diff --git a/docs/ocm/README.md b/docs/ocm/README.md index a3259a6..e30501a 100644 --- a/docs/ocm/README.md +++ b/docs/ocm/README.md @@ -27,6 +27,19 @@ Use "c2pcli ocm [command] --help" for more information about a command. ### Manual end-to-end use case +#### Outline +1. Create OSCAL Component Definition + - Use example one. In real cases, a user writes OSCAL by Authoring tool like [Trestle](https://ibm.github.io/compliance-trestle/)) +1. Run oscal2policy to generate OCM Policies from OSCAL +1. Deploy generated OCM Policies to OCM Hub +1. Get OCM Policies from OCM Hub +1. Run result2oscal to generate OSCAL Assessment Results from the OCM Policy Results +1. Prettify OSCAL Assessment Results + - Use C2P tools. In real cases, it's responsible of GRC tools. + +![manual-end-to-end-use-case.png](/docs/ocm/images/manual-end-to-end-use-case.png) + +#### Steps 1. Prerequisites 1. OCM is configured to manage two k8s clusters (cluster1 and cluster2) and installed Policy Governance Framework. 1. Namespace `c2p` is created in OCM Hub @@ -48,12 +61,12 @@ Use "c2pcli ocm [command] --help" for more information about a command. └── 2 ManagedClusters selected └── [cluster1 cluster2] ``` -1. Run oscal2policy +1. Run oscal2policy to generate OCM Policies from OSCAL ``` c2pcli ocm oscal2policy -c ./docs/ocm/c2p-config.yaml -o /tmp/ocm-policies ``` - The generated ocm-policies directory looks like [./final-outputs/ocm-policies](./final-outputs/ocm-policies) -1. Deploy generated OCM Policies to OCM Hub +1. Deploy the generated OCM Policies to OCM Hub ``` kubectl create -f /tmp/ocm-policies ``` @@ -76,12 +89,12 @@ Use "c2pcli ocm [command] --help" for more information about a command. ``` 1. Get OCM Policy Results (Policy, PolicySet, PlacementDecision) from OCM Hub ``` - mkdir /tmp/results + mkdir -p /tmp/results kubectl get policies.policy.open-cluster-management.io -A -o yaml > /tmp/results/policies.policy.open-cluster-management.io.yaml kubectl get policysets.policy.open-cluster-management.io -A -o yaml > /tmp/results/policysets.policy.open-cluster-management.io.yaml kubectl get placementdecisions.cluster.open-cluster-management.io -A -o yaml > /tmp/results/placementdecisions.cluster.open-cluster-management.io.yaml ``` -1. Run result2oscal +1. Run result2oscal to generate OSCAL Assessment Results from the OCM Policy Results ``` c2pcli ocm result2oscal -c ./docs/ocm/c2p-config.yaml --results /tmp/results -o /tmp/assessment-results.json ``` @@ -91,71 +104,15 @@ Use "c2pcli ocm [command] --help" for more information about a command. ``` - You can view the compliance posture like [./final-outputs/compliance-posture.md](./final-outputs/compliance-posture.md) -### C2P Decomposer -Decompose OCM poicy collection to kubernetes resources composing each OCM policy (we call it policy resource). +### GitOps automation use case -1. Clone [Policy Collection](https://github.com/open-cluster-management-io/policy-collection) - ``` - git clone --depth 1 https://github.com/open-cluster-management-io/policy-collection.git /tmp/policy-collection - ``` -1. Run C2P Decomposer - ``` - go run ./cmd/decompose/decompose.go --policy-collection-dir=/tmp/policy-collection --out=/tmp/c2p-output - ``` -1. Decomposed policy resources are ouput in `/tmp/c2p-output/decomposed/resources` - ``` - $ tree -L 1 /tmp/c2p-output/decomposed - /tmp/c2p-output/decomposed - ├── _sources - └── resources - ``` - Individual decomposed resource contains k8s manifests and configuration files (policy-generator.yaml and kustomization.yaml) for PolicyGenerator. - ``` - $ tree -L 3 /tmp/c2p-output/decomposed/resources - /tmp/c2p-output/decomposed/resources - ├── add-chrony - │   ├── add-chrony-worker - │   │   └── MachineConfig.50-worker-chrony.0.yaml - │   ├── kustomization.yaml - │   └── policy-generator.yaml - ├── add-tvk-license - │   ├── add-tvk-license - │   │   └── License.triliovault-license.0.yaml - │   ├── kustomization.yaml - ``` -### C2P Composer -Compose OCM Policy from policy resources from compliance information (for example, [compliance.yaml](cmd/compose/compliance.yaml)) +#### Outline -1. Run C2P Composer - ``` - go run cmd/compose-by-c2pcr/main.go --c2pcr ./cmd/compose-by-c2pcr/c2pcr.yaml --out /tmp/c2p-output - ``` -1. Composed OCM policies are output in `/tmp/c2p-output` - ``` - $ tree /tmp/c2p-output - /tmp/c2p-output - ├── add-chrony - │ ├── add-chrony-worker - │ │ └── MachineConfig.50-worker-chrony.0.yaml - │ ├── kustomization.yaml - │ └── policy-generator.yaml - ├── install-odf-lvm-operator - │ ├── kustomization.yaml - │ ├── odf-lvmcluster - │ │ └── LVMCluster.odf-lvmcluster.0.yaml - │ ├── policy-generator.yaml - │ └── policy-odf-lvm-operator - │ ├── Namespace.openshift-storage.0.yaml - │ ├── OperatorGroup.openshift-storage-operatorgroup.0.yaml - │ └── Subscription.lvm-operator.0.yaml - ├── kustomization.yaml - ├── policy-generator.yaml - └── policy-sets.yaml - ``` +https://github.com/IBM/compliance-to-policy/assets/113283236/da3518d0-53de-4bd6-8703-04ce94e9dfba -### GitOps automation use case +#### Steps -https://github.com/IBM/compliance-to-policy/assets/113283236/da3518d0-53de-4bd6-8703-04ce94e9dfba +Setup Github Repos 1. Create two repositories (one is configuration repository that's used for pipeline from OSCAL to Policy and another is evidence repository that's used for pipeline from OCM statuses to Compliance result) - For example, c2p-for-ocm-pipeline01-config and c2p-for-ocm-pipeline01-evidence @@ -183,17 +140,20 @@ https://github.com/IBM/compliance-to-policy/assets/113283236/da3518d0-53de-4bd6- - Name: PAT - Secret: Created Github Personal Access Token -### Run oscal-to-pocliy +Run oscal-to-pocliy + 1. Go to the configuration repository 1. Go to `Actions` tab 1. Run `OSCAL to Policy` 1. This action generates manifests from OSCAL and then generate a PR of changes for a directory `ocm-policy-manifests` containing the generated manifests. 1. Merge the PR -### Integrate with GitOps +Integrate with GitOps + 1. Sync `ocm-policy-manifests` directory with your OCM Hub by OCM GitOps (OCM Channel and Subscription addon) -### Deploy collector to your OCM Hub +Deploy collector to your OCM Hub + 1. Apply RBAC for collector ``` kubectl apply -f https://raw.githubusercontent.com/yana1205/compliance-to-policy/redesign.0622/scripts/collect/rbac.yaml @@ -211,13 +171,77 @@ https://github.com/IBM/compliance-to-policy/assets/113283236/da3518d0-53de-4bd6- kubectl apply -f https://raw.githubusercontent.com/IBM/compliance-to-policy/main/scripts/collect/cronjob.yaml ``` -### Cleanup +Cleanup + ``` kubectl delete -f https://raw.githubusercontent.com/IBM/compliance-to-policy/main/scripts/collect/cronjob.yaml kubectl -n c2p delete secret collect-ocm-status-secret kubectl delete -f https://raw.githubusercontent.com/IBM/compliance-to-policy/main/scripts/collect/rbac.yaml ``` + +### C2P Decomposer +Decompose OCM poicy collection to kubernetes resources composing each OCM policy (we call it policy resource). + +1. Clone [Policy Collection](https://github.com/open-cluster-management-io/policy-collection) + ``` + git clone --depth 1 https://github.com/open-cluster-management-io/policy-collection.git /tmp/policy-collection + ``` +1. Run C2P Decomposer + ``` + go run ./cmd/decompose/decompose.go --policy-collection-dir=/tmp/policy-collection --out=/tmp/c2p-output + ``` +1. Decomposed policy resources are ouput in `/tmp/c2p-output/decomposed/resources` + ``` + $ tree -L 1 /tmp/c2p-output/decomposed + /tmp/c2p-output/decomposed + ├── _sources + └── resources + ``` + Individual decomposed resource contains k8s manifests and configuration files (policy-generator.yaml and kustomization.yaml) for PolicyGenerator. + ``` + $ tree -L 3 /tmp/c2p-output/decomposed/resources + /tmp/c2p-output/decomposed/resources + ├── add-chrony + │   ├── add-chrony-worker + │   │   └── MachineConfig.50-worker-chrony.0.yaml + │   ├── kustomization.yaml + │   └── policy-generator.yaml + ├── add-tvk-license + │   ├── add-tvk-license + │   │   └── License.triliovault-license.0.yaml + │   ├── kustomization.yaml + ``` +### C2P Composer +Compose OCM Policy from policy resources from compliance information (for example, [compliance.yaml](cmd/compose/compliance.yaml)) + +1. Run C2P Composer + ``` + go run cmd/compose-by-c2pcr/main.go --c2pcr ./cmd/compose-by-c2pcr/c2pcr.yaml --out /tmp/c2p-output + ``` +1. Composed OCM policies are output in `/tmp/c2p-output` + ``` + $ tree /tmp/c2p-output + /tmp/c2p-output + ├── add-chrony + │ ├── add-chrony-worker + │ │ └── MachineConfig.50-worker-chrony.0.yaml + │ ├── kustomization.yaml + │ └── policy-generator.yaml + ├── install-odf-lvm-operator + │ ├── kustomization.yaml + │ ├── odf-lvmcluster + │ │ └── LVMCluster.odf-lvmcluster.0.yaml + │ ├── policy-generator.yaml + │ └── policy-odf-lvm-operator + │ ├── Namespace.openshift-storage.0.yaml + │ ├── OperatorGroup.openshift-storage-operatorgroup.0.yaml + │ └── Subscription.lvm-operator.0.yaml + ├── kustomization.yaml + ├── policy-generator.yaml + └── policy-sets.yaml + ``` + ## C2P as controller (deprecated) 1. Build image ``` diff --git a/docs/ocm/images/manual-end-to-end-use-case.drawio b/docs/ocm/images/manual-end-to-end-use-case.drawio new file mode 100644 index 0000000..19a1dcf --- /dev/null +++ b/docs/ocm/images/manual-end-to-end-use-case.drawio @@ -0,0 +1,76 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/docs/ocm/images/manual-end-to-end-use-case.png b/docs/ocm/images/manual-end-to-end-use-case.png new file mode 100644 index 0000000..8b968d2 Binary files /dev/null and b/docs/ocm/images/manual-end-to-end-use-case.png differ