compliance-operator icon indicating copy to clipboard operation
compliance-operator copied to clipboard

Rules marked as checkType Platform still being run on Node Scans.

Open montaguethomas opened this issue 1 year ago • 0 comments

After https://github.com/ComplianceAsCode/content/pull/10464 all but one kubelet rule was being parsed to be under checkType: Node. However one rule (kubelet_configure_tls_min_version) wasn't updated to remove the warnings field.

This rule ends up being parsed/imported into k8s by CO as a checkType: Platform. While trying to tailor out/disable rules, this rule is impossible to tailor.

Related PR to correct rule to be marked as Node type: https://github.com/ComplianceAsCode/content/pull/11243

In this case, the kubelet_configure_tls_min_version rule would still run under the node scans, however CO would mark the TailoredProfile in ERROR when trying to disable this rule for a Node profile. If tailored out in a Platform profile, it has no effect on the Node scan.

montaguethomas avatar Nov 02 '23 21:11 montaguethomas