Enhancement to handle arboretum fetcher-built OSCO evidence as input #311
Conversation
Signed-off-by: Lou Degenaro <[email protected]>
degenaro
force-pushed
the
feature/task-osco-to-oscal-for-arboretum
branch
from
a5818e2 to
5edb864
Compare
Codecov Report
@@ Coverage Diff @@
## develop #311 +/- ##
========================================
Coverage 99.08% 99.08%
========================================
Files 52 52
Lines 6098 6133 +35
========================================
+ Hits 6042 6077 +35
Misses 56 56
Continue to review full report at Codecov.
|
| if not quiet: | ||
| logger.debug(f'[simluate] Rules Analysis:') | ||
| logger.debug(f'[simluate] config_maps: {analysis["config_maps"]}') | ||
| logger.debug(f'[simluate] dispatched rules: {analysis["dispatched_rules"]}') | ||
| logger.debug(f'[simluate] result types: {analysis["result_types"]}') |
There was a problem hiding this comment.
So one item I forgot to mention. The logger should automatically observe a -v flag passed into the CLI which will turn on debug logging. If that behaves as expected that would be my preference (as it removes the need for an additional flag.
It is not a blocker more of a FYI
There was a problem hiding this comment.
For the most part the code does expect and follow the standard of the -v flag. Note that the task produces logging output about the file written and some analysis of the results encountered at the info level of execute. The quiet flag is meant to suppress all logging output, meaning the aforementioned info. At this point it is a frill, you might say, and can be removed entirely...or not. Nevertheless and with respect to symmetry, for the case of simulate these outputs are at the debug level while at the execute level they are at the info level. I think it's OK the way it is, but am not wedded to the need for the quiet flag. If preference is to remove, just say the word. Is there a way to suppress .info level output already?
Types of changes
Description
Comments
The Compliance-As-Code auditree-arboretum cluster resource fetcher (see ComplianceAsCode/auditree-arboretum#9) produces evidence which comprises the equivalent of one or more OpenShift Compliance Operator (OSCO) .yaml files.
In the end, the XML results of the OSCO .yaml file and of the auditree-arboretum fetcher are formatted the same. Thus, ingesting either OSCO .yaml files or fetcher .json files boils down to being able to find the XML results then transform them into OSCAL. The code contributed here provides the ability to do the OSCAL transformation on the fetcher-built .json files.
closes #310