CMP-4284: Fix api_server_bind_address for IPv6 and dual-stack clusters

[Vincent056]

Description:

• Fix rule api_server_bind_address to accept both 0.0.0.0:6443 (IPv4) and [::]:6443 (IPv6/dual-stack) as valid bind addresses. Previously the rule hardcoded 0.0.0.0:6443 via an exact-match variable, causing failures on IPv6 single-stack and dual-stack clusters.
• Switch from embedded_data with equals comparison to regex_data with a pattern-match variable, following the same approach used by configure_network_policies.

Rationale:

• On IPv6 single-stack and dual-stack OCP clusters, the kube-apiserver operator sets servingInfo.bindAddress to [::]:6443 instead of 0.0.0.0:6443 (see CORS-4363). Both values mean "listen on all interfaces on the TLS port" and are security-equivalent. The rule should pass for either.

Review Hints:

• Only two files changed: rule.yml and var_apiserver_bind_address.var. Review them together.
• The template code path follows the same pattern as configure_network_policies (xccdf_variable + regex_data), which is well-tested.
• Build with: ./build_product --datastream-only ocp4
• Affected profiles: any profile including api_server_bind_address (STIG, CIS, PCI-DSS, moderate, high).

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_api_server_bind_address'.
--- xccdf_org.ssgproject.content_rule_api_server_bind_address
+++ xccdf_org.ssgproject.content_rule_api_server_bind_address
@@ -3,7 +3,9 @@
 Ensure that the bindAddress is set to a relevant secure port
 
 [description]:
-The bindAddress is set by default to 0.0.0.0:6443, and listening with TLS enabled.
+The bindAddress is set by default to 0.0.0.0:6443 on IPv4 clusters
+or [::]:6443 on IPv6 and dual-stack clusters, and listening with
+TLS enabled.
 
 [warning]:
 This rule's check operates on the cluster configuration dump.
@@ -65,9 +67,10 @@
 
 [rationale]:
 The OpenShift API server is served over HTTPS with authentication and authorization;
-the secure API endpoint is bound to 0.0.0.0:6443 by default. In OpenShift, the only
+the secure API endpoint is bound to 0.0.0.0:6443 (IPv4) or
+[::]:6443 (IPv6/dual-stack) by default. In OpenShift, the only
 supported way to access the API server pod is through the load balancer and then through
-the internal service.  The value is set by the bindAddress argument under the servingInfo
+the internal service. The value is set by the bindAddress argument under the servingInfo
 parameter.
 
 [ident]:

OCIL for rule 'xccdf_org.ssgproject.content_rule_api_server_bind_address' differs.
--- ocil:ssg-api_server_bind_address_ocil:questionnaire:1
+++ ocil:ssg-api_server_bind_address_ocil:questionnaire:1
@@ -1,5 +1,6 @@
 Run the following command:
 oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq -r '.servingInfo["bindAddress"]'
-The output should return 0.0.0.0:6443.
+The output should return 0.0.0.0:6443 on IPv4 single-stack clusters
+or [::]:6443 on IPv6 and dual-stack clusters.
       Is it the case that <tt>bindAddress</tt> allows unsecure connections?