Port oc compliance to compliance operator

Makefile

@@ -679,6 +679,18 @@ e2e-prerelease: e2e-set-image prep-e2e ## Run prerelease e2e tests (e.g. default
 e2e-rosa: e2e-set-image prep-e2e ## Run tests against managed ROSA environment concurrently
 	@LOG_CONTAINER_OUTPUT=1 $(GO) test ./tests/e2e/rosa $(E2E_GO_TEST_FLAGS) -args $(E2E_ARGS) --platform rosa | tee tests/e2e-rosa.log
 
+.PHONY: oc-compliance
+oc-compliance: ## Build the oc-compliance binary.
+	$(GO) build -o $(TARGET_DIR)/bin/oc-compliance ./cmd/oc-compliance
+
+.PHONY: oc-compliance-install
+oc-compliance-install: oc-compliance ## Build and install oc-compliance as an oc plugin.
+	which oc | xargs dirname | xargs -n1 cp $(TARGET_DIR)/bin/oc-compliance
+
+.PHONY: e2e-oc-compliance
+e2e-oc-compliance: oc-compliance-install ## Run oc-compliance end-to-end tests against a cluster with the operator installed.
+	@$(GO) test ./tests/e2e/oc-compliance -timeout 40m -v --ginkgo.v | tee tests/e2e-oc-compliance.log
+
 .PHONY: prep-e2e
 prep-e2e: kustomize
 	rm -rf $(TEST_SETUP_DIR)

cmd/oc-compliance/bind.go

@@ -0,0 +1,70 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+
+	bind "github.com/ComplianceAsCode/compliance-operator/pkg/oc-compliance/bind"
+)
+
+func init() {
+	bindCmd := NewCmdBind(genericclioptions.IOStreams{In: os.Stdin, Out: os.Stdout, ErrOut: os.Stderr})
+	rootCmd.AddCommand(bindCmd)
+}
+
+func NewCmdBind(streams genericclioptions.IOStreams) *cobra.Command {
+	var (
+		usageExamples = `
+  # Create a ScanSettngBinding
+  %[1]s %[2]s -N <binding name> [-S <scansetting name>] <objtype/objname> [..<objtype/objname>]
+
+  # Display a ScanSettingBinding
+  %[1]s %[2]s --dry-run -N <binding name> [-S <scansetting name>] <objtype/objname> [..<objtype/objname>]
+
+  # Example: Creating a ScanSettingBinding named "mybinding" that applies the "default" ScanSettings to the standard CIS Profiles.
+  %[1]s %[2]s -N mybinding profile/ocp4-cis profile/ocp4-cis-node
+
+  # Example: Creating a ScanSettingBinding named "mybinding" that applies the "default-auto-apply" ScanSettings to a tailored CIS Profile.
+  %[1]s %[2]s -N mybinding -S default-auto-apply tailoredprofile/ocp4-cis-node-tailored
+`
+	)
+
+	o := bind.NewBindContext(streams)
+
+	cmd := &cobra.Command{
+		Use:   "bind [--dry-run] -N <binding name> [-S <scansetting name>] <objtype/objname> [..<objtype/objname>]",
+		Short: "Creates a ScanSettingBinding for the given parameters",
+		Long: `'bind' will take the given parameters and create a ScanSettingBinding object.
+
+These objects will take the given ScanSettings and bind them to the given
+Profiles and TailoredProfiles.
+
+If the -S option is not provided, then the ScanSettingBinding will bind the
+"default" ScanSetting (an hourly scan on worker and master nodes).`,
+		Example:      fmt.Sprintf(usageExamples, "oc compliance", "bind"),
+		SilenceUsage: true,
+		RunE: func(c *cobra.Command, args []string) error {
+			if err := o.Complete(c, args); err != nil {
+				return err
+			}
+			if err := o.Validate(); err != nil {
+				return err
+			}
+			if err := o.Run(); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVarP(&o.Settings, "settings", "S", "default", "The scan settings to bind the Profiles/TailoredProfiles to")
+	cmd.Flags().StringVarP(&o.Name, "name", "N", "", "The name of the binding to create")
+	cmd.Flags().BoolVar(&o.DryRun, "dry-run", false, "Output the scansettingbinding that would be created")
+	o.ConfigFlags.AddFlags(cmd.Flags())
+
+	return cmd
+}

cmd/oc-compliance/controls.go

@@ -0,0 +1,51 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/ComplianceAsCode/compliance-operator/pkg/oc-compliance/controls"
+	"github.com/spf13/cobra"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+)
+
+func init() {
+	controlsCmd := NewCmdControls(genericclioptions.IOStreams{In: os.Stdin, Out: os.Stdout, ErrOut: os.Stderr})
+	rootCmd.AddCommand(controlsCmd)
+}
+
+func NewCmdControls(streams genericclioptions.IOStreams) *cobra.Command {
+	var (
+		controlsExamples = `
+  # View controls for the "ocp4-cis-node" profile
+  %[1]s %[2]s profile ocp4-cis-node
+`
+	)
+
+	ctx := controls.NewControlsContext(streams)
+	cmd := &cobra.Command{
+		Use:          "controls profile <profile-name>",
+		Short:        "Get a report of what controls you're complying with",
+		Long:         "Get a report of what controls you're complying with",
+		Example:      fmt.Sprintf(controlsExamples, "oc compliance", "controls"),
+		SilenceUsage: true,
+		RunE: func(c *cobra.Command, args []string) error {
+			if err := ctx.Complete(c, args); err != nil {
+				return err
+			}
+			if err := ctx.Validate(); err != nil {
+				return err
+			}
+			if err := ctx.Run(); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+
+	ctx.ConfigFlags.AddFlags(cmd.Flags())
+	cmd.Flags().StringVarP(&ctx.Benchmark, "benchmark", "b", controls.AllBenchmarks,
+		"The benchmark we want to retrieve the controls for")
+	return cmd
+}

cmd/oc-compliance/fetchfixes.go

@@ -0,0 +1,69 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+
+	fetchfixes "github.com/ComplianceAsCode/compliance-operator/pkg/oc-compliance/fetchfixes"
+)
+
+func init() {
+	fetchFixesCmd := NewCmdFetchFixes(genericclioptions.IOStreams{In: os.Stdin, Out: os.Stdout, ErrOut: os.Stderr})
+	rootCmd.AddCommand(fetchFixesCmd)
+}
+
+func NewCmdFetchFixes(streams genericclioptions.IOStreams) *cobra.Command {
+	var (
+		usageExamples = `
+  # Fetch from a rule named "ocp4-api-server-encryption-provider-cipher" into /tmp
+  %[1]s %[2]s rule ocp4-api-server-encryption-provider-cipher -o /tmp
+
+  # Fetch from a profile named "ocp4-cis" into /tmp
+  %[1]s %[2]s profile ocp4-cis -o /tmp
+
+  # Fetch from a complianceRemediation named ocp4-cis-api-server-encryption-provider-cipher into /tmp
+  %[1]s %[2]s complianceremediation ocp4-cis-api-server-encryption-provider-cipher -o /tmp
+`
+	)
+
+	o := fetchfixes.NewFetchFixesContext(streams)
+
+	cmd := &cobra.Command{
+		Use:   "fetch-fixes {rule | profile | complianceremediation } <resource-name> -o <output path>",
+		Short: "Download the fixes/remediations",
+		Long: `'fetch-fixes' fetches the fixes/remediations from a Rule, Profile, or ComplianceRemediation.
+
+This command allows you to download the proposed fixes from a Rule, Profile, or
+ComplianceRemediation into a specified directory.`,
+		Example:      fmt.Sprintf(usageExamples, "oc compliance", "fetch-fixes"),
+		SilenceUsage: true,
+		RunE: func(c *cobra.Command, args []string) error {
+			if err := o.Complete(c, args); err != nil {
+				return err
+			}
+			if err := o.Validate(); err != nil {
+				return err
+			}
+			if err := o.Run(); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVarP(&o.OutputPath, "output", "o", ".", "The path where you want to persist the fix objects to")
+	cmd.Flags().StringSliceVarP(&o.MCRoles, "mc-roles", "", []string{"worker", "master"},
+		"If the remediation(s) are MachineConfig objects, render them with the following roles")
+	cmd.Flags().StringVarP(&o.ExtraManifestBuildType, "manifest-prepare", "", "default",
+		"Prepare the manifests for another system to use them. e.g. a GitOps engine.\n"+
+			"Available Options:\n"+
+			"\t* 'default'\t- does nothing.\n"+
+			"\t* 'ArgoCD'\t- prepares the manifest for ArgoCD (OpenShift GitOps)\n")
+	o.ConfigFlags.AddFlags(cmd.Flags())
+
+	return cmd
+}

cmd/oc-compliance/fetchraw.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+
+	fetchraw "github.com/ComplianceAsCode/compliance-operator/pkg/oc-compliance/fetchraw"
+)
+
+func init() {
+	fetchRawCmd := NewCmdFetchRaw(genericclioptions.IOStreams{In: os.Stdin, Out: os.Stdout, ErrOut: os.Stderr})
+	rootCmd.AddCommand(fetchRawCmd)
+}
+
+func NewCmdFetchRaw(streams genericclioptions.IOStreams) *cobra.Command {
+	var (
+		usageExamples = `
+  # Fetch from compliancescan named "myscan" into /tmp
+  %[1]s %[2]s compliancescan myscan -o /tmp
+
+  # Fetch from compliancesuite named "mysuite" into /tmp
+  %[1]s %[2]s compliancesuite mysuite -o /tmp
+
+  # Fetch from scansettingbinding named "mybinding" into /tmp
+  %[1]s %[2]s scansettingbindings mybinding -o /tmp
+`
+	)
+
+	o := fetchraw.NewFetchRawOptions(streams)
+
+	cmd := &cobra.Command{
+		Use:   "fetch-raw {compliancescan | compliancesuite | scansettingbindings} <resource-name> -o <output path>",
+		Short: "Download raw compliance results",
+		Long: `'fetch-raw' fetches the raw results for a scan or set of scans.
+
+This command allows you to download archives of the raw (ARF) results from a
+ComplianceScan, ComplianceSuite, or ScanSettingBinding to a specified directory.`,
+		Example:      fmt.Sprintf(usageExamples, "oc compliance", "fetch-raw"),
+		SilenceUsage: true,
+		RunE: func(c *cobra.Command, args []string) error {
+			if err := o.Complete(c, args); err != nil {
+				return err
+			}
+			if err := o.Validate(); err != nil {
+				return err
+			}
+			if err := o.Run(); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Flags().StringVarP(&o.OutputPath, "output", "o", ".", "The path where you want to persist the raw results to")
+	cmd.Flags().StringVarP(&o.Image, "image", "i", "registry.access.redhat.com/ubi8/ubi:latest",
+		"The container image to use to fetch the raw results from the compliance scan. Must contain the cp and tar commands.")
+	cmd.Flags().BoolVar(&o.HTML, "html", false, "Whether to render the raw results to HTML (Requires the 'oscap' command)")
+	o.ConfigFlags.AddFlags(cmd.Flags())
+
+	return cmd
+}

cmd/oc-compliance/main.go

@@ -0,0 +1,28 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+)
+
+var rootCmd = &cobra.Command{
+	Use:   "oc-compliance",
+	Short: "A set of utilities that come along with the compliance-operator.",
+	Long:  `A set of utilities that come along with the compliance-operator.`,
+	RunE: func(cmd *cobra.Command, args []string) error {
+		fmt.Fprint(os.Stderr, "You must specify a sub-command.\n\n")
+		return cmd.Usage()
+	},
+}
+
+func main() {
+	flags := pflag.NewFlagSet("oc-compliance", pflag.ExitOnError)
+	pflag.CommandLine = flags
+
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

cmd/oc-compliance/rerunnow.go

@@ -0,0 +1,55 @@
+package main
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/ComplianceAsCode/compliance-operator/pkg/oc-compliance/rerunnow"
+	"github.com/spf13/cobra"
+	"k8s.io/cli-runtime/pkg/genericclioptions"
+)
+
+func init() {
+	rerunNowCmd := NewCmdRerunNow(genericclioptions.IOStreams{In: os.Stdin, Out: os.Stdout, ErrOut: os.Stderr})
+	rootCmd.AddCommand(rerunNowCmd)
+}
+
+func NewCmdRerunNow(streams genericclioptions.IOStreams) *cobra.Command {
+	var (
+		rerunExamples = `
+  # Re-run an individual ComplianceScan named "ocp4-cis"
+  %[1]s %[2]s compliancescan ocp4-cis
+
+  # Re-run all scans in a ComplianceSuite named "mysuite"
+  %[1]s %[2]s compliancesuite mysuite
+
+  # Re-run all ComplianceSuites bound by the ScanSettingBinding named "mybinding"
+  %[1]s %[2]s scansettingbindings mybinding
+`
+	)
+
+	ctx := rerunnow.NewReRunNowContext(streams)
+	cmd := &cobra.Command{
+		Use:          "rerun-now {compliancescan | compliancesuite | scansettingbindings} <object-name>",
+		Short:        "Force a re-scan for one or more ComplianceScans",
+		Long:         `'rerun-now' forces a ComplianceScan or set of ComplianceScans to be retriggered.`,
+		Example:      fmt.Sprintf(rerunExamples, "oc compliance", "rerun-now"),
+		SilenceUsage: true,
+		RunE: func(c *cobra.Command, args []string) error {
+			if err := ctx.Complete(c, args); err != nil {
+				return err
+			}
+			if err := ctx.Validate(); err != nil {
+				return err
+			}
+			if err := ctx.Run(); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+
+	ctx.ConfigFlags.AddFlags(cmd.Flags())
+	return cmd
+}