diff --git a/src/metaschema/examples/rules-component.xml b/src/metaschema/examples/rules-component.xml new file mode 100644 index 0000000000..1bc5007f26 --- /dev/null +++ b/src/metaschema/examples/rules-component.xml @@ -0,0 +1,129 @@ + + + + + Example Component Definition for Openshift Container Platform v4, Rules, and Tests + 2022-08-23T00:00:00.000000000-04:00 + 0.0.1-alpha + 1.2.0 + + + Disable Anonymous Unauthenticated Access to Components + +

Anonymous (i.e. unauthenticated) access to any OCP4 sub-system documented in the components below must prevent anonymous, unauthenticated access.

+ + + + Disable Anonymous Authentication to the Kubelet - Iac Analysis + +

This test will analyze Infrastructure-as-Code (IaC) written in Ansible to provision OCP4 cluster(s). If the necessary configuration in /etc/kubernetes/kubelet.conf disables anonymous authentication with the appropriate setting (authentication.anonymous.enabled: false), this test will return a passing value. It will be one example of an aspect of OCP4 cluster(s) configured to meet CM-6 requirements.

+ + + + Disable Anonymous Authentication to the Kubelet - Runtime Analysis with OCP4 Compliance Operator + +

+ This test will analyze running OCP4 cluster(s) with its configured Compliance Operator to perform the necessary configuration management scans. If operator conducts scans of node kubelets and the necessary configuration in /etc/kubernetes/kubelet.conf disables anonymous authentication with the appropriate setting (authentication.anonymous.enabled: false), this test will return a passing value. It will be one example of an aspect of OCP4 cluster(s) configured to meet CM-6 requirements.

+ + + + + + + + Disable Anonymous Authentication to the Kubelet - Runtime Analysis with CSP API for Managed OCP4 Control Plane + +

This test will analyze running OCP4 cluster(s) with a managed service from a cloud service provider (CSP). The CSP has a managed service that provisions OCP4 cluster(s) for customers. A REST API for this managed service can be queried. If the API confirms the setting is appropriately set, this test will return a passing value. It will be one example of an aspect of OCP4 cluster(s) configured to meet CM-6 requirements.

+ + + + OCP4 Cluster Properly Configured and Deployed with Compliance Operator + +

This is a test that provides automated evaluation to confirm that an OCP4 cluster has the Compliance Operator properly installed and configured.

+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + RedHit Openshift Container Platform v4 + +

This component documents the usage of RedHat's OpenShift Container Platform v4 (OCP4) in a system.

+

For many OpenShift Container Platform customers, regulatory readiness, or compliance, on some level is required before any systems can be put into production. That regulatory readiness can be imposed by national standards, industry standards, or the organization's corporate governance framework.

+

This component documents a system's use of OCP4 and its regulatory readiness in relation to NIST's Special Publication 800-37 information security and risk management framework. Implemented requirements are documented through security and privacy controls from NIST's Special Publication 800-53 Revision 5 Catalog.

+

Many of the implemented requirements provide supporting evidence of already implemented requirements with OCP4 cluster(s) as-is or recommendations for customers to configure cluster(s) accordingly in their own environment when it is their responsibility, on a control-by-control basis. Where applicable, OSCAL and its rules provide machine-readable instructions for recommended security tools to evaluate security and privacy control requirements are met and provide machine-readable evidence of such requirements.

+ + + + + +

Control implementations and their documented requirements for OCP4 from the NIST 800-53 Revision 5 Catalog (sourced from NIST ITL CSD's official OSCAL catalog).

+ + + +

+ OCP4 implements requirements to support NIST 800-53 Revision 5 control CM-6: Configuration Settings. +

+ + + common secure configurations from official RedHat or community OpenSCAP sources + + + + +

Configuration managers can use the product's functionality to establish and document configuration settings for OCP4 cluster(s) employed within the system. When not using system defaults, configuration managers can use that reflect the most restrictive mode consistent with operational requirements.

+ + + + + + + + + + + \ No newline at end of file diff --git a/src/metaschema/oscal_component_metaschema.xml b/src/metaschema/oscal_component_metaschema.xml index c757be4c80..794cc88c32 100644 --- a/src/metaschema/oscal_component_metaschema.xml +++ b/src/metaschema/oscal_component_metaschema.xml @@ -26,6 +26,7 @@ + Component Definition @@ -41,6 +42,17 @@ + + rule + + + + test + + + + + component @@ -118,6 +130,7 @@ + + + + + + A string that identifies the revision of the test. + + + A pointer to the resource that this test is derived from. + + + + + Rule Testing Scenario + A rule testing scenario + + Testing Scenario Universally Unique Identifier + TODO + + + Testing Scenario Rule Universally Unique Identifier Reference + TODO + + + + + + + + + + + condition + + + + + + + + Test Reference + TODO + + + Test Universally Unique Identifier Reference + A test UUID reference + + + + Rule Condition + A rule implementation condition + + Rule Condition Negation Flag + TODO + +

Negate Truth Table

+

true -> false, false -> true, error -> error, not-applicable -> not-applicable

+ + + + Rule Condition Operator + TODO + + + and + or + + + +

Operator Truth Table

+

What is eager evaluation and why does it matter?

+

How do prerequisites work in the processing of condition operators and precedence.

+ + + + + + + + + + + prerequisite + + + + + condition + + + + + + + + + + + + + + Testing Scenario Universally Unique Identifier + A testing scenario UUID reference + + + Testing Scenario Reference + A reference to a testing scenario. + + Testing Scenario Universally Unique Identifier Reference + A testing scenario UUID reference + + + + + Rule Implementation + TODO + + Rule Implementation Universally Unique Identifier + TODO + + + + Rule Implementation Description + A summary of the rule implementation. + + + + + + + + + + condition + + + Provides a placeholder for cases where a rule can be identified, but the specific tests to evaluate the rule cannot be identified. + + + + + + +