun-now, and view-result. Updated deprecated ioutil calls to use os package equivalents. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add Makefile targets for building, installing, and running e2e tests for oc-compliance. The e2e target builds the binary, installs it as an oc plugin, then runs the tests — matching the original oc-compliance repository's workflow. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: rhmdnd The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
I experimented with this port locally, and pushed what I had for review. The rationale for doing this is to make it easier to maintain the oc-compliance binary by just bundling and rebuilding it with each Compliance Operator release (which is released more frequently than oc-compliance). This is a port from https://github.com/openshift/oc-compliance - and follows roughly the same code shape and structure. Changes are isolated to the dependencies (which are shared with the Compliance Operator now, and that's a good thing). |
|
@rhmdnd: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
1 participant
No description provided.