CMP-3589: Add variable for routes rate limit

[Vincent056]

Add a variable for excluded namespaces in the routes rate limit check

Introduce a new variable 'var_routes_excluded_namespaces_regex' to define namespaces that should be excluded from the routes rate limit compliance check.

[Vincent056]

tested with

apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  name: custom-security-checks
  namespace: openshift-compliance
spec:
  description: Test variable
  enableRules:
    - kind: Rule
      name: upstream-ocp4-routes-rate-limit   
      rationale: test
  setValues:
    - name: upstream-ocp4-var-routes-excluded-namespaces-regex
      rationale: test
      value: "^*"
  title: test
---
apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cel-ssb
  namespace: openshift-compliance
profiles:
  - apiGroup: compliance.openshift.io/v1alpha1
    kind: TailoredProfile
    name: custom-security-checks
settingsRef:
  apiGroup: compliance.openshift.io/v1alpha1
  kind: ScanSetting
  name: default

[xiaojiey]

May be use {{{ ocil_oc_pipe_jq_filter('routes --all-namespaces', jqfilter) }}}?
Currently, the command in the instructions will always return [].
'''
% oc get ccr upstream-ocp4-stig-routes-rate-limit -o=jsonpath={.instructions}
This rule checks routes that do not have rate limiting enabled and fails if there are
routes outside the excluded namespaces (as defined by the variable
ocp4-var-routes-excluded-namespaces-regex) without rate limiting annotations.
Use following command to list the routes that would fail the test:
$ oc get routes -o json | jq '[.items[] | select(.metadata.namespace | test("^kube-.|openshift-."; "") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name]'
Is it the case that Rate limit is not enabled for all routes outside the excluded namespaces?%

% oc get routes -o json | jq '[.items[] | select(.metadata.namespace | test("^kube-.|openshift-."; "") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name]'
[]

% oc get routes --all-namespaces -o json | jq '[.items[] | select(.metadata.namespace | test("^kube-.|openshift-."; "") | not) | select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | .metadata.name]'
[
"test-route"
]
% oc get ccr | grep routes-rate-limit
ocp4-stig-routes-rate-limit FAIL medium
upstream-ocp4-stig-routes-rate-limit FAIL medium
'''

[xiaojiey]

It works well at the function part. The only issue is the instruction need to updated a little bit.

1. Create a test-route without the annotation, and run the scan
%  oc get routes --all-namespaces -o json | jq '[.items[] | select(.metadata.namespace | test("^kube-.*|openshift-.*"; "") | not) | 
  select(.metadata.annotations["haproxy.router.openshift.io/rate-limit-connections"] == "true" | not) | {namespace: .metadata.namespace, name: .metadata.name}]'
[
  {
    "namespace": "test-routes",
    "name": "test-route"
  }
]
% oc get ccr | grep routes-rate-limit                                
ocp4-stig-routes-rate-limit                                     FAIL     medium
upstream-ocp4-stig-routes-rate-limit                            FAIL     medium
2. Create a tp with the variable to exclude the check for a specific namespace:
% cat custom-security-checks.yaml 
apiVersion: compliance.openshift.io/v1alpha1
kind: TailoredProfile
metadata:
  name: custom-security-checks
  namespace: openshift-compliance
spec:
  description: Test variable
  enableRules:
    - kind: Rule
      name: upstream-ocp4-routes-rate-limit
      rationale: test
  setValues:
    - name: upstream-ocp4-var-routes-excluded-namespaces-regex
      rationale: test
      value: "^kube-.*|openshift-.*|test-routes"
  title: test
% oc apply -f custom-security-checks.yaml 
tailoredprofile.compliance.openshift.io/custom-security-checks created
% oc apply -f -<<EOF
apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cel-ssb
  namespace: openshift-compliance
profiles:
  - apiGroup: compliance.openshift.io/v1alpha1
    kind: TailoredProfile
    name: custom-security-checks
settingsRef:
  apiGroup: compliance.openshift.io/v1alpha1
  kind: ScanSetting
  name: default
heredoc> EOF
scansettingbinding.compliance.openshift.io/cel-ssb created
% oc get suite cel-ssb  
NAME                              PHASE     RESULT
cel-ssb                           DONE          COMPLIANT
% oc get ccr | grep routes-rate-limit    
custom-security-checks-routes-rate-limit                        PASS     medium
ocp4-stig-routes-rate-limit                                     FAIL     medium
upstream-ocp4-stig-routes-rate-limit                            FAIL     medium
3. The only issue is that the instructions need to be updated a little bit. Details seen from https://github.com/ComplianceAsCode/content/pull/14023#discussion_r2454207457

[openshift-ci]

@Vincent056: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	14b2786	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[rhmdnd]

Thanks for updating this so it returns all routes.

[rhmdnd]

/lgtm

[rhmdnd]

/packit retest-required

[yuumasato]

Overriding testing-farm:centos-stream-9-x86_64:/static-checks