diff --git a/.ansible-lint b/.ansible-lint index 4d6fc94e3..ea6df7530 100644 --- a/.ansible-lint +++ b/.ansible-lint @@ -5,5 +5,5 @@ exclude_paths: - .github/ - clusters/ - scenarios/ciso/ - - scenarios/sre/tools/ + - scenarios/tools/ - .pre-commit-config.yaml diff --git a/.ansible-lint-ignore b/.ansible-lint-ignore index d290dc229..485ad70bb 100644 --- a/.ansible-lint-ignore +++ b/.ansible-lint-ignore @@ -2,30 +2,30 @@ clusters/kops/playbooks/roles/kops/tasks/configure_clusters.yaml yaml[line-length] # command-instead-of-shell is being invoked on files that have to use shell commands -scenarios/sre/project/roles/executables/tasks/check_binary_path.yaml command-instead-of-shell +scenarios/project/roles/executables/tasks/check_binary_path.yaml command-instead-of-shell # octal-values is being invoked on Kubernetes manifests -scenarios/sre/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml yaml[octal-values] -scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml yaml[octal-values] -scenarios/sre/project/roles/tools/tasks/install_clickhouse_instances.yaml yaml[octal-values] +scenarios/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml yaml[octal-values] +scenarios/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml yaml[octal-values] +scenarios/project/roles/tools/tasks/install_clickhouse_instances.yaml yaml[octal-values] # yaml[line-length] is being invoked on task files with long urls -scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/create.yml yaml[line-length] +scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/create.yml yaml[line-length] # yaml[line-length] is being invoked on groundtruth_v1 manifests -scenarios/sre/project/roles/scenarios/files/scenario_2/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_3/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_5/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_6/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_7/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_8/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_10/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_11/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_13/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_14/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_15/groundtruth_v1.yaml yaml[line-length] -scenarios/sre/project/roles/scenarios/files/scenario_36/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_2/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_3/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_5/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_6/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_7/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_8/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_10/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_11/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_13/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_14/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_15/groundtruth_v1.yaml yaml[line-length] +scenarios/project/roles/scenarios/files/scenario_36/groundtruth_v1.yaml yaml[line-length] # Legacy files which will eventually be removed or modified -scenarios/sre/project/generate_leaderboard_bundle_status.yaml yaml[line-length] -scenarios/sre/project/roles/leaderboard/tasks/main.yaml ignore-errors +scenarios/project/generate_leaderboard_bundle_status.yaml yaml[line-length] +scenarios/project/roles/leaderboard/tasks/main.yaml ignore-errors diff --git a/.claude/README.md b/.claude/README.md index 57596fb32..04a21e111 100644 --- a/.claude/README.md +++ b/.claude/README.md @@ -90,7 +90,7 @@ Then describe what you want to create: ```bash # 1. Start in the SRE scenarios directory -cd scenarios/sre +cd scenarios # 2. Scaffold a new fault make scaffold_fault @@ -210,16 +210,16 @@ The `settings.json` allows: - [Langfuse .claude structure](https://github.com/langfuse/langfuse/tree/main/.claude) - Original inspiration - [OpenCode.ai Skills Docs](https://opencode.ai/docs/skills/) - Official documentation -- [ITBench Developer Guide](../../scenarios/sre/DEVELOPER_GUIDE.md) - Project context -- [Faults Documentation](../../scenarios/sre/docs/faults.md) - Fault reference -- [Scenarios Documentation](../../scenarios/sre/docs/scenarios.md) - Scenario reference +- [ITBench Developer Guide](../../scenarios/DEVELOPER_GUIDE.md) - Project context +- [Faults Documentation](../../scenarios/docs/faults.md) - Fault reference +- [Scenarios Documentation](../../scenarios/docs/scenarios.md) - Scenario reference ## 🐛 Troubleshooting ### Skills Not Activating 1. Check `skill-rules.json` syntax: `jq . .claude/skills/skill-rules.json` -2. Verify file patterns match: `ls -la scenarios/sre/roles/documentation/files/library/faults/index.json` +2. Verify file patterns match: `ls -la scenarios/roles/documentation/files/library/faults/index.json` 3. Check hook is executable: `ls -la .claude/hooks/` 4. Review hook output: Check for skill suggestions in responses @@ -231,9 +231,9 @@ The `settings.json` allows: ### JSON Validation Errors -1. Validate faults index: `jq . scenarios/sre/roles/documentation/files/library/faults/index.json` -2. Validate scenarios index: `jq . scenarios/sre/roles/documentation/files/library/scenarios/index.json` -3. Run linter: `cd scenarios/sre && make lint` +1. Validate faults index: `jq . scenarios/roles/documentation/files/library/faults/index.json` +2. Validate scenarios index: `jq . scenarios/roles/documentation/files/library/scenarios/index.json` +3. Run linter: `cd scenarios && make lint` ## 💡 Tips diff --git a/.claude/agents/sre-scenario-creator.md b/.claude/agents/sre-scenario-creator.md index bcdf9f73e..62a70ee1e 100644 --- a/.claude/agents/sre-scenario-creator.md +++ b/.claude/agents/sre-scenario-creator.md @@ -35,13 +35,13 @@ Before creating new content, search existing implementations: ```bash # Find similar faults -grep -r "similar-keyword" scenarios/sre/roles/faults/tasks/ +grep -r "similar-keyword" scenarios/roles/faults/tasks/ # Review fault index -cat scenarios/sre/roles/documentation/files/library/faults/index.json | jq '.[] | select(.tags | contains(["keyword"]))' +cat scenarios/roles/documentation/files/library/faults/index.json | jq '.[] | select(.tags | contains(["keyword"]))' # Check scenario patterns -cat scenarios/sre/roles/documentation/files/library/scenarios/index.json | jq '.[] | select(.category == "sre")' +cat scenarios/roles/documentation/files/library/scenarios/index.json | jq '.[] | select(.category == "sre")' ``` Identify the closest existing fault as a reference template. @@ -51,7 +51,7 @@ Identify the closest existing fault as a reference template. If a new fault is needed: ```bash -cd scenarios/sre +cd scenarios make scaffold_fault ``` @@ -117,7 +117,7 @@ Reference similar injection tasks for patterns. ## Step 5: Scaffold the Scenario ```bash -cd scenarios/sre +cd scenarios make scaffold_scenario ``` @@ -178,7 +178,7 @@ Remove the scaffolding hint: 1. **Syntax check**: ```bash -cd scenarios/sre +cd scenarios make lint ``` @@ -243,7 +243,7 @@ Present results in stages: ## Fault Created: [Fault Name] **ID**: `fault-id` -**Location**: `scenarios/sre/roles/faults/tasks/inject_fault-id.yaml` +**Location**: `scenarios/roles/faults/tasks/inject_fault-id.yaml` **Summary**: - Arguments schema: ✅ Complete diff --git a/.claude/hooks/skill-activation-prompt.sh b/.claude/hooks/skill-activation-prompt.sh index 32a138cc3..c5aa5c592 100755 --- a/.claude/hooks/skill-activation-prompt.sh +++ b/.claude/hooks/skill-activation-prompt.sh @@ -28,7 +28,7 @@ check_file_pattern() { } # Check for fault-scaffolding activation -FAULT_INDEX="$CWD/scenarios/sre/roles/documentation/files/library/faults/index.json" +FAULT_INDEX="$CWD/scenarios/roles/documentation/files/library/faults/index.json" if [ -f "$FAULT_INDEX" ]; then # Check for TODO patterns in fault index if check_file_pattern "$FAULT_INDEX" '"alerts":\s*"TODO"' || \ @@ -40,7 +40,7 @@ if [ -f "$FAULT_INDEX" ]; then fi # Check for injection task TODOs -INJECTION_TASKS_DIR="$CWD/scenarios/sre/roles/faults/tasks" +INJECTION_TASKS_DIR="$CWD/scenarios/roles/faults/tasks" if [ -d "$INJECTION_TASKS_DIR" ]; then if find "$INJECTION_TASKS_DIR" -name "inject_*.yaml" -exec grep -q "# TODO: LLM-generated injection task" {} \; 2>/dev/null; then if [[ ! " ${ACTIVATED_SKILLS[@]} " =~ " fault-scaffolding " ]]; then @@ -50,7 +50,7 @@ if [ -d "$INJECTION_TASKS_DIR" ]; then fi # Check for scenario-scaffolding activation -SCENARIO_INDEX="$CWD/scenarios/sre/roles/documentation/files/library/scenarios/index.json" +SCENARIO_INDEX="$CWD/scenarios/roles/documentation/files/library/scenarios/index.json" if [ -f "$SCENARIO_INDEX" ]; then # Check for empty arrays or faultId hint if check_file_pattern "$SCENARIO_INDEX" '"faultId":' || \ diff --git a/.claude/skills/sre/fault-scaffolding/SKILL.md b/.claude/skills/sre/fault-scaffolding/SKILL.md index 563b72373..c6df8dece 100644 --- a/.claude/skills/sre/fault-scaffolding/SKILL.md +++ b/.claude/skills/sre/fault-scaffolding/SKILL.md @@ -44,17 +44,17 @@ If NO TODOs exist → Create new fault scaffolding (Steps 1-3). 1. **Search fault index by keywords:** ```bash jq '.[] | select(.name | test("(?i)configmap|image|network|memory"))' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json ``` 2. **List all fault injection tasks:** ```bash - ls scenarios/sre/roles/faults/tasks/inject_*.yaml + ls scenarios/roles/faults/tasks/inject_*.yaml ``` 3. **Search fault tasks by pattern:** ```bash - grep -r "ConfigMap\|Image\|NetworkPolicy" scenarios/sre/roles/faults/tasks/ + grep -r "ConfigMap\|Image\|NetworkPolicy" scenarios/roles/faults/tasks/ ``` **If similar fault exists:** @@ -98,7 +98,7 @@ Gather required information (similar to `scaffolding/tasks/collect_fault_inputs. 4. **Tags** - Read available tags from schema file: ```bash jq '.properties.tags.items.enum' \ - scenarios/sre/roles/documentation/files/library/faults/schema.json + scenarios/roles/documentation/files/library/faults/schema.json ``` Choose the most appropriate tag(s) for the fault mechanism. @@ -113,18 +113,18 @@ Gather required information (similar to `scaffolding/tasks/collect_fault_inputs. **First, read the fault schema to understand required fields:** ```bash -cat scenarios/sre/roles/documentation/files/library/faults/schema.json +cat scenarios/roles/documentation/files/library/faults/schema.json ``` -**File 1**: `scenarios/sre/roles/documentation/files/library/faults/index.json` +**File 1**: `scenarios/roles/documentation/files/library/faults/index.json` Add new fault entry with fields from schema: ```bash # Check required fields -jq '.required' scenarios/sre/roles/documentation/files/library/faults/schema.json +jq '.required' scenarios/roles/documentation/files/library/faults/schema.json # Check properties structure -jq '.properties | keys' scenarios/sre/roles/documentation/files/library/faults/schema.json +jq '.properties | keys' scenarios/roles/documentation/files/library/faults/schema.json ``` Create entry matching the schema (required fields: arguments, description, expectation, name, platform, resources, solutions, tags): @@ -143,7 +143,7 @@ Create entry matching the schema (required fields: arguments, description, expec } ``` -**File 2**: `scenarios/sre/roles/faults/tasks/inject_.yaml` +**File 2**: `scenarios/roles/faults/tasks/inject_.yaml` **IMPORTANT**: File naming convention uses **underscores only** (e.g., `inject_my_fault_name.yaml`), not hyphens. @@ -178,20 +178,20 @@ Next steps: **Read available applications dynamically from:** ```bash -cat scenarios/sre/roles/applications/defaults/main/managers.yaml +cat scenarios/roles/applications/defaults/main/managers.yaml ``` **Extract application details:** ```bash # List all application keys -grep -E "^ [a-z_]+:" scenarios/sre/roles/applications/defaults/main/managers.yaml | sed 's/://g' | awk '{print $1}' +grep -E "^ [a-z_]+:" scenarios/roles/applications/defaults/main/managers.yaml | sed 's/://g' | awk '{print $1}' # For each application key, get full configuration # Replace with the actual application key from the list above -grep -A 15 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml +grep -A 15 "^ :" scenarios/roles/applications/defaults/main/managers.yaml # Extract specific fields for an application -grep -A 15 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml | grep -E "namespace:|url:|documentation:" +grep -A 15 "^ :" scenarios/roles/applications/defaults/main/managers.yaml | grep -E "namespace:|url:|documentation:" ``` **For each application found, dynamically extract:** @@ -217,22 +217,22 @@ grep -A 15 "^ :" scenarios/sre/roles/applications/defaults/main/manage ### 3.1 List all available applications ```bash # Extract application keys from managers.yaml -grep -E "^ [a-z_]+:" scenarios/sre/roles/applications/defaults/main/managers.yaml | sed 's/://g' | awk '{print $1}' +grep -E "^ [a-z_]+:" scenarios/roles/applications/defaults/main/managers.yaml | sed 's/://g' | awk '{print $1}' ``` ### 3.2 Get application configuration ```bash # Replace with the chosen application key from step 3.1 -grep -A 20 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml +grep -A 20 "^ :" scenarios/roles/applications/defaults/main/managers.yaml ``` ### 3.3 Extract metadata ```bash # Get documentation URL -grep -A 20 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml | grep -E "url:|documentation:" | head -1 +grep -A 20 "^ :" scenarios/roles/applications/defaults/main/managers.yaml | grep -E "url:|documentation:" | head -1 # Get namespace -grep -A 20 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml | grep "namespace:" | head -1 +grep -A 20 "^ :" scenarios/roles/applications/defaults/main/managers.yaml | grep "namespace:" | head -1 ``` ### 3.4 Fetch service architecture from documentation (REQUIRED) @@ -267,7 +267,7 @@ Using the documentation URL from step 3.3: export KUBECONFIG= # Navigate to scenarios directory - cd scenarios/sre + cd scenarios # Deploy tools - outputs will be displayed make deploy-tools @@ -317,7 +317,7 @@ Using the documentation URL from step 3.3: Create the injection task file following patterns from existing faults. ### File Location -`scenarios/sre/roles/faults/tasks/inject_.yaml` +`scenarios/roles/faults/tasks/inject_.yaml` ### Important Guidelines @@ -380,58 +380,58 @@ Create the injection task file following patterns from existing faults. #### Step 1: List All Existing Fault Injection Tasks ```bash -ls scenarios/sre/roles/faults/tasks/inject_*.yaml | sort +ls scenarios/roles/faults/tasks/inject_*.yaml | sort ``` #### Step 2: Search by Fault Category/Pattern **Find Image-Related Faults:** ```bash -ls scenarios/sre/roles/faults/tasks/inject_*image*.yaml -grep -l "image:" scenarios/sre/roles/faults/tasks/inject_*.yaml +ls scenarios/roles/faults/tasks/inject_*image*.yaml +grep -l "image:" scenarios/roles/faults/tasks/inject_*.yaml ``` **Find Configuration/ConfigMap Faults:** ```bash -ls scenarios/sre/roles/faults/tasks/inject_*config*.yaml -grep -l "ConfigMap\|environment" scenarios/sre/roles/faults/tasks/inject_*.yaml +ls scenarios/roles/faults/tasks/inject_*config*.yaml +grep -l "ConfigMap\|environment" scenarios/roles/faults/tasks/inject_*.yaml ``` **Find Resource Faults:** ```bash -ls scenarios/sre/roles/faults/tasks/inject_*resource*.yaml -grep -l "ResourceQuota\|limits\|requests" scenarios/sre/roles/faults/tasks/inject_*.yaml +ls scenarios/roles/faults/tasks/inject_*resource*.yaml +grep -l "ResourceQuota\|limits\|requests" scenarios/roles/faults/tasks/inject_*.yaml ``` **Find Network Faults:** ```bash -ls scenarios/sre/roles/faults/tasks/inject_*network*.yaml -grep -l "NetworkPolicy" scenarios/sre/roles/faults/tasks/inject_*.yaml +ls scenarios/roles/faults/tasks/inject_*network*.yaml +grep -l "NetworkPolicy" scenarios/roles/faults/tasks/inject_*.yaml ``` **Find Chaos Mesh Faults:** ```bash -ls scenarios/sre/roles/faults/tasks/inject_*chaos*.yaml -grep -l "chaos-mesh.org" scenarios/sre/roles/faults/tasks/inject_*.yaml +ls scenarios/roles/faults/tasks/inject_*chaos*.yaml +grep -l "chaos-mesh.org" scenarios/roles/faults/tasks/inject_*.yaml ``` #### Step 3: Read and Study Relevant Fault Files ```bash # Read a specific fault to understand its pattern -cat scenarios/sre/roles/faults/tasks/inject_.yaml +cat scenarios/roles/faults/tasks/inject_.yaml # Search for specific Kubernetes resources in faults -grep -r "kind: Deployment" scenarios/sre/roles/faults/tasks/ -grep -r "kind: ConfigMap" scenarios/sre/roles/faults/tasks/ -grep -r "kind: NetworkPolicy" scenarios/sre/roles/faults/tasks/ +grep -r "kind: Deployment" scenarios/roles/faults/tasks/ +grep -r "kind: ConfigMap" scenarios/roles/faults/tasks/ +grep -r "kind: NetworkPolicy" scenarios/roles/faults/tasks/ ``` #### Step 4: Find Faults by Tag ```bash # Search faults index by tag -jq '.[] | select(.tags[] | contains("Networking"))' scenarios/sre/roles/documentation/files/library/faults/index.json -jq '.[] | select(.tags[] | contains("Performance"))' scenarios/sre/roles/documentation/files/library/faults/index.json -jq '.[] | select(.tags[] | contains("Deployment"))' scenarios/sre/roles/documentation/files/library/faults/index.json +jq '.[] | select(.tags[] | contains("Networking"))' scenarios/roles/documentation/files/library/faults/index.json +jq '.[] | select(.tags[] | contains("Performance"))' scenarios/roles/documentation/files/library/faults/index.json +jq '.[] | select(.tags[] | contains("Deployment"))' scenarios/roles/documentation/files/library/faults/index.json ``` #### Step 5: Match Fault Mechanism to Incident @@ -453,17 +453,17 @@ Based on your incident analysis (Step 1), identify which existing faults have si ## Completing the Fault Index - Dynamic Discovery After implementing the Ansible task, complete the fault entry in: -**File**: `scenarios/sre/roles/documentation/files/library/faults/index.json` +**File**: `scenarios/roles/documentation/files/library/faults/index.json` ### Step 1: Verify Required Fields from Schema ```bash # Check required fields -jq '.required' scenarios/sre/roles/documentation/files/library/faults/schema.json +jq '.required' scenarios/roles/documentation/files/library/faults/schema.json # Check all property names and types jq '.properties | to_entries[] | {key: .key, type: .value.type, required: .value.required}' \ - scenarios/sre/roles/documentation/files/library/faults/schema.json + scenarios/roles/documentation/files/library/faults/schema.json ``` ### Step 2: Discover Argument Schema Patterns from Existing Faults @@ -472,30 +472,30 @@ jq '.properties | to_entries[] | {key: .key, type: .value.type, required: .value ```bash # Find faults with similar argument structures jq '.[] | select(.arguments.jsonSchema.required[]? | contains("kubernetesObject")) | {id, required: .arguments.jsonSchema.required}' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # View specific fault's argument schema jq '.[] | select(.id == "") | .arguments' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # Find all unique argument patterns jq '[.[] | .arguments.jsonSchema.required] | unique' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json ``` **Common patterns discovered:** ```bash # Workload-only pattern jq '.[] | select(.arguments.jsonSchema.required == ["kubernetesObject"]) | .id' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # Workload + container pattern jq '.[] | select(.arguments.jsonSchema.required | contains(["kubernetesObject", "container"])) | .id' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # Custom patterns jq '.[] | select(.arguments.jsonSchema.required | length > 2) | {id, required: .arguments.jsonSchema.required}' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json ``` ### Step 3: Discover Alert Types Dynamically @@ -504,22 +504,22 @@ jq '.[] | select(.arguments.jsonSchema.required | length > 2) | {id, required: . ```bash # Application alerts enum jq '.properties.alerts.properties.application.items.enum' \ - scenarios/sre/roles/documentation/files/library/faults/schema.json + scenarios/roles/documentation/files/library/faults/schema.json # Golden signal alerts enum jq '.properties.alerts.properties.goldenSignal.items.enum' \ - scenarios/sre/roles/documentation/files/library/faults/schema.json + scenarios/roles/documentation/files/library/faults/schema.json ``` **Find which faults use which alerts:** ```bash # Find faults with specific alert jq '.[] | select(.alerts.application[]? == "KubePodCrashLooping") | .id' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # See all alert combinations jq '[.[] | .alerts] | unique' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json ``` ### Step 3.1: Registering New Alerts @@ -528,22 +528,22 @@ jq '[.[] | .alerts] | unique' \ 1. **Fault Schema** - Add to alert enum: ```bash - # Edit: scenarios/sre/roles/documentation/files/library/faults/schema.json + # Edit: scenarios/roles/documentation/files/library/faults/schema.json # Add to: .properties.alerts.properties.application.items.enum ``` 2. **Alerts Monitoring Playbook** - Add to alert detection (3 locations): ```bash - # Edit: scenarios/sre/playbooks/check_for_specific_alerts_in_firing_state.yaml + # Edit: scenarios/playbooks/check_for_specific_alerts_in_firing_state.yaml # Add to ALL THREE alert lists (lines ~58-70, ~79-89, ~101-110) ``` 3. **PrometheusRules Template** - Define the actual alert rule: ```bash # For OpenTelemetry Demo: - # scenarios/sre/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 + # scenarios/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 # For BookInfo: - # scenarios/sre/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 + # scenarios/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 ``` **Example**: For `KafkaConsumerGroupInactive` alert, you would: @@ -559,15 +559,15 @@ jq '[.[] | .alerts] | unique' \ ```bash # Find faults with rollback solutions jq '.[] | select(.solutions.templates[].steps[].command? | contains("rollout undo")) | .id' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # View specific fault's solutions jq '.[] | select(.id == "") | .solutions' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # Find all unique solution patterns jq '[.[] | .solutions.templates[].steps[].command] | unique' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json ``` ### Step 5: Use Similar Fault as Template @@ -576,11 +576,11 @@ jq '[.[] | .solutions.templates[].steps[].command] | unique' \ ```bash # 1. Find the most similar fault by searching for keywords jq '.[] | select(.name | contains("ConfigMap") or contains("Image")) | {id, name}' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json # 2. Extract full entry as template jq '.[] | select(.id == "")' \ - scenarios/sre/roles/documentation/files/library/faults/index.json > /tmp/template.json + scenarios/roles/documentation/files/library/faults/index.json > /tmp/template.json # 3. Modify the template for your new fault # 4. Validate against schema before adding @@ -593,33 +593,33 @@ jq '.[] | select(.id == "")' \ **Discover simple faults** (good starting points): ```bash # Find short/simple fault files (likely easier to understand) -find scenarios/sre/roles/faults/tasks -name "inject_*.yaml" -exec wc -l {} \; | sort -n | head -10 +find scenarios/roles/faults/tasks -name "inject_*.yaml" -exec wc -l {} \; | sort -n | head -10 # Search for specific patterns -ls scenarios/sre/roles/faults/tasks/inject_*image*.yaml -ls scenarios/sre/roles/faults/tasks/inject_*environment*.yaml -ls scenarios/sre/roles/faults/tasks/inject_*node*.yaml +ls scenarios/roles/faults/tasks/inject_*image*.yaml +ls scenarios/roles/faults/tasks/inject_*environment*.yaml +ls scenarios/roles/faults/tasks/inject_*node*.yaml ``` **Discover complex faults** (advanced patterns): ```bash # Find longer fault files (likely more complex) -find scenarios/sre/roles/faults/tasks -name "inject_*.yaml" -exec wc -l {} \; | sort -n | tail -10 +find scenarios/roles/faults/tasks -name "inject_*.yaml" -exec wc -l {} \; | sort -n | tail -10 # Search for multi-resource faults -grep -l "kubernetes.core.k8s:" scenarios/sre/roles/faults/tasks/inject_*.yaml | xargs grep -c "kubernetes.core.k8s:" | grep -v ":1$" +grep -l "kubernetes.core.k8s:" scenarios/roles/faults/tasks/inject_*.yaml | xargs grep -c "kubernetes.core.k8s:" | grep -v ":1$" # Find Chaos Mesh integration -grep -l "chaos-mesh.org" scenarios/sre/roles/faults/tasks/inject_*.yaml +grep -l "chaos-mesh.org" scenarios/roles/faults/tasks/inject_*.yaml # Find node-level operations -grep -l "node\|cordon\|drain" scenarios/sre/roles/faults/tasks/inject_*.yaml +grep -l "node\|cordon\|drain" scenarios/roles/faults/tasks/inject_*.yaml ``` **Study faults by complexity:** ```bash # Count steps in each fault to gauge complexity -for file in scenarios/sre/roles/faults/tasks/inject_*.yaml; do +for file in scenarios/roles/faults/tasks/inject_*.yaml; do echo "$(grep -c "^- name:" "$file") steps: $(basename "$file")" done | sort -n ``` diff --git a/.claude/skills/sre/scenario-scaffolding/SKILL.md b/.claude/skills/sre/scenario-scaffolding/SKILL.md index 9d57d18fa..292940079 100644 --- a/.claude/skills/sre/scenario-scaffolding/SKILL.md +++ b/.claude/skills/sre/scenario-scaffolding/SKILL.md @@ -36,7 +36,7 @@ Before starting scenario scaffolding: ### 1.1 List Available Applications ```bash # Extract all application keys from managers.yaml -grep -E "^ [a-z_]+:" scenarios/sre/roles/applications/defaults/main/managers.yaml | sed 's/://g' | awk '{print $1}' +grep -E "^ [a-z_]+:" scenarios/roles/applications/defaults/main/managers.yaml | sed 's/://g' | awk '{print $1}' ``` **Application Preference:** @@ -47,10 +47,10 @@ grep -E "^ [a-z_]+:" scenarios/sre/roles/applications/defaults/main/managers.ya ```bash # Replace with your chosen application # Get namespace -grep -A 15 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml | grep "namespace:" | awk '{print $2}' +grep -A 15 "^ :" scenarios/roles/applications/defaults/main/managers.yaml | grep "namespace:" | awk '{print $2}' # Get documentation URL -grep -A 15 "^ :" scenarios/sre/roles/applications/defaults/main/managers.yaml | grep -E "url:|documentation:" +grep -A 15 "^ :" scenarios/roles/applications/defaults/main/managers.yaml | grep -E "url:|documentation:" ``` ### 1.3 Discover Services from Manifests @@ -59,13 +59,13 @@ grep -A 15 "^ :" scenarios/sre/roles/applications/defaults/main/manage NAMESPACE="" # Find all Deployments in the application -grep -r "kind: Deployment" scenarios/sre/roles/applications/templates/kubernetes/ | grep "$NAMESPACE" | grep -oP 'name: \K[a-z0-9-]+' +grep -r "kind: Deployment" scenarios/roles/applications/templates/kubernetes/ | grep "$NAMESPACE" | grep -oP 'name: \K[a-z0-9-]+' # Find all Services -grep -r "kind: Service" scenarios/sre/roles/applications/templates/kubernetes/ | grep "$NAMESPACE" | grep -oP 'name: \K[a-z0-9-]+' +grep -r "kind: Service" scenarios/roles/applications/templates/kubernetes/ | grep "$NAMESPACE" | grep -oP 'name: \K[a-z0-9-]+' # Find all StatefulSets -grep -r "kind: StatefulSet" scenarios/sre/roles/applications/templates/kubernetes/ | grep "$NAMESPACE" | grep -oP 'name: \K[a-z0-9-]+' +grep -r "kind: StatefulSet" scenarios/roles/applications/templates/kubernetes/ | grep "$NAMESPACE" | grep -oP 'name: \K[a-z0-9-]+' ``` ### 1.3.1 Optional: Ground in Real Deployment @@ -86,7 +86,7 @@ grep -r "kind: StatefulSet" scenarios/sre/roles/applications/templates/kubernete export KUBECONFIG= # Navigate to scenarios directory - cd scenarios/sre + cd scenarios # Deploy tools - outputs will be displayed make deploy-tools @@ -134,24 +134,24 @@ Consult the documentation URL from step 1.2 to understand: ## Step 2: Populate Scenario Files -The scenario consists of multiple files in `scenarios/sre/roles/scenarios/files/scenario_/`: +The scenario consists of multiple files in `scenarios/roles/scenarios/files/scenario_/`: ### 2.1 Scenario Index Entry -**File**: `scenarios/sre/roles/documentation/files/library/scenarios/index.json` +**File**: `scenarios/roles/documentation/files/library/scenarios/index.json` **Structure** (discovered dynamically): First, get available tags and platforms: ```bash # Get valid tags -jq '.properties.tags.items.enum' scenarios/sre/roles/documentation/files/library/faults/schema.json +jq '.properties.tags.items.enum' scenarios/roles/documentation/files/library/faults/schema.json # Get valid platforms -jq '.properties.platforms.items.enum' scenarios/sre/roles/documentation/files/library/faults/schema.json +jq '.properties.platforms.items.enum' scenarios/roles/documentation/files/library/faults/schema.json # Get valid categories -jq '.properties.category.enum' scenarios/sre/roles/documentation/files/library/scenarios/schema.json +jq '.properties.category.enum' scenarios/roles/documentation/files/library/scenarios/schema.json ``` Then construct the scenario entry: @@ -227,12 +227,12 @@ Then construct the scenario entry: # Find scenarios using your chosen fault FAULT_ID="" jq --arg fault "$FAULT_ID" '.[] | select(.disruptions[].injections[].id == $fault) | {id, disruptions}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json + scenarios/roles/documentation/files/library/scenarios/index.json # Examine a specific scenario's disruptions SCENARIO_ID="" jq --arg id "$SCENARIO_ID" '.[] | select(.id == ($id | tonumber)) | .disruptions' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json + scenarios/roles/documentation/files/library/scenarios/index.json ``` **Single Fault Injection** (template): @@ -299,7 +299,7 @@ jq --arg id "$SCENARIO_ID" '.[] | select(.id == ($id | tonumber)) | .disruptions ```bash # Find scenarios using waitFor patterns jq '.[] | select(.disruptions[].waitFor != null) | {id, disruptions}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json | head -50 + scenarios/roles/documentation/files/library/scenarios/index.json | head -50 ``` ### 2.3 waitFor Patterns @@ -320,7 +320,7 @@ jq '.[] | select(.disruptions[].waitFor != null) | {id, disruptions}' \ # Get solutions from the fault entry FAULT_ID="" jq --arg fault "$FAULT_ID" '.[] | select(.id == $fault) | .solutions' \ - scenarios/sre/roles/documentation/files/library/faults/index.json + scenarios/roles/documentation/files/library/faults/index.json ``` Adapt fault solutions to scenario context (replace Jinja2 templates with actual values): @@ -357,12 +357,12 @@ Adapt fault solutions to scenario context (replace Jinja2 templates with actual ```bash # Find scenarios with multi-step solutions jq '.[] | select(.solutions[][].steps | length > 1) | {id, solutions}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json | head -100 + scenarios/roles/documentation/files/library/scenarios/index.json | head -100 ``` ### 2.5 Determine Required Tools -Based on disruptions, identify tools needed (captured by scaffolding from `scenarios/sre/roles/scaffolding/tasks/generate_new_scenario_files.yaml`): +Based on disruptions, identify tools needed (captured by scaffolding from `scenarios/roles/scaffolding/tasks/generate_new_scenario_files.yaml`): **Chaos Mesh Detection**: ```yaml @@ -386,7 +386,7 @@ Scenarios require **two ground truth files** in different formats: ### 3.0 Create groundtruth.yaml (v2 API) -**File**: `scenarios/sre/roles/scenarios/files/scenario_/groundtruth.yaml` +**File**: `scenarios/roles/scenarios/files/scenario_/groundtruth.yaml` This is a **simplified format** that focuses on affected entities and solutions. @@ -421,10 +421,10 @@ spec: **Example** (find real examples dynamically): ```bash # View an existing groundtruth.yaml for reference -cat scenarios/sre/roles/scenarios/files/scenario_20/groundtruth.yaml +cat scenarios/roles/scenarios/files/scenario_20/groundtruth.yaml # Or examine multiple scenarios -ls scenarios/sre/roles/scenarios/files/scenario_*/groundtruth.yaml | head -5 | xargs -I {} sh -c 'echo "=== {} ===" && cat {}' +ls scenarios/roles/scenarios/files/scenario_*/groundtruth.yaml | head -5 | xargs -I {} sh -c 'echo "=== {} ===" && cat {}' ``` **Template**: @@ -460,7 +460,7 @@ spec: ### 3.1 Create groundtruth_v1.yaml (v1 API - DSL Format) -**File**: `scenarios/sre/roles/scenarios/files/scenario_/groundtruth_v1.yaml` +**File**: `scenarios/roles/scenarios/files/scenario_/groundtruth_v1.yaml` Ground truth uses **DSL format (groups)** to define fault propagation chains. @@ -535,10 +535,10 @@ spec: **Discover group patterns from existing scenarios:** ```bash # View groups from a specific scenario -cat scenarios/sre/roles/scenarios/files/scenario_/groundtruth_v1.yaml | grep -A 10 "^ groups:" +cat scenarios/roles/scenarios/files/scenario_/groundtruth_v1.yaml | grep -A 10 "^ groups:" # Find scenarios with ConfigMap root causes -grep -r "kind: ConfigMap" scenarios/sre/roles/scenarios/files/*/groundtruth_v1.yaml +grep -r "kind: ConfigMap" scenarios/roles/scenarios/files/*/groundtruth_v1.yaml ``` **Pod group with filter** (template): @@ -584,7 +584,7 @@ aliases: **Discover alias patterns:** ```bash # Find scenarios with aliases -grep -A 5 "^ aliases:" scenarios/sre/roles/scenarios/files/*/groundtruth_v1.yaml | head -20 +grep -A 5 "^ aliases:" scenarios/roles/scenarios/files/*/groundtruth_v1.yaml | head -20 ``` **Template**: @@ -614,7 +614,7 @@ aliases: **Discover propagation patterns:** ```bash # Find propagation examples -grep -A 10 "^ propagations:" scenarios/sre/roles/scenarios/files/*/groundtruth_v1.yaml | head -50 +grep -A 10 "^ propagations:" scenarios/roles/scenarios/files/*/groundtruth_v1.yaml | head -50 ``` **Template**: @@ -645,12 +645,12 @@ propagations: **OpenTelemetry Demo:** ```bash - cat scenarios/sre/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 + cat scenarios/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 ``` **BookInfo:** ```bash - cat scenarios/sre/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 + cat scenarios/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 ``` 2. **Kubernetes Platform Alerts** - Check: @@ -658,7 +658,7 @@ propagations: a. **Local schema** (available alerts in ITBench): ```bash jq '.properties.alerts.properties.application.items.enum' \ - scenarios/sre/roles/documentation/files/library/faults/schema.json + scenarios/roles/documentation/files/library/faults/schema.json ``` b. **Prometheus Community Rules** (canonical source): @@ -688,12 +688,12 @@ alerts: **View real examples dynamically:** ```bash # View a complete groundtruth_v1.yaml file -cat scenarios/sre/roles/scenarios/files/scenario_20/groundtruth_v1.yaml +cat scenarios/roles/scenarios/files/scenario_20/groundtruth_v1.yaml # Compare multiple scenarios for patterns for scenario in 20 30 40; do echo "=== Scenario $scenario ===" - cat "scenarios/sre/roles/scenarios/files/scenario_${scenario}/groundtruth_v1.yaml" 2>/dev/null || echo "Not found" + cat "scenarios/roles/scenarios/files/scenario_${scenario}/groundtruth_v1.yaml" 2>/dev/null || echo "Not found" echo "" done ``` @@ -776,7 +776,7 @@ spec: After creating both files manually, validate with: ```bash -cd scenarios/sre +cd scenarios make regenerate-scenario-files ``` @@ -795,13 +795,13 @@ This validates and generates: # Get all scenarios for a specific application APP_ID="opentelemetry-demo" # Prefer opentelemetry-demo over book-info jq --arg app "$APP_ID" '.[] | select(.environment.applications[].id == $app) | {id, description}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json + scenarios/roles/documentation/files/library/scenarios/index.json # Analyze groundtruth patterns for that application for scenario_id in $(jq --arg app "$APP_ID" '.[] | select(.environment.applications[].id == $app) | .id' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json); do + scenarios/roles/documentation/files/library/scenarios/index.json); do echo "=== Scenario $scenario_id ===" - cat "scenarios/sre/roles/scenarios/files/scenario_${scenario_id}/groundtruth_v1.yaml" | grep -E "^ (groups|propagations):" -A 20 + cat "scenarios/roles/scenarios/files/scenario_${scenario_id}/groundtruth_v1.yaml" | grep -E "^ (groups|propagations):" -A 20 done ``` @@ -810,10 +810,10 @@ done **Find typical propagation chains:** ```bash # Find Pod → Service propagations -grep -A 4 "source:.*pod" scenarios/sre/roles/scenarios/files/*/groundtruth_v1.yaml | grep "target:" | head -10 +grep -A 4 "source:.*pod" scenarios/roles/scenarios/files/*/groundtruth_v1.yaml | grep "target:" | head -10 # Find Service → Service propagations -grep -A 4 "source:.*service" scenarios/sre/roles/scenarios/files/*/groundtruth_v1.yaml | grep "target:" | head -10 +grep -A 4 "source:.*service" scenarios/roles/scenarios/files/*/groundtruth_v1.yaml | grep "target:" | head -10 ``` **Generic propagation chain template:** @@ -826,7 +826,7 @@ grep -A 4 "source:.*service" scenarios/sre/roles/scenarios/files/*/groundtruth_v **Discover ConfigMap scenarios:** ```bash # Find scenarios with ConfigMap root causes -grep -r "kind: ConfigMap" scenarios/sre/roles/scenarios/files/*/groundtruth_v1.yaml -l | \ +grep -r "kind: ConfigMap" scenarios/roles/scenarios/files/*/groundtruth_v1.yaml -l | \ xargs -I {} sh -c 'echo "=== {} ===" && cat {} | head -50' ``` @@ -879,27 +879,27 @@ propagations: ```bash # Find simple scenarios (low complexity) jq '.[] | select(.complexity == "low") | {id, description, faults: [.disruptions[].injections[].id]}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json | head -50 + scenarios/roles/documentation/files/library/scenarios/index.json | head -50 # Find complex scenarios (high complexity) jq '.[] | select(.complexity == "high") | {id, description, faults: [.disruptions[].injections[].id]}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json | head -50 + scenarios/roles/documentation/files/library/scenarios/index.json | head -50 # Find scenarios using specific fault mechanisms FAULT_ID="" jq --arg fault "$FAULT_ID" '.[] | select(.disruptions[].injections[].id == $fault) | {id, description}' \ - scenarios/sre/roles/documentation/files/library/scenarios/index.json + scenarios/roles/documentation/files/library/scenarios/index.json ``` **View groundtruth files for reference:** ```bash # List all available groundtruth files -ls scenarios/sre/roles/scenarios/files/scenario_*/groundtruth_v1.yaml | sort -V +ls scenarios/roles/scenarios/files/scenario_*/groundtruth_v1.yaml | sort -V # View specific scenarios -cat scenarios/sre/roles/scenarios/files/scenario_1/groundtruth_v1.yaml # Feature flag pattern -cat scenarios/sre/roles/scenarios/files/scenario_20/groundtruth_v1.yaml # Image pull error -cat scenarios/sre/roles/scenarios/files/scenario_40/groundtruth_v1.yaml # Code change pattern +cat scenarios/roles/scenarios/files/scenario_1/groundtruth_v1.yaml # Feature flag pattern +cat scenarios/roles/scenarios/files/scenario_20/groundtruth_v1.yaml # Image pull error +cat scenarios/roles/scenarios/files/scenario_40/groundtruth_v1.yaml # Code change pattern ``` # Tips diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index c82eedc7c..d2ee1366f 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,4 +1 @@ -scenarios/ @Red-GV @yana1205 -scenarios/ciso/ @yana1205 @yuji-watanabe-jp -scenarios/sre/ @Red-GV @rohanarora -scenarios/finops/ @Red-GV @oguzhan78 +scenarios/ @Red-GV @yana1205 @rohanarora @oguzhan78 diff --git a/.github/workflows/run-e2e-tests.yaml b/.github/workflows/run-e2e-tests.yaml index 4d894f91f..755b8f2c1 100644 --- a/.github/workflows/run-e2e-tests.yaml +++ b/.github/workflows/run-e2e-tests.yaml @@ -6,18 +6,18 @@ on: - main paths: - clusters/kind/go.* - - scenarios/sre/project/roles/applications/tasks/install_*.yaml - - scenarios/sre/project/roles/cluster/vars/main/minimum_versions.yaml - - scenarios/sre/project/roles/executables/vars/main/minimum_versions.yaml - - scenarios/sre/project/roles/recorders/tasks/copy_python_recorder_files.yaml - - scenarios/sre/project/roles/recorders/tasks/deploy_python_recorder.yaml - - scenarios/sre/project/roles/tools/tasks/install_*.yaml - - scenarios/sre/project/manage_applications.yaml - - scenarios/sre/project/manage_faults.yaml - - scenarios/sre/project/manage_recorders.yaml - - scenarios/sre/project/manage_tools.yaml - - scenarios/sre/scripts/inject_scenario_faults.py - - scenarios/sre/Makefile + - scenarios/project/roles/applications/tasks/install_*.yaml + - scenarios/project/roles/cluster/vars/main/minimum_versions.yaml + - scenarios/project/roles/executables/vars/main/minimum_versions.yaml + - scenarios/project/roles/recorders/tasks/copy_python_recorder_files.yaml + - scenarios/project/roles/recorders/tasks/deploy_python_recorder.yaml + - scenarios/project/roles/tools/tasks/install_*.yaml + - scenarios/project/manage_applications.yaml + - scenarios/project/manage_faults.yaml + - scenarios/project/manage_recorders.yaml + - scenarios/project/manage_tools.yaml + - scenarios/scripts/inject_scenario_faults.py + - scenarios/Makefile - pyproject.toml - requirements.yaml @@ -52,15 +52,15 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Start FinOps Scenario 37 # Due to resources, skip deploying recorders run: | - SCENARIO_NUMBER=37 make -C scenarios/sre create-environment - SCENARIO_NUMBER=37 make -C scenarios/sre inject-scenario-faults + SCENARIO_NUMBER=37 make -C scenarios create-environment + SCENARIO_NUMBER=37 make -C scenarios inject-scenario-faults - name: Stop FinOps Scenario 37 run: | - SCENARIO_NUMBER=37 make -C scenarios/sre remove-fault-resources - SCENARIO_NUMBER=37 make -C scenarios/sre destroy-environment + SCENARIO_NUMBER=37 make -C scenarios remove-fault-resources + SCENARIO_NUMBER=37 make -C scenarios destroy-environment - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster @@ -90,13 +90,13 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Start SRE Scenario 60 run: | - SCENARIO_NUMBER=60 make -C scenarios/sre start-scenario + SCENARIO_NUMBER=60 make -C scenarios start-scenario - name: Stop SRE Scenario 60 run: | - SCENARIO_NUMBER=60 make -C scenarios/sre stop-scenario + SCENARIO_NUMBER=60 make -C scenarios stop-scenario - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster diff --git a/.github/workflows/run-molecule-tests.yaml b/.github/workflows/run-molecule-tests.yaml index 58fc3cd47..5a9e1182a 100644 --- a/.github/workflows/run-molecule-tests.yaml +++ b/.github/workflows/run-molecule-tests.yaml @@ -7,15 +7,16 @@ on: paths: - clusters/kind/** - clusters/minikube/** - - scenarios/sre/project/roles/agent/** - - scenarios/sre/project/roles/awx/** - - scenarios/sre/project/roles/faults/** - - scenarios/sre/project/roles/waiters/** + - scenarios/project/roles/agent/** + - scenarios/project/roles/awx/** + - scenarios/project/roles/faults/** + - scenarios/project/roles/virtual_machine/** + - scenarios/project/roles/waiters/** - '!clusters/kind/README.md' - '!clusters/minikube/README.md' - - '!scenarios/sre/project/roles/awx/tasks/generate_files.yaml' - - '!scenarios/sre/project/roles/faults/tasks/generate_files.yaml' - - '!scenarios/sre/project/roles/waiters/tasks/generate_files.yaml' + - '!scenarios/project/roles/awx/tasks/generate_files.yaml' + - '!scenarios/project/roles/faults/tasks/generate_files.yaml' + - '!scenarios/project/roles/waiters/tasks/generate_files.yaml' concurrency: group: ci-molecule-${{ github.ref }} @@ -50,7 +51,7 @@ jobs: - name: Run Molecule tests run: | make -C clusters/kind test-molecule - - name: Destroy Minikube cluster + - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster clusters-minikube: @@ -89,8 +90,8 @@ jobs: - name: Destroy Minikube cluster run: | make -C clusters/minikube destroy-simple-cluster - sre-agent: - name: SRE Agent Access Tests + agent: + name: Agent Access Tests runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v7.0.1 @@ -106,18 +107,18 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Create Kind cluster run: | make -C clusters/kind create-simple-cluster - name: Run Molecule tests run: | - make -C scenarios/sre test-molecule-agent + make -C scenarios test-molecule-agent - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster - sre-awx: - name: SRE AWX Tests + awx: + name: AWX Tests runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v7.0.1 @@ -136,7 +137,7 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Create Kind cluster run: | make -C clusters/kind create-simple-cluster @@ -146,12 +147,12 @@ jobs: sleep 10 - name: Run Molecule tests run: | - make -C scenarios/sre test-molecule-awx + make -C scenarios test-molecule-awx - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster - sre-faults: - name: SRE Fault Injection Tests + faults: + name: Fault Injection Tests runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v7.0.1 @@ -167,7 +168,7 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Create Kind cluster run: | make -C clusters/kind create-simple-cluster @@ -177,12 +178,12 @@ jobs: sleep 10 - name: Run Molecule tests run: | - make -C scenarios/sre test-molecule-faults + make -C scenarios test-molecule-faults - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster - sre-waiters: - name: SRE Waiters Tests + waiters: + name: Waiters Tests runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v7.0.1 @@ -198,13 +199,28 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Create Kind cluster run: | make -C clusters/kind create-simple-cluster - name: Run Molecule tests run: | - make -C scenarios/sre test-molecule-waiters + make -C scenarios test-molecule-waiters - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster + virtual-machine: + name: Virtual Machine Tests + runs-on: ubuntu-24.04 + steps: + - uses: actions/checkout@v7.0.1 + - uses: astral-sh/setup-uv@v9.0.0 + - name: Install project dependencies + run: | + make deps + - name: Create group vars + run: | + make -C scenarios group-vars + - name: Run Molecule tests + run: | + make -C scenarios test-molecule-virtual-machine diff --git a/.github/workflows/run-network-tests.yaml b/.github/workflows/run-network-tests.yaml index 1f0f81aaf..1d9842fe9 100644 --- a/.github/workflows/run-network-tests.yaml +++ b/.github/workflows/run-network-tests.yaml @@ -6,7 +6,7 @@ on: - main paths: - clusters/kind/go.* - - scenarios/sre/project/roles/tools/install_*.yaml + - scenarios/project/roles/tools/install_*.yaml concurrency: group: ci-network-${{ github.ref }} @@ -33,7 +33,7 @@ jobs: make deps - name: Create group vars run: | - make -C scenarios/sre group-vars + make -C scenarios group-vars - name: Create Kind cluster run: | make -C clusters/kind create-simple-cluster @@ -43,7 +43,7 @@ jobs: sleep 10 - name: Run connection tests run: | - make -C scenarios/sre test-network-gateway + make -C scenarios test-network-gateway - name: Destroy Kind cluster run: | make -C clusters/kind destroy-simple-cluster diff --git a/.github/workflows/run-unit-tests.yaml b/.github/workflows/run-unit-tests.yaml index 0b146b773..327a28f83 100644 --- a/.github/workflows/run-unit-tests.yaml +++ b/.github/workflows/run-unit-tests.yaml @@ -5,7 +5,7 @@ on: branches: - main paths: - - scenarios/sre/scripts/** + - scenarios/scripts/** concurrency: group: ci-unit-${{ github.ref }} @@ -20,9 +20,12 @@ jobs: - uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0 with: version-file: pyproject.toml + - uses: open-policy-agent/setup-opa@v2.4.0 + with: + version: v1.19.0 - name: Install project dependencies run: | make deps - name: Run unit tests run: | - make -C scenarios/sre test-scripts + make -C scenarios test-scripts diff --git a/.github/workflows/sre-build-push-tools.yaml b/.github/workflows/sre-build-push-tools.yaml index e797ae68a..2f51cc388 100644 --- a/.github/workflows/sre-build-push-tools.yaml +++ b/.github/workflows/sre-build-push-tools.yaml @@ -5,8 +5,8 @@ on: branches: - main paths: - - scenarios/sre/tools/** - - '!scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/**' + - scenarios/tools/** + - '!scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/**' concurrency: group: ci-build-${{ github.ref }} @@ -46,19 +46,19 @@ jobs: - name: Create AWX Execution Environment image context run: | uv run ansible-builder create --output-filename Dockerfile - working-directory: scenarios/sre/tools/awx-ee + working-directory: scenarios/tools/awx-ee - name: Copy requirements to expected location run: | cp _build/requirements.yml requirements.yml cp _build/requirements.txt requirements.txt - working-directory: scenarios/sre/tools/awx-ee/context + working-directory: scenarios/tools/awx-ee/context - name: Build AWX Execution Environment image id: build uses: docker/build-push-action@v7.3.0 env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/awx-ee/context + context: scenarios/tools/awx-ee/context platforms: ${{ matrix.platform }} outputs: type=image,name=quay.io/it-bench/awx-ee,push-by-digest=true,push=true - name: Export digest @@ -125,7 +125,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/hello-bench + context: scenarios/tools/hello-bench platforms: | linux/amd64 push: true @@ -153,7 +153,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/hello-bench + context: scenarios/tools/hello-bench platforms: | linux/arm64 push: true @@ -191,7 +191,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/opentelemetry-collector-builder + context: scenarios/tools/opentelemetry-collector-builder platforms: ${{ matrix.platform }} outputs: type=image,name=quay.io/it-bench/opentelemetry-collector,push-by-digest=true,push=true - name: Export digest @@ -267,7 +267,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/kubernetes-topology-monitor + context: scenarios/tools/kubernetes-topology-monitor platforms: ${{ matrix.platform }} outputs: type=image,name=quay.io/it-bench/topology-monitor,push-by-digest=true,push=true - name: Export digest diff --git a/.github/workflows/sre-build-test-tools.yaml b/.github/workflows/sre-build-test-tools.yaml index 525d7a4fe..b8f73ec58 100644 --- a/.github/workflows/sre-build-test-tools.yaml +++ b/.github/workflows/sre-build-test-tools.yaml @@ -5,8 +5,8 @@ on: branches: - main paths: - - scenarios/sre/tools/** - - '!scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/**' + - scenarios/tools/** + - '!scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/**' concurrency: group: ci-build-test-${{ github.ref }} @@ -38,18 +38,18 @@ jobs: - name: Create AWX Execution Environment image context run: | uv run ansible-builder create --output-filename Dockerfile - working-directory: scenarios/sre/tools/awx-ee + working-directory: scenarios/tools/awx-ee - name: Copy requirements to expected location run: | cp _build/requirements.yml requirements.yml cp _build/requirements.txt requirements.txt - working-directory: scenarios/sre/tools/awx-ee/context + working-directory: scenarios/tools/awx-ee/context - name: Build AWX Execution Environment image uses: docker/build-push-action@v7.3.0 env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/awx-ee/context + context: scenarios/tools/awx-ee/context platforms: | ${{ matrix.platform }} push: false @@ -71,7 +71,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/hello-bench + context: scenarios/tools/hello-bench platforms: | linux/amd64 push: false @@ -93,7 +93,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/hello-bench + context: scenarios/tools/hello-bench platforms: | linux/arm64 push: false @@ -122,7 +122,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/opentelemetry-collector-builder + context: scenarios/tools/opentelemetry-collector-builder platforms: | ${{ matrix.platform }} push: false @@ -151,7 +151,7 @@ jobs: env: DOCKER_BUILD_RECORD_UPLOAD: false with: - context: scenarios/sre/tools/kubernetes-topology-monitor + context: scenarios/tools/kubernetes-topology-monitor platforms: | ${{ matrix.platform }} push: false diff --git a/.github/workflows/validate-documentation.yaml b/.github/workflows/validate-documentation.yaml index 7b45c8500..5f6d9c77e 100644 --- a/.github/workflows/validate-documentation.yaml +++ b/.github/workflows/validate-documentation.yaml @@ -5,12 +5,12 @@ on: branches: - main paths: - - scenarios/sre/library/** - - scenarios/sre/scripts/generate_library_*.py - - scenarios/sre/scripts/validate_library_*.py - - scenarios/sre/templates/documentation/** - - scenarios/sre/templates/library/** - - scenarios/sre/templates/schemas/** + - scenarios/library/** + - scenarios/scripts/generate_library_*.py + - scenarios/scripts/validate_library_*.py + - scenarios/templates/documentation/** + - scenarios/templates/library/** + - scenarios/templates/schemas/** jobs: validate-library: @@ -26,4 +26,4 @@ jobs: make deps - name: Run validation scripts run: | - make -C scenarios/sre validate-library + make -C scenarios validate-library diff --git a/.gitignore b/.gitignore index 039f5bc40..db578a22a 100644 --- a/.gitignore +++ b/.gitignore @@ -7,16 +7,13 @@ scenarios/sre/group_vars/*/*.yaml scenarios/sre/dev/remote_cluster/group_vars/*/*.yaml # Files associated with group variables (v2) -clusters/kind/inventory/group_vars/*/*.yaml -clusters/kops/inventory/group_vars/*/*.yaml -clusters/minikube/inventory/group_vars/*/*.yaml -scenarios/sre/inventory/group_vars/*/*.yaml +**/inventory/group_vars/*/*.yaml # Files associated with kOps cluster kubeconfigs clusters/kops/kubeconfigs/ # Files associated with ansible-runner execution -scenarios/sre/artifacts/ +scenarios/artifacts/ # Source: python .gitignore diff --git a/.secrets.baseline b/.secrets.baseline index e869b94ef..9e8e120a9 100644 --- a/.secrets.baseline +++ b/.secrets.baseline @@ -3,7 +3,7 @@ "files": "^.secrets.baseline$", "lines": null }, - "generated_at": "2026-07-24T14:34:20Z", + "generated_at": "2026-08-10T20:44:30Z", "plugins_used": [ { "name": "AWSKeyDetector" @@ -1641,7 +1641,7 @@ { "hashed_secret": "0c38457a72c89d7b79c21427f8a08028edcd1c0f", "is_verified": false, - "line_number": 226, + "line_number": 228, "type": "Secret Keyword", "verified_result": null } @@ -1671,7 +1671,7 @@ "verified_result": null } ], - "scenarios/sre/project/roles/awx/tasks/configure_projects.yaml": [ + "scenarios/project/roles/awx/tasks/configure_projects.yaml": [ { "hashed_secret": "d2e2ab0f407e4ee3cf2ab87d61c31b25a74085e5", "is_verified": false, @@ -1680,7 +1680,7 @@ "verified_result": null } ], - "scenarios/sre/project/roles/awx/tasks/configure_workflows.yaml": [ + "scenarios/project/roles/awx/tasks/configure_workflows.yaml": [ { "hashed_secret": "28ed3a797da3c48c309a4ef792147f3c56cfec40", "is_verified": false, @@ -1689,7 +1689,34 @@ "verified_result": null } ], - "scenarios/sre/tools/opentelemetry-collector-builder/go.sum": [ + "scenarios/project/roles/virtual_machine/molecule/revoke_access/converge.yml": [ + { + "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc", + "is_verified": false, + "line_number": 19, + "type": "Secret Keyword", + "verified_result": null + } + ], + "scenarios/project/roles/virtual_machine/molecule/revoke_access/create.yml": [ + { + "hashed_secret": "789cbe0407840b1c2041cb33452ff60f19bf58cc", + "is_verified": false, + "line_number": 44, + "type": "Secret Keyword", + "verified_result": null + } + ], + "scenarios/project/roles/virtual_machine/tasks/grant.yaml": [ + { + "hashed_secret": "f19492d4bfbd4787cc64a1a847385a3a2ea93c0b", + "is_verified": false, + "line_number": 62, + "type": "Secret Keyword", + "verified_result": null + } + ], + "scenarios/tools/opentelemetry-collector-builder/go.sum": [ { "hashed_secret": "4aac9d46ed585a983d958e9207083aa4fe618f25", "is_verified": false, @@ -1838,268 +1865,219 @@ "verified_result": null }, { - "hashed_secret": "ba587f6a940dca65109d203c5816402c862e3c54", + "hashed_secret": "be80b31115d7d31662755b0a887a7db6159c3ff4", "is_verified": false, "line_number": 22, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "7ee178324b977e202c99a1df3f1ae92819b7a67d", + "hashed_secret": "0ff0cf7ccc89637b0571d266bc8ebaee74dabdae", "is_verified": false, "line_number": 23, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "8b008690a2114bf8092791ae8aa0b0177a2e78af", + "hashed_secret": "13e6bf1c325508cc263dbdfa5a76593d9ac1f646", "is_verified": false, "line_number": 24, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "e134a4ec1ab316db90f0c25018be96acddea30c3", + "hashed_secret": "93a7fd05464cab4859542a2d78be0189aeaa1f7b", "is_verified": false, "line_number": 25, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "be80b31115d7d31662755b0a887a7db6159c3ff4", + "hashed_secret": "6a4a1948d9e9978e41ee2d466928b91e8ac5d54b", "is_verified": false, "line_number": 26, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "0ff0cf7ccc89637b0571d266bc8ebaee74dabdae", + "hashed_secret": "c382813ad978b45fb54312f408087e014b4374eb", "is_verified": false, "line_number": 27, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "13e6bf1c325508cc263dbdfa5a76593d9ac1f646", + "hashed_secret": "cb5a31c2b60354e7f3fe3a788538bb781b34a94f", "is_verified": false, "line_number": 28, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "93a7fd05464cab4859542a2d78be0189aeaa1f7b", + "hashed_secret": "7e06ce7969d3d518efdec47402c5f0c166a92754", "is_verified": false, "line_number": 29, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "6a4a1948d9e9978e41ee2d466928b91e8ac5d54b", + "hashed_secret": "bf1aa4df66ee10a9d98510626fc51d18310b2165", "is_verified": false, "line_number": 30, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "c382813ad978b45fb54312f408087e014b4374eb", - "is_verified": false, - "line_number": 31, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "ddf772c359f79467b55c662a7cd7dbfa259ad1c8", + "hashed_secret": "911315a87b968dcc5868049a2fd98b88a1b1c4c5", "is_verified": false, "line_number": 32, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "7463de3990ced515e0d6d43c6539e193366878c6", + "hashed_secret": "d8b7d15a6ddd1fe63e5f56d538a721cbe1b4e384", "is_verified": false, "line_number": 33, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "cb5a31c2b60354e7f3fe3a788538bb781b34a94f", + "hashed_secret": "4e8e2a963cbc0880b71eb8663c65652ca1d570f5", "is_verified": false, "line_number": 34, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "7e06ce7969d3d518efdec47402c5f0c166a92754", + "hashed_secret": "49952be58b3267d1fa8d334025727d6a6181340d", "is_verified": false, "line_number": 35, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "bf1aa4df66ee10a9d98510626fc51d18310b2165", + "hashed_secret": "4508d8f1f66efd0cc879f58abeea6a9598f694d6", "is_verified": false, "line_number": 36, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "911315a87b968dcc5868049a2fd98b88a1b1c4c5", + "hashed_secret": "314df4cd200b07dea7c1b9cea93687062646bf17", + "is_verified": false, + "line_number": 37, + "type": "Base64 High Entropy String", + "verified_result": null + }, + { + "hashed_secret": "f939221a5b0a07aef07099f0418ce3231660b8ca", "is_verified": false, "line_number": 38, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "d8b7d15a6ddd1fe63e5f56d538a721cbe1b4e384", + "hashed_secret": "c91c8842d38f063e79d56ecd475d4961d4f04fd5", "is_verified": false, "line_number": 39, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "4e8e2a963cbc0880b71eb8663c65652ca1d570f5", + "hashed_secret": "d64386e1070d5c71c14dc461f299de87643ed0b2", "is_verified": false, "line_number": 40, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "49952be58b3267d1fa8d334025727d6a6181340d", + "hashed_secret": "85508f499bdd852658877cfe62acfd53fba84e65", "is_verified": false, "line_number": 41, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "66dc38e81ef0cb5d195b3dbad17eb0d7e902d985", + "hashed_secret": "975f7b6642c5d2793cd58cd3a377812ec99d071c", "is_verified": false, "line_number": 42, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "a7499aeed72a6c0243e32194a8bfd32e73f780d1", + "hashed_secret": "caf83ba3accd0f6e79dc335a39a622e16d84cb3a", "is_verified": false, "line_number": 43, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "f939221a5b0a07aef07099f0418ce3231660b8ca", + "hashed_secret": "81879c995bee51a3ffc9c6994b893961273e346b", "is_verified": false, "line_number": 44, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "c91c8842d38f063e79d56ecd475d4961d4f04fd5", + "hashed_secret": "7820c7ee8b7ee82b996641a1e376860a40018fcc", "is_verified": false, "line_number": 45, "type": "Base64 High Entropy String", "verified_result": null }, { - "hashed_secret": "d64386e1070d5c71c14dc461f299de87643ed0b2", + "hashed_secret": "172a1a1428e38e5f854b815bc25cf61a4994da86", "is_verified": false, "line_number": 46, "type": "Base64 High Entropy String", "verified_result": null }, - { - "hashed_secret": "85508f499bdd852658877cfe62acfd53fba84e65", - "is_verified": false, - "line_number": 47, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "975f7b6642c5d2793cd58cd3a377812ec99d071c", - "is_verified": false, - "line_number": 48, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "caf83ba3accd0f6e79dc335a39a622e16d84cb3a", - "is_verified": false, - "line_number": 49, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "be835c1bc33a391fc25a2abd548903ab65cf2f4f", - "is_verified": false, - "line_number": 50, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "81879c995bee51a3ffc9c6994b893961273e346b", - "is_verified": false, - "line_number": 51, - "type": "Base64 High Entropy String", - "verified_result": null - }, { "hashed_secret": "4f01b53ae7d776690a67f458937ef55677152dd1", "is_verified": false, - "line_number": 52, + "line_number": 47, "type": "Base64 High Entropy String", "verified_result": null }, { "hashed_secret": "6d3337e0e05efc3003d3fdf5a0e4d47a9e6ea8b8", "is_verified": false, - "line_number": 53, + "line_number": 48, "type": "Base64 High Entropy String", "verified_result": null }, { "hashed_secret": "4c9f83d019d536256479c3a5b5d1ed8169ad37de", "is_verified": false, - "line_number": 54, + "line_number": 49, "type": "Base64 High Entropy String", "verified_result": null }, { "hashed_secret": "bf3142726a74cca84731c2705d90fbb47eb16bb9", "is_verified": false, - "line_number": 55, + "line_number": 50, "type": "Base64 High Entropy String", "verified_result": null }, { "hashed_secret": "aa945027601e7b92be504f177761e51cd2fc9293", "is_verified": false, - "line_number": 56, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "a5153026164a8b6aec7ea9f54ab4742295bc0854", - "is_verified": false, - "line_number": 57, - "type": "Base64 High Entropy String", - "verified_result": null - }, - { - "hashed_secret": "f78d2a86ab2f64ebcc591442fa0a1be2143ecb46", - "is_verified": false, - "line_number": 58, + "line_number": 51, "type": "Base64 High Entropy String", "verified_result": null }, { "hashed_secret": "26003ea45ee54ae0c27ff9e6156c3a353bfbf0cb", "is_verified": false, - "line_number": 59, + "line_number": 52, "type": "Base64 High Entropy String", "verified_result": null }, { "hashed_secret": "d858adb1976228c458c39e2564548b3e2466d8d5", "is_verified": false, - "line_number": 60, + "line_number": 53, "type": "Base64 High Entropy String", "verified_result": null } diff --git a/ansible.cfg b/ansible.cfg index b8e139d86..63a34cb53 100644 --- a/ansible.cfg +++ b/ansible.cfg @@ -1,3 +1,3 @@ [defaults] display_skipped_hosts = false -roles_path = scenarios/sre/project/roles +roles_path = scenarios/project/roles diff --git a/clusters/kops/Makefile b/clusters/kops/Makefile index a1003b825..00d748fca 100644 --- a/clusters/kops/Makefile +++ b/clusters/kops/Makefile @@ -40,7 +40,7 @@ install-cluster-docker-registry: get-cluster-kubeconfig ## Installs docker regis sync-cluster-group-vars: get-cluster-kubeconfig ## Syncs the kubeconfig with the scenarios group variables $(UV) run ansible-playbook -i inventory playbooks/sync_group_variables.yaml \ --extra-vars "target=single-cluster" - cd ../../ && $(UV) run ansible-lint scenarios/sre/inventory/group_vars/environment --fix + cd ../../ && $(UV) run ansible-lint scenarios/inventory/group_vars/environment --fix .PHONY: destroy-cluster destroy-cluster: ## Deletes a single cluster @@ -71,7 +71,7 @@ install-stack-docker-registry: get-stack-kubeconfigs ## Installs docker registry sync-stack-group-vars: get-stack-kubeconfigs ## Syncs the kubeconfig with the scenarios group variables $(UV) run ansible-playbook -i inventory playbooks/sync_group_variables.yaml \ --extra-vars "target=awx-stack" - cd ../../ && $(UV) run ansible-lint scenarios/sre/inventory/group_vars/runner --fix + cd ../../ && $(UV) run ansible-lint scenarios/inventory/group_vars/runner --fix .PHONY: destroy-awx-stack destroy-awx-stack: ## Destroy an AWX stack diff --git a/clusters/kops/playbooks/sync_group_variables.yaml b/clusters/kops/playbooks/sync_group_variables.yaml index b59d5e4e1..5e185d148 100644 --- a/clusters/kops/playbooks/sync_group_variables.yaml +++ b/clusters/kops/playbooks/sync_group_variables.yaml @@ -47,7 +47,7 @@ dest: "{{ group_vars_path | ansible.builtin.realpath }}" mode: "0644" vars: - group_vars_path: "{{ playbook_dir }}/../../../scenarios/sre/inventory/group_vars/environment/cluster.yaml" + group_vars_path: "{{ playbook_dir }}/../../../scenarios/inventory/group_vars/environment/cluster.yaml" - name: Write runner group variables when: @@ -90,4 +90,4 @@ dest: "{{ group_vars_path | ansible.builtin.realpath }}" mode: "0644" vars: - group_vars_path: "{{ playbook_dir }}/../../../scenarios/sre/inventory/group_vars/runner/stack.yaml" + group_vars_path: "{{ playbook_dir }}/../../../scenarios/inventory/group_vars/runner/stack.yaml" diff --git a/documentation/developer/faults.md b/documentation/developer/faults.md index 93e99381c..9179d977d 100644 --- a/documentation/developer/faults.md +++ b/documentation/developer/faults.md @@ -35,7 +35,7 @@ make generate-resource-files ``` >[!NOTE] ->These commands generate the basics needed to begin developing. One may need to make additional changes or create new files to add scripts (ie: [`crashing-kubernetes-workload-init-container`](../../scenarios/sre/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml)). +>These commands generate the basics needed to begin developing. One may need to make additional changes or create new files to add scripts (ie: [`crashing-kubernetes-workload-init-container`](../../scenarios/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml)). >[!TIP] >To see a list of all the added and changed files, use `git status`. @@ -44,12 +44,12 @@ make generate-resource-files **This process is meant to be iterative.** Once the fault is confirmed to work and the index is fully filled out, move to the next phase: [validation](#validating-new-fault). -1. Edit the new fault index. This will be located in the [fault library index directory](../../scenarios/sre/project/roles/documentation/files/library/faults/indexes/). Ensure that all the fields listed have value. Resource links should be provided in the `resources` field and a JSON schema for the fault's arguments should be provided in the `arguments.jsonSchema` field. +1. Edit the new fault index. This will be located in the [fault library index directory](../../scenarios/project/roles/documentation/files/library/faults/indexes/). Ensure that all the fields listed have value. Resource links should be provided in the `resources` field and a JSON schema for the fault's arguments should be provided in the `arguments.jsonSchema` field. >[!IMPORTANT] >The JSON schema should be valid with the `2020-12` ruleset. -2. Edit the new fault implementation file. This will be located in the [faults role task directory](../../scenarios/sre/project/roles/faults/tasks/). **Please use Ansible modules whenever possible and only use CLI tools when necessary.** +2. Edit the new fault implementation file. This will be located in the [faults role task directory](../../scenarios/project/roles/faults/tasks/). **Please use Ansible modules whenever possible and only use CLI tools when necessary.** >[!IMPORTANT] >For Kubernetes or OpenShift related faults, only the namespace of the application should be affected. This allows for easy cleanup of the fault when the application is undeployed (and thus the namespace is deleted). However, if the fault needs to change or add something cluster wide, then the fault will need to do clean up those changes. In such a case, either add a new `remove_x` task file to the directory or modify one of the existing removal tasks files where appropriate to add in the clean up step. @@ -57,7 +57,7 @@ make generate-resource-files >[!IMPORTANT] >When adding new files or test cases, please create a new directory with the same name as the fault's task file **without the `inject_` prefix**. This allows for easier correlation between what additional resources a fault requires. -3. Create a [Molecule test](../../scenarios/sre/project/roles/faults/molecule/) to test the fault. The name of directory should be the exact same name as the task file. Use the following command to run the fault test suite: +3. Create a [Molecule test](../../scenarios/project/roles/faults/molecule/) to test the fault. The name of directory should be the exact same name as the task file. Use the following command to run the fault test suite: ```shell make test-molecule-faults ``` diff --git a/documentation/developer/scenarios.md b/documentation/developer/scenarios.md index ed11a3e2c..13b721522 100644 --- a/documentation/developer/scenarios.md +++ b/documentation/developer/scenarios.md @@ -31,7 +31,7 @@ make generate-scenario-index ### Editing New Scenario -1. Edit the new scenario index template. This will be located in the [scenario library index template directory](../../scenarios/sre/project/roles/documentation/templates/library/scenarios/indexes/). If using an [ITBench supported application](../library/applications/README.md), please ensure that [proper template variables are used](../../scenarios/sre/project/roles/applications/defaults/main/managers.yaml). +1. Edit the new scenario index template. This will be located in the [scenario library index template directory](../../scenarios/project/roles/documentation/templates/library/scenarios/indexes/). If using an [ITBench supported application](../library/applications/README.md), please ensure that [proper template variables are used](../../scenarios/project/roles/applications/defaults/main/managers.yaml). >[!TIP] >Use the existing templates to see how to add the variables for templating. diff --git a/documentation/developer/software.md b/documentation/developer/software.md index ef50dd364..66ca1b9d3 100644 --- a/documentation/developer/software.md +++ b/documentation/developer/software.md @@ -9,11 +9,11 @@ For issues and support directly related to the software, it is often best to rea | Name | Repository | | --- | --- | | amazon.aws | https://github.com/ansible-collections/amazon.aws | -| ansible.posix | https://github.com/ansible-collections/ansible.posix | | ansible.windows | https://github.com/ansible-collections/ansible.windows | | awx.awx | https://github.com/ansible/awx | | azure.azcollection | https://github.com/ansible-collections/azure | | community.aws | https://github.com/ansible-collections/community.aws | +| community.docker | https://github.com/ansible-collections/community.docker | | community.vmware | https://github.com/ansible-collections/community.vmware | | google.cloud | https://github.com/ansible-collections/google.cloud | | kubernetes.core | https://github.com/ansible-collections/kubernetes.core | @@ -44,6 +44,7 @@ For issues and support directly related to the software, it is often best to rea | kubectl | https://github.com/kubernetes/kubectl | | Minikube | https://github.com/kubernetes/minikube | | Molecule | https://github.com/ansible/molecule | +| OPA | https://github.com/open-policy-agent/opa | | Podman | https://github.com/containers/podman | | pre-commit | https://github.com/pre-commit/pre-commit | | uv | https://github.com/astral-sh/uv | diff --git a/documentation/getting-started/awx.md b/documentation/getting-started/awx.md index 27a1a7b75..8c3be233f 100644 --- a/documentation/getting-started/awx.md +++ b/documentation/getting-started/awx.md @@ -21,20 +21,20 @@ ITBench defines an AWX setup as a stack. This AWX stack has two components: one ### AWX with SRE and FinOps Scenarios -The playbooks feature a number of [group variables](../../scenarios/sre/inventory/group_vars/). Each one will be described here: +The playbooks feature a number of [group variables](../../scenarios/inventory/group_vars/). Each one will be described here: | File Name | Function | | --- | --- | -| [agent.yaml](../../scenarios/sre/inventory/group_vars/runner/agent.yaml.example) | Configures the agent configuration and version | -| [experiments.yaml](../../scenarios/sre/inventory/group_vars/runner/experiments.yaml.example) | Configures scenarios and number of trials to run | -| [github.yaml](../../scenarios/sre/inventory/group_vars/runner/github.yaml.example) | Configures the ITBench and Agent repositories | -| [stack.yaml](../../scenarios/sre/inventory/group_vars/runner/stack.yaml.example) | Configures the head and runner clusters | -| [storage.yaml](../../scenarios/sre/inventory/group_vars/all/storage.yaml.example) | Configures the storage options for data files | +| [agent.yaml](../../scenarios/inventory/group_vars/runner/agent.yaml.example) | Configures the agent configuration and version | +| [experiments.yaml](../../scenarios/inventory/group_vars/runner/experiments.yaml.example) | Configures scenarios and number of trials to run | +| [github.yaml](../../scenarios/inventory/group_vars/runner/github.yaml.example) | Configures the ITBench and Agent repositories | +| [stack.yaml](../../scenarios/inventory/group_vars/runner/stack.yaml.example) | Configures the head and runner clusters | +| [storage.yaml](../../scenarios/inventory/group_vars/all/storage.yaml.example) | Configures the storage options for data files | >[!NOTE] >Some of the yaml files have sections commented out. This is to show parameters which are optional. If they are not needed, leave them commented out. Otherwise, uncomment them and fill them out as needed. -After creating an AWX stack, go to the `scenarios/sre` directory. +After creating an AWX stack, go to the `scenarios` directory. #### Creation @@ -44,7 +44,7 @@ make group-vars ``` >[!TIP] ->If using [our kops setup](../../clusters/kops/README.md), use `make sync-stack-group-vars` to export the kubeconfig files and configure the [`stack.yaml`](../../scenarios/sre/inventory/group_vars/runner/stack.yaml) group variables. If using [our kind setup](../../clusters/kind/README.md), the default group variables made at creation will suffice. +>If using [our kops setup](../../clusters/kops/README.md), use `make sync-stack-group-vars` to export the kubeconfig files and configure the [`stack.yaml`](../../scenarios/inventory/group_vars/runner/stack.yaml) group variables. If using [our kind setup](../../clusters/kind/README.md), the default group variables made at creation will suffice. >[!WARNING] >If the group variables were already created as a part of development or running the SRE and FinOps scenarios beforehand, skip this step. Running the command will override the existing files. @@ -108,4 +108,4 @@ Once debugged, one can launch the failed workload from the dashboard in order to ![scenario-launch](../images/awx-scenario-launch.png) >[!WARNING] ->If an `undeploy` node did not run successfully, the `runner` has been left in an improper state. This is intentional so that the cluster itself can be properly explored for debugging. Additional runs should not be scheduled on it until it has been cleaned. Getting the path in the `stack.yaml` of the offending `runner's` kubeconfig and putting it in [`cluster.yaml`](../../scenarios/sre/inventory/group_vars/environment/cluster.yaml.example) group variable. Then, run `make destroy-environment` in order to clean the cluster. Once the cluster has been successfully cleaned, it is ready for scheduling once again. +>If an `undeploy` node did not run successfully, the `runner` has been left in an improper state. This is intentional so that the cluster itself can be properly explored for debugging. Additional runs should not be scheduled on it until it has been cleaned. Getting the path in the `stack.yaml` of the offending `runner's` kubeconfig and putting it in [`cluster.yaml`](../../scenarios/inventory/group_vars/environment/cluster.yaml.example) group variable. Then, run `make destroy-environment` in order to clean the cluster. Once the cluster has been successfully cleaned, it is ready for scheduling once again. diff --git a/documentation/getting-started/scenarios.md b/documentation/getting-started/scenarios.md index 017bc9546..6f033afd5 100644 --- a/documentation/getting-started/scenarios.md +++ b/documentation/getting-started/scenarios.md @@ -30,6 +30,7 @@ There is currently not a unifed running procedure that covers both CISO, FinOps, ```shell brew install helm brew install kubectl +brew install opa brew install uv ``` @@ -50,7 +51,8 @@ brew install openshift-cli 1. Download the following packages - **a.** Install Helm 4 by following the instructions [here](https://helm.sh/docs/intro/install#from-script) - **b.** Install kubectl by following the instructions [here](https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/#install-using-native-package-management) - - **c.** Install UV by following the instructions [here](https://docs.astral.sh/uv/getting-started/installation/#standalone-installer) + - **c.** Install opa by following the instructions [here](https://github.com/open-policy-agent/opa/blob/main/docs/docs/index.md) + - **d.** Install UV by following the instructions [here](https://docs.astral.sh/uv/getting-started/installation/#standalone-installer) 2. Download the following packages **(optional)** - **a.** Install Python by downloading the package [here](https://www.python.org/downloads/source/) @@ -73,19 +75,19 @@ make deps 3. Run the following command from the root directory, to go to the scenarios directory: ```shell -cd scenarios/sre +cd scenarios ``` ## Running Scenarios -ITBench uses [Ansible](https://docs.ansible.com/ansible/latest/getting_started/introduction.html) to manage the sandbox environment on a Kubernetes cluster. The playbooks feature a number of [group variables](../../scenarios/sre/inventory/group_vars/). Each one will be described here: +ITBench uses [Ansible](https://docs.ansible.com/ansible/latest/getting_started/introduction.html) to manage the sandbox environment on a Kubernetes cluster. The playbooks feature a number of [group variables](../../scenarios/inventory/group_vars/). Each one will be described here: | File Name | Function | | --- | --- | -| [applications.yaml](../../scenarios/sre/inventory/group_vars/environment/applications.yaml.example) | Configures applications | -| [cluster.yaml](../../scenarios/sre/inventory/group_vars/environment/cluster.yaml.example) | Configures the cluster | -| [tools.yaml](../../scenarios/sre/inventory/group_vars/environment/tools.yaml.example) | Configures the tool stack | -| [storage.yaml](../../scenarios/sre/inventory/group_vars/all/storage.yaml.example) | Configures the storage options for data files | +| [applications.yaml](../../scenarios/inventory/group_vars/environment/applications.yaml.example) | Configures applications | +| [cluster.yaml](../../scenarios/inventory/group_vars/environment/cluster.yaml.example) | Configures the cluster | +| [tools.yaml](../../scenarios/inventory/group_vars/environment/tools.yaml.example) | Configures the tool stack | +| [storage.yaml](../../scenarios/inventory/group_vars/all/storage.yaml.example) | Configures the storage options for data files | >[!NOTE] >Some of the yaml files have sections commented out. This is to show parameters which are optional. If they are not needed, leave them commented out. Otherwise, uncomment them and fill them out as needed. @@ -101,7 +103,7 @@ make group-vars ``` >[!TIP] ->If using [our kops setup](../../clusters/kops/README.md), use `make sync-cluster-group-vars` to export the kubeconfig files and configure the [`stack.yaml`](../../scenarios/sre/inventory/group_vars/runner/stack.yaml) group variables. If using [our kind setup](../../clusters/kind/README.md), the default group variables made at creation will suffice. +>If using [our kops setup](../../clusters/kops/README.md), use `make sync-cluster-group-vars` to export the kubeconfig files and configure the [`stack.yaml`](../../scenarios/inventory/group_vars/runner/stack.yaml) group variables. If using [our kind setup](../../clusters/kind/README.md), the default group variables made at creation will suffice. >[!WARNING] >If the group variables were already created as a part of development or running the SRE and FinOps scenarios beforehand, skip this step. Running the command will override the existing files. diff --git a/documentation/library/applications/book-info.md b/documentation/library/applications/book-info.md index 0b3536e43..486c830c1 100644 --- a/documentation/library/applications/book-info.md +++ b/documentation/library/applications/book-info.md @@ -3,7 +3,7 @@ # Book Info -| [Source](../../../scenarios/sre/library/indexes/applications/book-info.json) | [Schema](../../../schemas/json/applications/book-info.json) | [Repository](https://github.com/istio/istio) | Kubernetes | +| [Source](../../../scenarios/library/indexes/applications/book-info.json) | [Schema](../../../schemas/json/applications/book-info.json) | [Repository](https://github.com/istio/istio) | Kubernetes | This microservice application is primarily used to showcase the capabitlities of Istio. diff --git a/documentation/library/applications/opentelemetry-demo.md b/documentation/library/applications/opentelemetry-demo.md index 49aa405b1..51a92a506 100644 --- a/documentation/library/applications/opentelemetry-demo.md +++ b/documentation/library/applications/opentelemetry-demo.md @@ -3,7 +3,7 @@ # OpenTelemetry Demo -| [Source](../../../scenarios/sre/library/indexes/applications/opentelemetry-demo.json) | [Schema](../../../schemas/json/applications/opentelemetry-demo.json) | [Repository](https://github.com/open-telemetry/opentelemetry-demo) | Kubernetes | +| [Source](../../../scenarios/library/indexes/applications/opentelemetry-demo.json) | [Schema](../../../schemas/json/applications/opentelemetry-demo.json) | [Repository](https://github.com/open-telemetry/opentelemetry-demo) | Kubernetes | This microservice application is primarily used to showcase the capabitlities of OpenTelemetry. diff --git a/documentation/library/faults/README.md b/documentation/library/faults/README.md index a63d679a3..d25025fb6 100644 --- a/documentation/library/faults/README.md +++ b/documentation/library/faults/README.md @@ -7,11 +7,14 @@ A fault is a solvable issue injected into an environment to create an incident. | Name | Platform | | --- | --- | +| [Active Host Network Kubernetes Deployment](./active-host-network-kubernetes-deployment.md) | Kubernetes | | [Cordoned Kubernetes Worker Node](./cordoned-kubernetes-worker-node.md) | Kubernetes | | [Corrupted Kubernetes Secret Credentials](./corrupted-kubernetes-secret-credentials.md) | Kubernetes | +| [Corrupted Kubernetes Secret Credentials](./corrupted-kubernetes-secret-credentials.md) | Kubernetes | | [Crashing Kubernetes Workload Init Container](./crashing-kubernetes-workload-init-container.md) | Kubernetes | | [Deleted Kubernetes Service](./deleted-kubernetes-service.md) | Kubernetes | | [Disabled Istio Ambient Mode Kubernetes Namespace](./disabled-istio-ambient-mode-kubernetes-namespace.md) | Kubernetes | +| [Enabled X11 Forwarding RHEL9 SSHD](./enabled-x11-forwarding-rhel9-sshd.md) | RHEL9 | | [Failing Name Resolution Kubernetes Workload DNS Policy](./failing-name-resolution-kubernetes-workload-dns-policy.md) | Kubernetes | | [Hanging Kubernetes Workload Init Container](./hanging-kubernetes-workload-init-container.md) | Kubernetes | | [Ingress Port Blocking Network Policy](./ingress-port-blocking-network-policy.md) | Kubernetes | @@ -24,6 +27,7 @@ A fault is a solvable issue injected into an environment to create an incident. | [Misconfigured Kubernetes Workload Container Readiness Probe](./misconfigured-kubernetes-workload-container-readiness-probe.md) | Kubernetes | | [Modified Kubernetes Workload Container Environment Variable](./modified-kubernetes-workload-container-environment-variable.md) | Kubernetes | | [Modified Target Port Kubernetes Service](./modified-target-port-kubernetes-service.md) | Kubernetes | +| [Non Compliant Kubernetes Pod Deployment](./non-compliant-kubernetes-pod-deployment.md) | Kubernetes | | [Nonexistent Kubernetes Workload Container Image](./nonexistent-kubernetes-workload-container-image.md) | Kubernetes | | [Nonexistent Kubernetes Workload Node](./nonexistent-kubernetes-workload-node.md) | Kubernetes | | [Nonexistent Kubernetes Workload Persistent Volume Claim](./nonexistent-kubernetes-workload-persistent-volume-claim.md) | Kubernetes | diff --git a/documentation/library/faults/active-host-network-kubernetes-deployment.md b/documentation/library/faults/active-host-network-kubernetes-deployment.md new file mode 100644 index 000000000..c52c985d0 --- /dev/null +++ b/documentation/library/faults/active-host-network-kubernetes-deployment.md @@ -0,0 +1,23 @@ +>[!NOTE] +>This file is autogenerated. Please do not edit. + +# Active Host Network Kubernetes Deployment + +| [Source](../../../scenarios/library/indexes/faults/active-host-network-kubernetes-deployment.json) | [Schema](../../../schemas/json/faults/active-host-network-kubernetes-deployment.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_active_host_network_kubernetes_deployment.yaml) | Kubernetes | Compliance, Deployment | + +This fault deploys a Kubernetes workload with hostNetwork set to true, granting the container access to the host network namespace. + +## Expectation + +Kyverno PolicyReport will record a policy failure against the Deployment for violating the disallow-host-namespaces rule. + +### Alerts + +The following alerts are expected to fire when this fault is injected. + +#### Application Alerts + + +## Resources + +- https://kubernetes.io/docs/concepts/security/pod-security-standards/ diff --git a/documentation/library/faults/cordoned-kubernetes-worker-node.md b/documentation/library/faults/cordoned-kubernetes-worker-node.md index 7ba2ef673..33676a78d 100644 --- a/documentation/library/faults/cordoned-kubernetes-worker-node.md +++ b/documentation/library/faults/cordoned-kubernetes-worker-node.md @@ -3,7 +3,7 @@ # Cordoned Kubernetes Worker Node -| [Source](../../../scenarios/sre/library/indexes/faults/cordoned-kubernetes-worker-node.json) | [Schema](../../../schemas/json/faults/cordoned-kubernetes-worker-node.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_cordoned_kubernetes_worker_node.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/cordoned-kubernetes-worker-node.json) | [Schema](../../../schemas/json/faults/cordoned-kubernetes-worker-node.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_cordoned_kubernetes_worker_node.yaml) | Kubernetes | Deployment, Performance | This fault places a workload on a node and prevents it from scaling by blocking all new scheduling attempts. diff --git a/documentation/library/faults/corrupted-kubernetes-secret-credentials.md b/documentation/library/faults/corrupted-kubernetes-secret-credentials.md index 0c596d44e..d680139b7 100644 --- a/documentation/library/faults/corrupted-kubernetes-secret-credentials.md +++ b/documentation/library/faults/corrupted-kubernetes-secret-credentials.md @@ -3,7 +3,7 @@ # Corrupted Kubernetes Secret Credentials -| [Source](../../../../scenarios/sre/library/indexes/faults/corrupted-kubernetes-secret-credentials.json) | [Schema](../../../../schemas/json/faults/corrupted-kubernetes-secret-credentials.json) | [Implementation](../../../../scenarios/sre/project/roles/faults/tasks/inject_corrupted_kubernetes_secret_credentials.yaml) | Kubernetes | Authentication, Deployment | +| [Source](../../../scenarios/library/indexes/faults/corrupted-kubernetes-secret-credentials.json) | [Schema](../../../schemas/json/faults/corrupted-kubernetes-secret-credentials.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_corrupted_kubernetes_secret_credentials.yaml) | Kubernetes | Authentication, Deployment | This fault corrupts a Kubernetes Secret by replacing its data with invalid credentials, simulating real-world incidents where secret rotation failures, registry authentication issues, or Vault access problems cause service outages. diff --git a/documentation/library/faults/crashing-kubernetes-workload-init-container.md b/documentation/library/faults/crashing-kubernetes-workload-init-container.md index c4e15334b..c9ab3cd5c 100644 --- a/documentation/library/faults/crashing-kubernetes-workload-init-container.md +++ b/documentation/library/faults/crashing-kubernetes-workload-init-container.md @@ -3,7 +3,7 @@ # Crashing Kubernetes Workload Init Container -| [Source](../../../scenarios/sre/library/indexes/faults/crashing-kubernetes-workload-init-container.json) | [Schema](../../../schemas/json/faults/crashing-kubernetes-workload-init-container.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml) | Kubernetes | Code, Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/crashing-kubernetes-workload-init-container.json) | [Schema](../../../schemas/json/faults/crashing-kubernetes-workload-init-container.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml) | Kubernetes | Code, Deployment, Performance | This fault injects an init container that crashes due to a bad script. diff --git a/documentation/library/faults/deleted-kubernetes-service.md b/documentation/library/faults/deleted-kubernetes-service.md index 7f534a371..4896efdce 100644 --- a/documentation/library/faults/deleted-kubernetes-service.md +++ b/documentation/library/faults/deleted-kubernetes-service.md @@ -3,7 +3,7 @@ # Deleted Kubernetes Service -| [Source](../../../scenarios/sre/library/indexes/faults/deleted-kubernetes-service.json) | [Schema](../../../schemas/json/faults/deleted-kubernetes-service.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_deleted_kubernetes_service.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/deleted-kubernetes-service.json) | [Schema](../../../schemas/json/faults/deleted-kubernetes-service.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_deleted_kubernetes_service.yaml) | Kubernetes | Deployment, Networking | This fault deletes the services attached to a Kubernetes workload, preventing other workloads from being able to communicate with it. diff --git a/documentation/library/faults/disabled-istio-ambient-mode-kubernetes-namespace.md b/documentation/library/faults/disabled-istio-ambient-mode-kubernetes-namespace.md index d39f4a208..6dd51a7c5 100644 --- a/documentation/library/faults/disabled-istio-ambient-mode-kubernetes-namespace.md +++ b/documentation/library/faults/disabled-istio-ambient-mode-kubernetes-namespace.md @@ -3,7 +3,7 @@ # Disabled Istio Ambient Mode Kubernetes Namespace -| [Source](../../../scenarios/sre/library/indexes/faults/disabled-istio-ambient-mode-kubernetes-namespace.json) | [Schema](../../../schemas/json/faults/disabled-istio-ambient-mode-kubernetes-namespace.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/disabled-istio-ambient-mode-kubernetes-namespace.json) | [Schema](../../../schemas/json/faults/disabled-istio-ambient-mode-kubernetes-namespace.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml) | Kubernetes | Deployment, Networking | This fault modifies a namespace, disabling it from being included in Istio's Ambient Mode service mesh. diff --git a/documentation/library/faults/enabled-x11-forwarding-rhel9-sshd.md b/documentation/library/faults/enabled-x11-forwarding-rhel9-sshd.md new file mode 100644 index 000000000..4cd3ab8c0 --- /dev/null +++ b/documentation/library/faults/enabled-x11-forwarding-rhel9-sshd.md @@ -0,0 +1,23 @@ +>[!NOTE] +>This file is autogenerated. Please do not edit. + +# Enabled X11 Forwarding RHEL9 SSHD + +| [Source](../../../scenarios/library/indexes/faults/enabled-x11-forwarding-rhel9-sshd.json) | [Schema](../../../schemas/json/faults/enabled-x11-forwarding-rhel9-sshd.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_enabled_x11_forwarding_rhel9_sshd.yaml) | RHEL9 | Compliance | + +This fault enables X11 forwarding in /etc/ssh/sshd_config on a RHEL9 host, violating the requirement for it to be disabled. + +## Expectation + +OPA evaluation of the collected SSH configuration data will return false, indicating the host is non-compliant with the applicable benchmark rule. + +### Alerts + +The following alerts are expected to fire when this fault is injected. + +#### Application Alerts + + +## Resources + +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/securing_networks/assembly_using-secure-communications-between-two-systems-with-openssh_securing-networks diff --git a/documentation/library/faults/failing-name-resolution-kubernetes-workload-dns-policy.md b/documentation/library/faults/failing-name-resolution-kubernetes-workload-dns-policy.md index 1613be75a..818f8a83e 100644 --- a/documentation/library/faults/failing-name-resolution-kubernetes-workload-dns-policy.md +++ b/documentation/library/faults/failing-name-resolution-kubernetes-workload-dns-policy.md @@ -3,7 +3,7 @@ # Failing Name Resolution Kubernetes Workload DNS Policy -| [Source](../../../scenarios/sre/library/indexes/faults/failing-name-resolution-kubernetes-workload-dns-policy.json) | [Schema](../../../schemas/json/faults/failing-name-resolution-kubernetes-workload-dns-policy.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/failing-name-resolution-kubernetes-workload-dns-policy.json) | [Schema](../../../schemas/json/faults/failing-name-resolution-kubernetes-workload-dns-policy.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml) | Kubernetes | Deployment, Networking | This fault injects an DNS policy which results in the workload being unable to resolve the name of outgoing services. diff --git a/documentation/library/faults/hanging-kubernetes-workload-init-container.md b/documentation/library/faults/hanging-kubernetes-workload-init-container.md index a744efcbe..5d0e4c9b2 100644 --- a/documentation/library/faults/hanging-kubernetes-workload-init-container.md +++ b/documentation/library/faults/hanging-kubernetes-workload-init-container.md @@ -3,7 +3,7 @@ # Hanging Kubernetes Workload Init Container -| [Source](../../../scenarios/sre/library/indexes/faults/hanging-kubernetes-workload-init-container.json) | [Schema](../../../schemas/json/faults/hanging-kubernetes-workload-init-container.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_hanging_kubernetes_workload_init_container.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/hanging-kubernetes-workload-init-container.json) | [Schema](../../../schemas/json/faults/hanging-kubernetes-workload-init-container.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_hanging_kubernetes_workload_init_container.yaml) | Kubernetes | Deployment, Performance | This fault injects an init container which will hang into a workload. diff --git a/documentation/library/faults/ingress-port-blocking-network-policy.md b/documentation/library/faults/ingress-port-blocking-network-policy.md index bf907fc05..e06c098fe 100644 --- a/documentation/library/faults/ingress-port-blocking-network-policy.md +++ b/documentation/library/faults/ingress-port-blocking-network-policy.md @@ -3,7 +3,7 @@ # Ingress Port Blocking Network Policy -| [Source](../../../scenarios/sre/library/indexes/faults/ingress-port-blocking-network-policy.json) | [Schema](../../../schemas/json/faults/ingress-port-blocking-network-policy.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_ingress_port_blocking_network_policy.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/ingress-port-blocking-network-policy.json) | [Schema](../../../schemas/json/faults/ingress-port-blocking-network-policy.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_ingress_port_blocking_network_policy.yaml) | Kubernetes | Deployment, Networking | This fault injects a network policy which blocks traffic on all ingress ports of a given workload. diff --git a/documentation/library/faults/insufficient-kubernetes-resource-quota.md b/documentation/library/faults/insufficient-kubernetes-resource-quota.md index 709e9a1d1..8228ae4d4 100644 --- a/documentation/library/faults/insufficient-kubernetes-resource-quota.md +++ b/documentation/library/faults/insufficient-kubernetes-resource-quota.md @@ -3,7 +3,7 @@ # Insufficient Kubernetes Resource Quota -| [Source](../../../scenarios/sre/library/indexes/faults/insufficient-kubernetes-resource-quota.json) | [Schema](../../../schemas/json/faults/insufficient-kubernetes-resource-quota.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_insufficient_kubernetes_resource_quota.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/insufficient-kubernetes-resource-quota.json) | [Schema](../../../schemas/json/faults/insufficient-kubernetes-resource-quota.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_insufficient_kubernetes_resource_quota.yaml) | Kubernetes | Deployment, Performance | This fault injects a resource quota with hard resource requirements that are underprovisioned for the namespace. diff --git a/documentation/library/faults/insufficient-kubernetes-workload-container-resources.md b/documentation/library/faults/insufficient-kubernetes-workload-container-resources.md index e9b58e25d..ee0dda4bf 100644 --- a/documentation/library/faults/insufficient-kubernetes-workload-container-resources.md +++ b/documentation/library/faults/insufficient-kubernetes-workload-container-resources.md @@ -3,7 +3,7 @@ # Insufficient Kubernetes Workload Container Resources -| [Source](../../../scenarios/sre/library/indexes/faults/insufficient-kubernetes-workload-container-resources.json) | [Schema](../../../schemas/json/faults/insufficient-kubernetes-workload-container-resources.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_insufficient_kubernetes_workload_container_resources.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/insufficient-kubernetes-workload-container-resources.json) | [Schema](../../../schemas/json/faults/insufficient-kubernetes-workload-container-resources.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_insufficient_kubernetes_workload_container_resources.yaml) | Kubernetes | Deployment, Performance | This fault injects a insufficient resource configuration into a designated Kubernetes workload's container. diff --git a/documentation/library/faults/invalid-kubernetes-service-selector.md b/documentation/library/faults/invalid-kubernetes-service-selector.md index 6682ef89e..24f95bd52 100644 --- a/documentation/library/faults/invalid-kubernetes-service-selector.md +++ b/documentation/library/faults/invalid-kubernetes-service-selector.md @@ -3,7 +3,7 @@ # Invalid Kubernetes Service Selector -| [Source](../../../scenarios/sre/library/indexes/faults/invalid-kubernetes-service-selector.json) | [Schema](../../../schemas/json/faults/invalid-kubernetes-service-selector.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_invalid_kubernetes_service_selector.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/invalid-kubernetes-service-selector.json) | [Schema](../../../schemas/json/faults/invalid-kubernetes-service-selector.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_invalid_kubernetes_service_selector.yaml) | Kubernetes | Deployment, Networking | This fault modifies an existing service's selector, causing the service to be unable to find its intended workload. diff --git a/documentation/library/faults/invalid-kubernetes-workload-container-command.md b/documentation/library/faults/invalid-kubernetes-workload-container-command.md index 6f083cf77..86c7f3b7e 100644 --- a/documentation/library/faults/invalid-kubernetes-workload-container-command.md +++ b/documentation/library/faults/invalid-kubernetes-workload-container-command.md @@ -3,7 +3,7 @@ # Invalid Kubernetes Workload Container Command -| [Source](../../../scenarios/sre/library/indexes/faults/invalid-kubernetes-workload-container-command.json) | [Schema](../../../schemas/json/faults/invalid-kubernetes-workload-container-command.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_invalid_kubernetes_workload_container_command.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/invalid-kubernetes-workload-container-command.json) | [Schema](../../../schemas/json/faults/invalid-kubernetes-workload-container-command.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_invalid_kubernetes_workload_container_command.yaml) | Kubernetes | Deployment, Performance | This fault injects an invalid command into a designated Kubernetes workload's container. diff --git a/documentation/library/faults/kubernetes-api-server-request-surge.md b/documentation/library/faults/kubernetes-api-server-request-surge.md index c1e5af3d7..0263469d8 100644 --- a/documentation/library/faults/kubernetes-api-server-request-surge.md +++ b/documentation/library/faults/kubernetes-api-server-request-surge.md @@ -3,7 +3,7 @@ # Kubernetes API Server Request Surge -| [Source](../../../scenarios/sre/library/indexes/faults/kubernetes-api-server-request-surge.json) | [Schema](../../../schemas/json/faults/kubernetes-api-server-request-surge.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_kubernetes_api_server_request_surge.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/kubernetes-api-server-request-surge.json) | [Schema](../../../schemas/json/faults/kubernetes-api-server-request-surge.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_kubernetes_api_server_request_surge.yaml) | Kubernetes | Deployment, Performance | This fault injects a workload which causes a surge in requests to the API server, causing performance degredation. diff --git a/documentation/library/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.md b/documentation/library/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.md index d32742609..79275cc2a 100644 --- a/documentation/library/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.md +++ b/documentation/library/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.md @@ -3,7 +3,7 @@ # Misconfigured Kubernetes Horizontal Pod Autoscaler -| [Source](../../../scenarios/sre/library/indexes/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.json) | [Schema](../../../schemas/json/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_misconfigured_kubernetes_horizontal_pod_autoscaler.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.json) | [Schema](../../../schemas/json/faults/misconfigured-kubernetes-horizontal-pod-autoscaler.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_misconfigured_kubernetes_horizontal_pod_autoscaler.yaml) | Kubernetes | Deployment, Performance | This fault injects a configuration into a horizontal pod autoscaler that causes it to react to low resource usage diff --git a/documentation/library/faults/misconfigured-kubernetes-workload-container-readiness-probe.md b/documentation/library/faults/misconfigured-kubernetes-workload-container-readiness-probe.md index f004df9e3..2874c375f 100644 --- a/documentation/library/faults/misconfigured-kubernetes-workload-container-readiness-probe.md +++ b/documentation/library/faults/misconfigured-kubernetes-workload-container-readiness-probe.md @@ -3,7 +3,7 @@ # Misconfigured Kubernetes Workload Container Readiness Probe -| [Source](../../../scenarios/sre/library/indexes/faults/misconfigured-kubernetes-workload-container-readiness-probe.json) | [Schema](../../../schemas/json/faults/misconfigured-kubernetes-workload-container-readiness-probe.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_misconfigured_kubernetes_workload_container_readiness_probe.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/misconfigured-kubernetes-workload-container-readiness-probe.json) | [Schema](../../../schemas/json/faults/misconfigured-kubernetes-workload-container-readiness-probe.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_misconfigured_kubernetes_workload_container_readiness_probe.yaml) | Kubernetes | Deployment, Performance | This fault injects a misconfigured readiness probe into a workload container. This probe blocks the pod from starting up. diff --git a/documentation/library/faults/modified-kubernetes-workload-container-environment-variable.md b/documentation/library/faults/modified-kubernetes-workload-container-environment-variable.md index 0cc04e652..3919ab14a 100644 --- a/documentation/library/faults/modified-kubernetes-workload-container-environment-variable.md +++ b/documentation/library/faults/modified-kubernetes-workload-container-environment-variable.md @@ -3,7 +3,7 @@ # Modified Kubernetes Workload Container Environment Variable -| [Source](../../../scenarios/sre/library/indexes/faults/modified-kubernetes-workload-container-environment-variable.json) | [Schema](../../../schemas/json/faults/modified-kubernetes-workload-container-environment-variable.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_modified_kubernetes_workload_container_environment_variable.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/modified-kubernetes-workload-container-environment-variable.json) | [Schema](../../../schemas/json/faults/modified-kubernetes-workload-container-environment-variable.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_modified_kubernetes_workload_container_environment_variable.yaml) | Kubernetes | Deployment, Performance | This fault overwrites an environment variable value with one provided in the argument. diff --git a/documentation/library/faults/modified-target-port-kubernetes-service.md b/documentation/library/faults/modified-target-port-kubernetes-service.md index 3d60374c6..c0f044bb6 100644 --- a/documentation/library/faults/modified-target-port-kubernetes-service.md +++ b/documentation/library/faults/modified-target-port-kubernetes-service.md @@ -3,7 +3,7 @@ # Modified Target Port Kubernetes Service -| [Source](../../../scenarios/sre/library/indexes/faults/modified-target-port-kubernetes-service.json) | [Schema](../../../schemas/json/faults/modified-target-port-kubernetes-service.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_modified_target_port_kubernetes_service.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/modified-target-port-kubernetes-service.json) | [Schema](../../../schemas/json/faults/modified-target-port-kubernetes-service.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_modified_target_port_kubernetes_service.yaml) | Kubernetes | Deployment, Networking | This fault overwrites the designated target port with a different number. diff --git a/documentation/library/faults/non-compliant-kubernetes-pod-deployment.md b/documentation/library/faults/non-compliant-kubernetes-pod-deployment.md new file mode 100644 index 000000000..ce2b0d962 --- /dev/null +++ b/documentation/library/faults/non-compliant-kubernetes-pod-deployment.md @@ -0,0 +1,23 @@ +>[!NOTE] +>This file is autogenerated. Please do not edit. + +# Non Compliant Kubernetes Pod Deployment + +| [Source](../../../scenarios/library/indexes/faults/non-compliant-kubernetes-pod-deployment.json) | [Schema](../../../schemas/json/faults/non-compliant-kubernetes-pod-deployment.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_non_compliant_kubernetes_pod_deployment.yaml) | Kubernetes | Compliance, Deployment | + +This fault deploys a Pod that violates active security policies, such as pulling from an untrusted image registry or permitting privilege escalation. + +## Expectation + +Policy evaluation will flag the Pod as non-compliant, producing a policy failure result for the target resource. + +### Alerts + +The following alerts are expected to fire when this fault is injected. + +#### Application Alerts + + +## Resources + +- https://kubernetes.io/docs/concepts/security/pod-security-standards/ diff --git a/documentation/library/faults/nonexistent-kubernetes-workload-container-image.md b/documentation/library/faults/nonexistent-kubernetes-workload-container-image.md index f3f9b2ce8..48682b27b 100644 --- a/documentation/library/faults/nonexistent-kubernetes-workload-container-image.md +++ b/documentation/library/faults/nonexistent-kubernetes-workload-container-image.md @@ -3,7 +3,7 @@ # Nonexistent Kubernetes Workload Container Image -| [Source](../../../scenarios/sre/library/indexes/faults/nonexistent-kubernetes-workload-container-image.json) | [Schema](../../../schemas/json/faults/nonexistent-kubernetes-workload-container-image.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/nonexistent-kubernetes-workload-container-image.json) | [Schema](../../../schemas/json/faults/nonexistent-kubernetes-workload-container-image.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml) | Kubernetes | Deployment, Performance | This fault injects an nonexistent image into a designated Kubernetes workload's container. diff --git a/documentation/library/faults/nonexistent-kubernetes-workload-node.md b/documentation/library/faults/nonexistent-kubernetes-workload-node.md index 795aa9078..3c06f1c91 100644 --- a/documentation/library/faults/nonexistent-kubernetes-workload-node.md +++ b/documentation/library/faults/nonexistent-kubernetes-workload-node.md @@ -3,7 +3,7 @@ # Nonexistent Kubernetes Workload Node -| [Source](../../../scenarios/sre/library/indexes/faults/nonexistent-kubernetes-workload-node.json) | [Schema](../../../schemas/json/faults/nonexistent-kubernetes-workload-node.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_node.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/nonexistent-kubernetes-workload-node.json) | [Schema](../../../schemas/json/faults/nonexistent-kubernetes-workload-node.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_node.yaml) | Kubernetes | Deployment, Performance | This fault injects a node selector for an nonexistent node into a designated Kubernetes workload. diff --git a/documentation/library/faults/nonexistent-kubernetes-workload-persistent-volume-claim.md b/documentation/library/faults/nonexistent-kubernetes-workload-persistent-volume-claim.md index c5e408853..d379addac 100644 --- a/documentation/library/faults/nonexistent-kubernetes-workload-persistent-volume-claim.md +++ b/documentation/library/faults/nonexistent-kubernetes-workload-persistent-volume-claim.md @@ -3,7 +3,7 @@ # Nonexistent Kubernetes Workload Persistent Volume Claim -| [Source](../../../scenarios/sre/library/indexes/faults/nonexistent-kubernetes-workload-persistent-volume-claim.json) | [Schema](../../../schemas/json/faults/nonexistent-kubernetes-workload-persistent-volume-claim.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_persistent_volume_claim.yaml) | Kubernetes | Deployment | +| [Source](../../../scenarios/library/indexes/faults/nonexistent-kubernetes-workload-persistent-volume-claim.json) | [Schema](../../../schemas/json/faults/nonexistent-kubernetes-workload-persistent-volume-claim.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_persistent_volume_claim.yaml) | Kubernetes | Deployment | This fault injects a workload with a nonexistent volume. diff --git a/documentation/library/faults/opentelemetry-demo-feature-flag.md b/documentation/library/faults/opentelemetry-demo-feature-flag.md index 3cf745fb2..00fa22f9b 100644 --- a/documentation/library/faults/opentelemetry-demo-feature-flag.md +++ b/documentation/library/faults/opentelemetry-demo-feature-flag.md @@ -3,7 +3,7 @@ # OpenTelemetry Demo Feature Flag -| [Source](../../../scenarios/sre/library/indexes/faults/opentelemetry-demo-feature-flag.json) | [Schema](../../../schemas/json/faults/opentelemetry-demo-feature-flag.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_opentelemetry_demo_feature_flag.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/opentelemetry-demo-feature-flag.json) | [Schema](../../../schemas/json/faults/opentelemetry-demo-feature-flag.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_opentelemetry_demo_feature_flag.yaml) | Kubernetes | Deployment, Performance | This fault activates an implemented fault in the OpenTelemetry Demo. diff --git a/documentation/library/faults/priority-kubernetes-workload-priority-preemption.md b/documentation/library/faults/priority-kubernetes-workload-priority-preemption.md index 3b5dfd8b3..d06bc7411 100644 --- a/documentation/library/faults/priority-kubernetes-workload-priority-preemption.md +++ b/documentation/library/faults/priority-kubernetes-workload-priority-preemption.md @@ -3,7 +3,7 @@ # Priority Kubernetes Workload Priority Preemption -| [Source](../../../scenarios/sre/library/indexes/faults/priority-kubernetes-workload-priority-preemption.json) | [Schema](../../../schemas/json/faults/priority-kubernetes-workload-priority-preemption.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_priority_kubernetes_workload_priority_preemption.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/priority-kubernetes-workload-priority-preemption.json) | [Schema](../../../schemas/json/faults/priority-kubernetes-workload-priority-preemption.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_priority_kubernetes_workload_priority_preemption.yaml) | Kubernetes | Deployment, Performance | This fault causes a workload to be a lower priority than another. This causes the pod to be evicted when the higher priority workload needs more resources. diff --git a/documentation/library/faults/scaled-to-zero-kubernetes-workload.md b/documentation/library/faults/scaled-to-zero-kubernetes-workload.md index 7e1569665..70da58cb6 100644 --- a/documentation/library/faults/scaled-to-zero-kubernetes-workload.md +++ b/documentation/library/faults/scaled-to-zero-kubernetes-workload.md @@ -3,7 +3,7 @@ # Scaled To Zero Kubernetes Workload -| [Source](../../../scenarios/sre/library/indexes/faults/scaled-to-zero-kubernetes-workload.json) | [Schema](../../../schemas/json/faults/scaled-to-zero-kubernetes-workload.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_scaled_to_zero_kubernetes_workload.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/scaled-to-zero-kubernetes-workload.json) | [Schema](../../../schemas/json/faults/scaled-to-zero-kubernetes-workload.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_scaled_to_zero_kubernetes_workload.yaml) | Kubernetes | Deployment, Performance | This fault scales a Kubernetes workload to 0. diff --git a/documentation/library/faults/scheduled-chaos-mesh-experiment.md b/documentation/library/faults/scheduled-chaos-mesh-experiment.md index e57f4210c..2947457a1 100644 --- a/documentation/library/faults/scheduled-chaos-mesh-experiment.md +++ b/documentation/library/faults/scheduled-chaos-mesh-experiment.md @@ -3,7 +3,7 @@ # Scheduled Chaos Mesh Experiment -| [Source](../../../scenarios/sre/library/indexes/faults/scheduled-chaos-mesh-experiment.json) | [Schema](../../../schemas/json/faults/scheduled-chaos-mesh-experiment.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_scheduled_chaos_mesh_experiment.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/scheduled-chaos-mesh-experiment.json) | [Schema](../../../schemas/json/faults/scheduled-chaos-mesh-experiment.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_scheduled_chaos_mesh_experiment.yaml) | Kubernetes | Deployment, Performance | This fault injects a Chaos Mesh experiment into the environment. The experiment is [scheduled](https://chaos-mesh.org/docs/define-scheduling-rules/) to repeated fire so that the behavior persists. diff --git a/documentation/library/faults/strict-mutual-tls-istio-service-mesh-enforcement.md b/documentation/library/faults/strict-mutual-tls-istio-service-mesh-enforcement.md index 613b954fd..180a3bc01 100644 --- a/documentation/library/faults/strict-mutual-tls-istio-service-mesh-enforcement.md +++ b/documentation/library/faults/strict-mutual-tls-istio-service-mesh-enforcement.md @@ -3,7 +3,7 @@ # Strict Mutual TLS Istio Service Mesh Enforcement -| [Source](../../../scenarios/sre/library/indexes/faults/strict-mutual-tls-istio-service-mesh-enforcement.json) | [Schema](../../../schemas/json/faults/strict-mutual-tls-istio-service-mesh-enforcement.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_strict_mutual_tls_istio_service_mesh_enforcement.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/strict-mutual-tls-istio-service-mesh-enforcement.json) | [Schema](../../../schemas/json/faults/strict-mutual-tls-istio-service-mesh-enforcement.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_strict_mutual_tls_istio_service_mesh_enforcement.yaml) | Kubernetes | Deployment, Networking | This fault injects a policy which causes the affected workload to be unable to communicate with other pods in the service mesh. diff --git a/documentation/library/faults/traffic-denying-istio-gateway-authorization-policy.md b/documentation/library/faults/traffic-denying-istio-gateway-authorization-policy.md index 2aa6841fa..b456dcb48 100644 --- a/documentation/library/faults/traffic-denying-istio-gateway-authorization-policy.md +++ b/documentation/library/faults/traffic-denying-istio-gateway-authorization-policy.md @@ -3,7 +3,7 @@ # Traffic Denying Istio Gateway Authorization Policy -| [Source](../../../scenarios/sre/library/indexes/faults/traffic-denying-istio-gateway-authorization-policy.json) | [Schema](../../../schemas/json/faults/traffic-denying-istio-gateway-authorization-policy.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_traffic_denying_istio_gateway_authorization_policy.yaml) | Kubernetes | Deployment, Networking | +| [Source](../../../scenarios/library/indexes/faults/traffic-denying-istio-gateway-authorization-policy.json) | [Schema](../../../schemas/json/faults/traffic-denying-istio-gateway-authorization-policy.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_traffic_denying_istio_gateway_authorization_policy.yaml) | Kubernetes | Deployment, Networking | This fault injects an authorization policy which denies all HTTP requests to a Kubernetes Gateway. diff --git a/documentation/library/faults/unassigned-kubernetes-workload-container-resource-limits.md b/documentation/library/faults/unassigned-kubernetes-workload-container-resource-limits.md index dd3598f31..f6e1f241d 100644 --- a/documentation/library/faults/unassigned-kubernetes-workload-container-resource-limits.md +++ b/documentation/library/faults/unassigned-kubernetes-workload-container-resource-limits.md @@ -3,7 +3,7 @@ # Unassigned Kubernetes Workload Container Resource Limits -| [Source](../../../scenarios/sre/library/indexes/faults/unassigned-kubernetes-workload-container-resource-limits.json) | [Schema](../../../schemas/json/faults/unassigned-kubernetes-workload-container-resource-limits.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_unassigned_kubernetes_workload_container_resource_limits.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/unassigned-kubernetes-workload-container-resource-limits.json) | [Schema](../../../schemas/json/faults/unassigned-kubernetes-workload-container-resource-limits.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_unassigned_kubernetes_workload_container_resource_limits.yaml) | Kubernetes | Deployment, Performance | This fault removes the resource limits of an indicated workload container. diff --git a/documentation/library/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.md b/documentation/library/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.md index 818cb3c3e..6ab626265 100644 --- a/documentation/library/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.md +++ b/documentation/library/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.md @@ -3,7 +3,7 @@ # Unschedulable Kubernetes Workload Pod Anti Affinity Rule -| [Source](../../../scenarios/sre/library/indexes/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.json) | [Schema](../../../schemas/json/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.json) | [Schema](../../../schemas/json/faults/unschedulable-kubernetes-workload-pod-anti-affinity-rule.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule.yaml) | Kubernetes | Deployment, Performance | This fault injects an Inter-Pod Anti-Affinity which causes Kubernetes to be unable to schedule the pod. diff --git a/documentation/library/faults/unsupported-architecture-kubernetes-workload-container-image.md b/documentation/library/faults/unsupported-architecture-kubernetes-workload-container-image.md index 1611c657b..78a29b34f 100644 --- a/documentation/library/faults/unsupported-architecture-kubernetes-workload-container-image.md +++ b/documentation/library/faults/unsupported-architecture-kubernetes-workload-container-image.md @@ -3,7 +3,7 @@ # Unsupported Architecture Kubernetes Workload Container Image -| [Source](../../../scenarios/sre/library/indexes/faults/unsupported-architecture-kubernetes-workload-container-image.json) | [Schema](../../../schemas/json/faults/unsupported-architecture-kubernetes-workload-container-image.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_unsupported_architecture_kubernetes_workload_container_image.yaml) | Kubernetes | Deployment, Performance | +| [Source](../../../scenarios/library/indexes/faults/unsupported-architecture-kubernetes-workload-container-image.json) | [Schema](../../../schemas/json/faults/unsupported-architecture-kubernetes-workload-container-image.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_unsupported_architecture_kubernetes_workload_container_image.yaml) | Kubernetes | Deployment, Performance | This fault injects an image with an unsupported architecture into a designated Kubernetes workload's container and assigns it to a node. diff --git a/documentation/library/faults/valkey-workload-changed-password.md b/documentation/library/faults/valkey-workload-changed-password.md index 0749431a4..59b6f9954 100644 --- a/documentation/library/faults/valkey-workload-changed-password.md +++ b/documentation/library/faults/valkey-workload-changed-password.md @@ -3,7 +3,7 @@ # Valkey Workload Changed Password -| [Source](../../../scenarios/sre/library/indexes/faults/valkey-workload-changed-password.json) | [Schema](../../../schemas/json/faults/valkey-workload-changed-password.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_changed_password.yaml) | Kubernetes | Deployment, Authentication | +| [Source](../../../scenarios/library/indexes/faults/valkey-workload-changed-password.json) | [Schema](../../../schemas/json/faults/valkey-workload-changed-password.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_valkey_workload_changed_password.yaml) | Kubernetes | Deployment, Authentication | This fault changes the password of a Valkey workload. diff --git a/documentation/library/faults/valkey-workload-out-of-memory.md b/documentation/library/faults/valkey-workload-out-of-memory.md index 5ed6826f9..e27dd568f 100644 --- a/documentation/library/faults/valkey-workload-out-of-memory.md +++ b/documentation/library/faults/valkey-workload-out-of-memory.md @@ -3,7 +3,7 @@ # Valkey Workload Out of Memory -| [Source](../../../scenarios/sre/library/indexes/faults/valkey-workload-out-of-memory.json) | [Schema](../../../schemas/json/faults/valkey-workload-out-of-memory.json) | [Implementation](../../../scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml) | Kubernetes | Deployment, Code | +| [Source](../../../scenarios/library/indexes/faults/valkey-workload-out-of-memory.json) | [Schema](../../../schemas/json/faults/valkey-workload-out-of-memory.json) | [Implementation](../../../scenarios/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml) | Kubernetes | Deployment, Code | This fault adds a code change to a Valkey workload. This modifies the container to also contain a process which will consume memory. diff --git a/documentation/library/scenarios/README.md b/documentation/library/scenarios/README.md index 7c93db4d8..ee9d50419 100644 --- a/documentation/library/scenarios/README.md +++ b/documentation/library/scenarios/README.md @@ -67,6 +67,10 @@ _For statistics on the distrubution spread of scenarios, please see [here](./sta | [61](./sre/61.md) | sre | medium | | [62](./sre/62.md) | sre | medium | | [63](./sre/63.md) | sre | medium | +| [64](./ciso/64.md) | ciso | medium | +| [65](./ciso/65.md) | ciso | medium | +| [66](./ciso/66.md) | ciso | medium | +| [67](./ciso/67.md) | ciso | high | | [80](./sre/80.md) | sre | medium | | [81](./sre/81.md) | sre | medium | | [83](./sre/83.md) | sre | medium | diff --git a/documentation/library/scenarios/ciso/64.md b/documentation/library/scenarios/ciso/64.md new file mode 100644 index 000000000..40b92caa6 --- /dev/null +++ b/documentation/library/scenarios/ciso/64.md @@ -0,0 +1,36 @@ +> [!NOTE] +> This file is autogenerated. Please do not edit. + +# Scenario 64 + +| [Source](../../../../scenarios/library/indexes/scenarios/64.json) | Medium Complexity | Kubernetes | Compliance, Deployment | + +## Description + +This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using Kyverno and generate a policy to prevent it. + +## Applications + + +## Faults + +- [Active Host Network Kubernetes Deployment](../../../../scenarios/docs/faults.md#Active-Host-Network-Kubernetes-Deployment) + +## Solution Guides + +Below is a noncomprehensive list of step by step guides which can lead to remediating the one or more problems in the scenario. + +A **solution** represents the process of fixing an issue created by a fault. To remediate the issues in the scenarios, follow the solutions in order of appearance. + +A solution can have multiple **variants**. A variant is a different process of deriving the solution. If multiple variants are presented, pick only one to solve the problem. + +### Solution 1 + +#### Variant 1 + +1. Delete the non-compliant Deployment that uses hostNetwork. +```shell +kubectl -n benchmarks delete deployment backend +``` + +2. Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads. diff --git a/documentation/library/scenarios/ciso/65.md b/documentation/library/scenarios/ciso/65.md new file mode 100644 index 000000000..848bfdef9 --- /dev/null +++ b/documentation/library/scenarios/ciso/65.md @@ -0,0 +1,36 @@ +> [!NOTE] +> This file is autogenerated. Please do not edit. + +# Scenario 65 + +| [Source](../../../../scenarios/library/indexes/scenarios/65.json) | Medium Complexity | Kubernetes | Compliance, Deployment | + +## Description + +This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using kubectl and OPA and generate a policy to prevent it. + +## Applications + + +## Faults + +- [Active Host Network Kubernetes Deployment](../../../../scenarios/docs/faults.md#Active-Host-Network-Kubernetes-Deployment) + +## Solution Guides + +Below is a noncomprehensive list of step by step guides which can lead to remediating the one or more problems in the scenario. + +A **solution** represents the process of fixing an issue created by a fault. To remediate the issues in the scenarios, follow the solutions in order of appearance. + +A solution can have multiple **variants**. A variant is a different process of deriving the solution. If multiple variants are presented, pick only one to solve the problem. + +### Solution 1 + +#### Variant 1 + +1. Delete the non-compliant Deployment that uses hostNetwork. +```shell +kubectl -n benchmarks delete deployment backend +``` + +2. Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads. diff --git a/documentation/library/scenarios/ciso/66.md b/documentation/library/scenarios/ciso/66.md new file mode 100644 index 000000000..105051915 --- /dev/null +++ b/documentation/library/scenarios/ciso/66.md @@ -0,0 +1,31 @@ +> [!NOTE] +> This file is autogenerated. Please do not edit. + +# Scenario 66 + +| [Source](../../../../scenarios/library/indexes/scenarios/66.json) | Medium Complexity | RHEL9 | Compliance | + +## Description + +This scenario simulates a RHEL9 host with X11 forwarding enabled in the SSH configuration, violating CIS RHEL9 Benchmark 5.2.6. The agent must detect the violation using Ansible and OPA and generate a policy to prevent it. + +## Applications + + +## Faults + +- [Enabled X11 Forwarding RHEL9 SSHD](../../../../scenarios/docs/faults.md#Enabled-X11-Forwarding-RHEL9-SSHD) + +## Solution Guides + +Below is a noncomprehensive list of step by step guides which can lead to remediating the one or more problems in the scenario. + +A **solution** represents the process of fixing an issue created by a fault. To remediate the issues in the scenarios, follow the solutions in order of appearance. + +A solution can have multiple **variants**. A variant is a different process of deriving the solution. If multiple variants are presented, pick only one to solve the problem. + +### Solution 1 + +#### Variant 1 + +1. Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service. diff --git a/documentation/library/scenarios/ciso/67.md b/documentation/library/scenarios/ciso/67.md new file mode 100644 index 000000000..14cad7625 --- /dev/null +++ b/documentation/library/scenarios/ciso/67.md @@ -0,0 +1,36 @@ +> [!NOTE] +> This file is autogenerated. Please do not edit. + +# Scenario 67 + +| [Source](../../../../scenarios/library/indexes/scenarios/67.json) | High Complexity | Kubernetes | Compliance, Deployment | + +## Description + +This scenario simulates a Kubernetes cluster with existing Kyverno policies that have gaps in their security controls. The agent must extend the policies to remediate the violations without modifying the existing policy rules. + +## Applications + + +## Faults + +- [Non Compliant Kubernetes Pod Deployment](../../../../scenarios/docs/faults.md#Non-Compliant-Kubernetes-Pod-Deployment) + +## Solution Guides + +Below is a noncomprehensive list of step by step guides which can lead to remediating the one or more problems in the scenario. + +A **solution** represents the process of fixing an issue created by a fault. To remediate the issues in the scenarios, follow the solutions in order of appearance. + +A solution can have multiple **variants**. A variant is a different process of deriving the solution. If multiple variants are presented, pick only one to solve the problem. + +### Solution 1 + +#### Variant 1 + +1. Delete the non-compliant Pod. +```shell +kubectl -n benchmarks delete deployment backend +``` + +2. Author and apply a policy that enforces the required security controls for the workload. diff --git a/documentation/library/scenarios/finops/37.md b/documentation/library/scenarios/finops/37.md index 064382fc9..e68a1bbff 100644 --- a/documentation/library/scenarios/finops/37.md +++ b/documentation/library/scenarios/finops/37.md @@ -3,7 +3,7 @@ # Scenario 37 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/37.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/37.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description diff --git a/documentation/library/scenarios/finops/38.md b/documentation/library/scenarios/finops/38.md index 26668cfc1..557d5cf2a 100644 --- a/documentation/library/scenarios/finops/38.md +++ b/documentation/library/scenarios/finops/38.md @@ -3,7 +3,7 @@ # Scenario 38 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/38.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/38.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,9 +15,9 @@ This scenario simulates several OpenTelemetry Demo services being incorrectly au ## Faults -- [Misconfigured Kubernetes Horizontal Pod Autoscaler](../../../../scenarios/sre/docs/faults.md#Misconfigured-Kubernetes-Horizontal-Pod-Autoscaler) -- [Misconfigured Kubernetes Horizontal Pod Autoscaler](../../../../scenarios/sre/docs/faults.md#Misconfigured-Kubernetes-Horizontal-Pod-Autoscaler) -- [Misconfigured Kubernetes Horizontal Pod Autoscaler](../../../../scenarios/sre/docs/faults.md#Misconfigured-Kubernetes-Horizontal-Pod-Autoscaler) +- [Misconfigured Kubernetes Horizontal Pod Autoscaler](../../../../scenarios/docs/faults.md#Misconfigured-Kubernetes-Horizontal-Pod-Autoscaler) +- [Misconfigured Kubernetes Horizontal Pod Autoscaler](../../../../scenarios/docs/faults.md#Misconfigured-Kubernetes-Horizontal-Pod-Autoscaler) +- [Misconfigured Kubernetes Horizontal Pod Autoscaler](../../../../scenarios/docs/faults.md#Misconfigured-Kubernetes-Horizontal-Pod-Autoscaler) ## Solution Guides diff --git a/documentation/library/scenarios/sre/1.md b/documentation/library/scenarios/sre/1.md index c1d789eee..0498936d6 100644 --- a/documentation/library/scenarios/sre/1.md +++ b/documentation/library/scenarios/sre/1.md @@ -3,7 +3,7 @@ # Scenario 1 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/1.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/1.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's services being flooded with req ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/10.md b/documentation/library/scenarios/sre/10.md index c89c354c5..ac9697ec3 100644 --- a/documentation/library/scenarios/sre/10.md +++ b/documentation/library/scenarios/sre/10.md @@ -3,7 +3,7 @@ # Scenario 10 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/10.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/10.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `frontend` service being slow t ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/102.md b/documentation/library/scenarios/sre/102.md index 342a0e3e6..0fd16088b 100644 --- a/documentation/library/scenarios/sre/102.md +++ b/documentation/library/scenarios/sre/102.md @@ -3,7 +3,7 @@ # Scenario 102 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/102.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/102.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `ad` service unable to run due to a ## Faults -- [Insufficient Kubernetes Resource Quota](../../../../scenarios/sre/docs/faults.md#Insufficient-Kubernetes-Resource-Quota) +- [Insufficient Kubernetes Resource Quota](../../../../scenarios/docs/faults.md#Insufficient-Kubernetes-Resource-Quota) ## Solution Guides diff --git a/documentation/library/scenarios/sre/105.md b/documentation/library/scenarios/sre/105.md index c9687c058..2b45939af 100644 --- a/documentation/library/scenarios/sre/105.md +++ b/documentation/library/scenarios/sre/105.md @@ -3,7 +3,7 @@ # Scenario 105 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/105.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/105.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `product-catalog` service having a ## Faults -- [Invalid Kubernetes Workload Container Command](../../../../scenarios/sre/docs/faults.md#Invalid-Kubernetes-Workload-Container-Command) +- [Invalid Kubernetes Workload Container Command](../../../../scenarios/docs/faults.md#Invalid-Kubernetes-Workload-Container-Command) ## Solution Guides diff --git a/documentation/library/scenarios/sre/11.md b/documentation/library/scenarios/sre/11.md index e879ace8d..230bdb697 100644 --- a/documentation/library/scenarios/sre/11.md +++ b/documentation/library/scenarios/sre/11.md @@ -3,7 +3,7 @@ # Scenario 11 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/11.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/11.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `kafka` service experiencing qu ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/114.md b/documentation/library/scenarios/sre/114.md index a3747be90..9856b8ac2 100644 --- a/documentation/library/scenarios/sre/114.md +++ b/documentation/library/scenarios/sre/114.md @@ -3,7 +3,7 @@ # Scenario 114 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/114.json) | Low Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/114.json) | Low Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelementry Demo's `product-catalog` service being un ## Faults -- [Deleted Kubernetes Service](../../../../scenarios/sre/docs/faults.md#Deleted-Kubernetes-Service) +- [Deleted Kubernetes Service](../../../../scenarios/docs/faults.md#Deleted-Kubernetes-Service) ## Solution Guides diff --git a/documentation/library/scenarios/sre/12.md b/documentation/library/scenarios/sre/12.md index 2f868ec2d..1cd7dbd70 100644 --- a/documentation/library/scenarios/sre/12.md +++ b/documentation/library/scenarios/sre/12.md @@ -3,7 +3,7 @@ # Scenario 12 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/12.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/12.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates the OpenTelemetry Demo's `recommendation` and `product-c ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/13.md b/documentation/library/scenarios/sre/13.md index 6bb6aad5f..a9e8a229c 100644 --- a/documentation/library/scenarios/sre/13.md +++ b/documentation/library/scenarios/sre/13.md @@ -3,7 +3,7 @@ # Scenario 13 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/13.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/13.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates the OpenTelemetry Demo's `payment` service experiencing ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/14.md b/documentation/library/scenarios/sre/14.md index 4f6dd4348..e5e796d7f 100644 --- a/documentation/library/scenarios/sre/14.md +++ b/documentation/library/scenarios/sre/14.md @@ -3,7 +3,7 @@ # Scenario 14 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/14.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/14.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates the OpenTelemetry Demo's `ad` and `payment` services exp ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/15.md b/documentation/library/scenarios/sre/15.md index 9adf41f3d..8d48e959b 100644 --- a/documentation/library/scenarios/sre/15.md +++ b/documentation/library/scenarios/sre/15.md @@ -3,7 +3,7 @@ # Scenario 15 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/15.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/15.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates the OpenTelemetry Demo's `ad` and `payment` services exp ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/16.md b/documentation/library/scenarios/sre/16.md index 4df6c207f..3f7943e68 100644 --- a/documentation/library/scenarios/sre/16.md +++ b/documentation/library/scenarios/sre/16.md @@ -3,7 +3,7 @@ # Scenario 16 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/16.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/16.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario changes the environment variables of OpenTelemetry Demo's `shippin ## Faults -- [Modified Kubernetes Workload Container Environment Variable](../../../../scenarios/sre/docs/faults.md#Modified-Kubernetes-Workload-Container-Environment-Variable) +- [Modified Kubernetes Workload Container Environment Variable](../../../../scenarios/docs/faults.md#Modified-Kubernetes-Workload-Container-Environment-Variable) ## Solution Guides diff --git a/documentation/library/scenarios/sre/17.md b/documentation/library/scenarios/sre/17.md index 046aa40d0..9ce0571fe 100644 --- a/documentation/library/scenarios/sre/17.md +++ b/documentation/library/scenarios/sre/17.md @@ -3,7 +3,7 @@ # Scenario 17 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/17.json) | High Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/17.json) | High Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `product-catalog` service experienc ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/18.md b/documentation/library/scenarios/sre/18.md index 9029dc35d..a7056c72a 100644 --- a/documentation/library/scenarios/sre/18.md +++ b/documentation/library/scenarios/sre/18.md @@ -3,7 +3,7 @@ # Scenario 18 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/18.json) | High Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/18.json) | High Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `checkout` service experiencing a f ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/19.md b/documentation/library/scenarios/sre/19.md index fac848291..c4bf590f9 100644 --- a/documentation/library/scenarios/sre/19.md +++ b/documentation/library/scenarios/sre/19.md @@ -3,7 +3,7 @@ # Scenario 19 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/19.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/19.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates a network disconnection or partion between OpenTelemetry ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/2.md b/documentation/library/scenarios/sre/2.md index fcafda775..0d0c0851b 100644 --- a/documentation/library/scenarios/sre/2.md +++ b/documentation/library/scenarios/sre/2.md @@ -3,7 +3,7 @@ # Scenario 2 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/2.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/2.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `cart` service failing. ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/20.md b/documentation/library/scenarios/sre/20.md index 78c8c5e92..aa40b3802 100644 --- a/documentation/library/scenarios/sre/20.md +++ b/documentation/library/scenarios/sre/20.md @@ -3,7 +3,7 @@ # Scenario 20 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/20.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/20.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `product-catalog` service using ## Faults -- [Nonexistent Kubernetes Workload Container Image](../../../../scenarios/sre/docs/faults.md#Nonexistent-Kubernetes-Workload-Container-Image) +- [Nonexistent Kubernetes Workload Container Image](../../../../scenarios/docs/faults.md#Nonexistent-Kubernetes-Workload-Container-Image) ## Solution Guides diff --git a/documentation/library/scenarios/sre/21.md b/documentation/library/scenarios/sre/21.md index ad99151b3..aa84091f3 100644 --- a/documentation/library/scenarios/sre/21.md +++ b/documentation/library/scenarios/sre/21.md @@ -3,7 +3,7 @@ # Scenario 21 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/21.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/21.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `valkey-cart` service experiencing ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/22.md b/documentation/library/scenarios/sre/22.md index 4d9d09645..4951e2dae 100644 --- a/documentation/library/scenarios/sre/22.md +++ b/documentation/library/scenarios/sre/22.md @@ -3,7 +3,7 @@ # Scenario 22 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/22.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/22.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `ad` service experiencing memory st ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/23.md b/documentation/library/scenarios/sre/23.md index d19a9d6e0..53f8d1590 100644 --- a/documentation/library/scenarios/sre/23.md +++ b/documentation/library/scenarios/sre/23.md @@ -3,7 +3,7 @@ # Scenario 23 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/23.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/23.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario changes the environment variables of OpenTelemetry Demo's `shippin ## Faults -- [Unsupported Architecture Kubernetes Workload Container Image](../../../../scenarios/sre/docs/faults.md#Unsupported-Architecture-Kubernetes-Workload-Container-Image) +- [Unsupported Architecture Kubernetes Workload Container Image](../../../../scenarios/docs/faults.md#Unsupported-Architecture-Kubernetes-Workload-Container-Image) ## Solution Guides diff --git a/documentation/library/scenarios/sre/24.md b/documentation/library/scenarios/sre/24.md index dadf30275..67cee7935 100644 --- a/documentation/library/scenarios/sre/24.md +++ b/documentation/library/scenarios/sre/24.md @@ -3,7 +3,7 @@ # Scenario 24 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/24.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/24.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario changes the environment variables of OpenTelemetry Demo's `checkou ## Faults -- [Modified Kubernetes Workload Container Environment Variable](../../../../scenarios/sre/docs/faults.md#Modified-Kubernetes-Workload-Container-Environment-Variable) +- [Modified Kubernetes Workload Container Environment Variable](../../../../scenarios/docs/faults.md#Modified-Kubernetes-Workload-Container-Environment-Variable) ## Solution Guides diff --git a/documentation/library/scenarios/sre/25.md b/documentation/library/scenarios/sre/25.md index 249147b5f..e9a784f4b 100644 --- a/documentation/library/scenarios/sre/25.md +++ b/documentation/library/scenarios/sre/25.md @@ -3,7 +3,7 @@ # Scenario 25 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/25.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/25.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `recommendation` service experienci ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/26.md b/documentation/library/scenarios/sre/26.md index 73a74fb1f..dcae31a34 100644 --- a/documentation/library/scenarios/sre/26.md +++ b/documentation/library/scenarios/sre/26.md @@ -3,7 +3,7 @@ # Scenario 26 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/26.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/26.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates tampered HTTP requests to OpenTelemetry Demo's `email` s ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/27.md b/documentation/library/scenarios/sre/27.md index 36b92fdc0..f6273ba7e 100644 --- a/documentation/library/scenarios/sre/27.md +++ b/documentation/library/scenarios/sre/27.md @@ -3,7 +3,7 @@ # Scenario 27 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/27.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/27.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates aborted HTTP requests to OpenTelemetry Demo's `quote` se ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/29.md b/documentation/library/scenarios/sre/29.md index 023e23e50..b1d00b936 100644 --- a/documentation/library/scenarios/sre/29.md +++ b/documentation/library/scenarios/sre/29.md @@ -3,7 +3,7 @@ # Scenario 29 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/29.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/29.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `ad` service having a Java virtual ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/3.md b/documentation/library/scenarios/sre/3.md index 5f206e691..3ef93c011 100644 --- a/documentation/library/scenarios/sre/3.md +++ b/documentation/library/scenarios/sre/3.md @@ -3,7 +3,7 @@ # Scenario 3 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/3.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/3.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `ad` service experiencing high ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/30.md b/documentation/library/scenarios/sre/30.md index 765a74129..c57c7b788 100644 --- a/documentation/library/scenarios/sre/30.md +++ b/documentation/library/scenarios/sre/30.md @@ -3,7 +3,7 @@ # Scenario 30 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/30.json) | Low Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/30.json) | Low Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario changes the specified port of OpenTelemetry Demo's `ad` service. ## Faults -- [Modified Target Port Kubernetes Service](../../../../scenarios/sre/docs/faults.md#Modified-Target-Port-Kubernetes-Service) +- [Modified Target Port Kubernetes Service](../../../../scenarios/docs/faults.md#Modified-Target-Port-Kubernetes-Service) ## Solution Guides diff --git a/documentation/library/scenarios/sre/31.md b/documentation/library/scenarios/sre/31.md index 72cadcc95..081c20998 100644 --- a/documentation/library/scenarios/sre/31.md +++ b/documentation/library/scenarios/sre/31.md @@ -3,7 +3,7 @@ # Scenario 31 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/31.json) | Low Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/31.json) | Low Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates all ingress traffic being blocked on OpenTelemetry Demo' ## Faults -- [Ingress Port Blocking Network Policy](../../../../scenarios/sre/docs/faults.md#Ingress-Port-Blocking-Network-Policy) +- [Ingress Port Blocking Network Policy](../../../../scenarios/docs/faults.md#Ingress-Port-Blocking-Network-Policy) ## Solution Guides diff --git a/documentation/library/scenarios/sre/33.md b/documentation/library/scenarios/sre/33.md index 7c1374c22..8dc864c9c 100644 --- a/documentation/library/scenarios/sre/33.md +++ b/documentation/library/scenarios/sre/33.md @@ -3,7 +3,7 @@ # Scenario 33 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/33.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/33.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates OpenTelemetry Demo's `ad` and `cart` services being depl ## Faults -- [Nonexistent Kubernetes Workload Node](../../../../scenarios/sre/docs/faults.md#Nonexistent-Kubernetes-Workload-Node) -- [Nonexistent Kubernetes Workload Node](../../../../scenarios/sre/docs/faults.md#Nonexistent-Kubernetes-Workload-Node) +- [Nonexistent Kubernetes Workload Node](../../../../scenarios/docs/faults.md#Nonexistent-Kubernetes-Workload-Node) +- [Nonexistent Kubernetes Workload Node](../../../../scenarios/docs/faults.md#Nonexistent-Kubernetes-Workload-Node) ## Solution Guides diff --git a/documentation/library/scenarios/sre/34.md b/documentation/library/scenarios/sre/34.md index 1931ac0f1..b55d72e7d 100644 --- a/documentation/library/scenarios/sre/34.md +++ b/documentation/library/scenarios/sre/34.md @@ -3,7 +3,7 @@ # Scenario 34 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/34.json) | Low Complexity | Kubernetes | Authentication, Deployment | +| [Source](../../../../scenarios/library/indexes/scenarios/34.json) | Low Complexity | Kubernetes | Authentication, Deployment | ## Description @@ -15,7 +15,7 @@ This scenario simulates the wrong password being set as the user for OpenTelemet ## Faults -- [Valkey Workload Changed Password](../../../../scenarios/sre/docs/faults.md#Valkey-Workload-Changed-Password) +- [Valkey Workload Changed Password](../../../../scenarios/docs/faults.md#Valkey-Workload-Changed-Password) ## Solution Guides diff --git a/documentation/library/scenarios/sre/35.md b/documentation/library/scenarios/sre/35.md index 2a7112e58..e8654baf4 100644 --- a/documentation/library/scenarios/sre/35.md +++ b/documentation/library/scenarios/sre/35.md @@ -3,7 +3,7 @@ # Scenario 35 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/35.json) | High Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/35.json) | High Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `ad` service experiencing heap stre ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/36.md b/documentation/library/scenarios/sre/36.md index 786a2fde4..b33de2c68 100644 --- a/documentation/library/scenarios/sre/36.md +++ b/documentation/library/scenarios/sre/36.md @@ -3,7 +3,7 @@ # Scenario 36 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/36.json) | Medium Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/36.json) | Medium Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates BookInfo's `details` service being unable to accept traf ## Faults -- [Invalid Kubernetes Service Selector](../../../../scenarios/sre/docs/faults.md#Invalid-Kubernetes-Service-Selector) +- [Invalid Kubernetes Service Selector](../../../../scenarios/docs/faults.md#Invalid-Kubernetes-Service-Selector) ## Solution Guides diff --git a/documentation/library/scenarios/sre/39.md b/documentation/library/scenarios/sre/39.md index c73064176..90cc85acd 100644 --- a/documentation/library/scenarios/sre/39.md +++ b/documentation/library/scenarios/sre/39.md @@ -3,7 +3,7 @@ # Scenario 39 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/39.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/39.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `payment` service being unable to s ## Faults -- [Cordoned Kubernetes Worker Node](../../../../scenarios/sre/docs/faults.md#Cordoned-Kubernetes-Worker-Node) +- [Cordoned Kubernetes Worker Node](../../../../scenarios/docs/faults.md#Cordoned-Kubernetes-Worker-Node) ## Solution Guides diff --git a/documentation/library/scenarios/sre/4.md b/documentation/library/scenarios/sre/4.md index f5a3eda7c..384ac33af 100644 --- a/documentation/library/scenarios/sre/4.md +++ b/documentation/library/scenarios/sre/4.md @@ -3,7 +3,7 @@ # Scenario 4 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/4.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/4.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `product catalog` service faili ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/40.md b/documentation/library/scenarios/sre/40.md index 6408aeb04..b3c6de301 100644 --- a/documentation/library/scenarios/sre/40.md +++ b/documentation/library/scenarios/sre/40.md @@ -3,7 +3,7 @@ # Scenario 40 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/40.json) | Low Complexity | Kubernetes | Code, Deployment | +| [Source](../../../../scenarios/library/indexes/scenarios/40.json) | Low Complexity | Kubernetes | Code, Deployment | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `valkey-cart` service experiencing ## Faults -- [Valkey Workload Out of Memory](../../../../scenarios/sre/docs/faults.md#Valkey-Workload-Out-of-Memory) +- [Valkey Workload Out of Memory](../../../../scenarios/docs/faults.md#Valkey-Workload-Out-of-Memory) ## Solution Guides diff --git a/documentation/library/scenarios/sre/41.md b/documentation/library/scenarios/sre/41.md index dd2f1760b..f8acb6df1 100644 --- a/documentation/library/scenarios/sre/41.md +++ b/documentation/library/scenarios/sre/41.md @@ -3,7 +3,7 @@ # Scenario 41 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/41.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/41.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates the OpenTelemetry Demo's `cart` service consuming most o ## Faults -- [Unassigned Kubernetes Workload Container Resource Limits](../../../../scenarios/sre/docs/faults.md#Unassigned-Kubernetes-Workload-Container-Resource-Limits) -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Unassigned Kubernetes Workload Container Resource Limits](../../../../scenarios/docs/faults.md#Unassigned-Kubernetes-Workload-Container-Resource-Limits) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/42.md b/documentation/library/scenarios/sre/42.md index e21e95fb6..ea7879591 100644 --- a/documentation/library/scenarios/sre/42.md +++ b/documentation/library/scenarios/sre/42.md @@ -3,7 +3,7 @@ # Scenario 42 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/42.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/42.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `kafka` service being evicted f ## Faults -- [Priority Kubernetes Workload Priority Preemption](../../../../scenarios/sre/docs/faults.md#Priority-Kubernetes-Workload-Priority-Preemption) +- [Priority Kubernetes Workload Priority Preemption](../../../../scenarios/docs/faults.md#Priority-Kubernetes-Workload-Priority-Preemption) ## Solution Guides diff --git a/documentation/library/scenarios/sre/43.md b/documentation/library/scenarios/sre/43.md index 681117738..4f55c09de 100644 --- a/documentation/library/scenarios/sre/43.md +++ b/documentation/library/scenarios/sre/43.md @@ -3,7 +3,7 @@ # Scenario 43 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/43.json) | Medium Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/43.json) | Medium Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `frontend` service being reach ## Faults -- [Failing Name Resolution Kubernetes Workload DNS Policy](../../../../scenarios/sre/docs/faults.md#Failing-Name-Resolution-Kubernetes-Workload-DNS-Policy) +- [Failing Name Resolution Kubernetes Workload DNS Policy](../../../../scenarios/docs/faults.md#Failing-Name-Resolution-Kubernetes-Workload-DNS-Policy) ## Solution Guides diff --git a/documentation/library/scenarios/sre/44.md b/documentation/library/scenarios/sre/44.md index 6fb1d05b4..4d9a657ae 100644 --- a/documentation/library/scenarios/sre/44.md +++ b/documentation/library/scenarios/sre/44.md @@ -3,7 +3,7 @@ # Scenario 44 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/44.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/44.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates new pods of OpenTelemetry Demo's `payment` service being ## Faults -- [Unschedulable Kubernetes Workload Pod Anti Affinity Rule](../../../../scenarios/sre/docs/faults.md#Unschedulable-Kubernetes-Workload-Pod-Anti-Affinity-Rule) +- [Unschedulable Kubernetes Workload Pod Anti Affinity Rule](../../../../scenarios/docs/faults.md#Unschedulable-Kubernetes-Workload-Pod-Anti-Affinity-Rule) ## Solution Guides diff --git a/documentation/library/scenarios/sre/45.md b/documentation/library/scenarios/sre/45.md index 6b49982a1..083de231d 100644 --- a/documentation/library/scenarios/sre/45.md +++ b/documentation/library/scenarios/sre/45.md @@ -3,7 +3,7 @@ # Scenario 45 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/45.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/45.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates new pods of OpenTelemetry Demo's `email` service being u ## Faults -- [Hanging Kubernetes Workload Init Container](../../../../scenarios/sre/docs/faults.md#Hanging-Kubernetes-Workload-Init-Container) +- [Hanging Kubernetes Workload Init Container](../../../../scenarios/docs/faults.md#Hanging-Kubernetes-Workload-Init-Container) ## Solution Guides diff --git a/documentation/library/scenarios/sre/46.md b/documentation/library/scenarios/sre/46.md index e199a8823..4db8ac5f1 100644 --- a/documentation/library/scenarios/sre/46.md +++ b/documentation/library/scenarios/sre/46.md @@ -3,7 +3,7 @@ # Scenario 46 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/46.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/46.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `postgresql` service not having eno ## Faults -- [Insufficient Kubernetes Workload Container Resources](../../../../scenarios/sre/docs/faults.md#Insufficient-Kubernetes-Workload-Container-Resources) +- [Insufficient Kubernetes Workload Container Resources](../../../../scenarios/docs/faults.md#Insufficient-Kubernetes-Workload-Container-Resources) ## Solution Guides diff --git a/documentation/library/scenarios/sre/47.md b/documentation/library/scenarios/sre/47.md index 243c031fa..34334f245 100644 --- a/documentation/library/scenarios/sre/47.md +++ b/documentation/library/scenarios/sre/47.md @@ -3,7 +3,7 @@ # Scenario 47 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/47.json) | Medium Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/47.json) | Medium Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates BookInfo's `gateway` service unable to receive GET HTTP ## Faults -- [Traffic Denying Istio Gateway Authorization Policy](../../../../scenarios/sre/docs/faults.md#Traffic-Denying-Istio-Gateway-Authorization-Policy) +- [Traffic Denying Istio Gateway Authorization Policy](../../../../scenarios/docs/faults.md#Traffic-Denying-Istio-Gateway-Authorization-Policy) ## Solution Guides diff --git a/documentation/library/scenarios/sre/48.md b/documentation/library/scenarios/sre/48.md index 776e4db37..b1955ba9b 100644 --- a/documentation/library/scenarios/sre/48.md +++ b/documentation/library/scenarios/sre/48.md @@ -3,7 +3,7 @@ # Scenario 48 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/48.json) | Medium Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/48.json) | Medium Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates BookInfo's `gateway` service unable to receive GET HTTP ## Faults -- [Disabled Istio Ambient Mode Kubernetes Namespace](../../../../scenarios/sre/docs/faults.md#Disabled-Istio-Ambient-Mode-Kubernetes-Namespace) +- [Disabled Istio Ambient Mode Kubernetes Namespace](../../../../scenarios/docs/faults.md#Disabled-Istio-Ambient-Mode-Kubernetes-Namespace) ## Solution Guides diff --git a/documentation/library/scenarios/sre/49.md b/documentation/library/scenarios/sre/49.md index 9570bf208..6996bfb6a 100644 --- a/documentation/library/scenarios/sre/49.md +++ b/documentation/library/scenarios/sre/49.md @@ -3,7 +3,7 @@ # Scenario 49 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/49.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/49.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `frontend` service having a malform ## Faults -- [Misconfigured Kubernetes Workload Container Readiness Probe](../../../../scenarios/sre/docs/faults.md#Misconfigured-Kubernetes-Workload-Container-Readiness-Probe) +- [Misconfigured Kubernetes Workload Container Readiness Probe](../../../../scenarios/docs/faults.md#Misconfigured-Kubernetes-Workload-Container-Readiness-Probe) ## Solution Guides diff --git a/documentation/library/scenarios/sre/5.md b/documentation/library/scenarios/sre/5.md index 99ccb88e7..852ff5a85 100644 --- a/documentation/library/scenarios/sre/5.md +++ b/documentation/library/scenarios/sre/5.md @@ -3,7 +3,7 @@ # Scenario 5 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/5.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/5.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `ad` service failing. ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/50.md b/documentation/library/scenarios/sre/50.md index 705eac251..cb9fd7ed5 100644 --- a/documentation/library/scenarios/sre/50.md +++ b/documentation/library/scenarios/sre/50.md @@ -3,7 +3,7 @@ # Scenario 50 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/50.json) | Medium Complexity | Kubernetes | Deployment, Networking | +| [Source](../../../../scenarios/library/indexes/scenarios/50.json) | Medium Complexity | Kubernetes | Deployment, Networking | ## Description @@ -15,7 +15,7 @@ This scenario simulates BookInfo's `productpage-v1` service being unable to comm ## Faults -- [Strict Mutual TLS Istio Service Mesh Enforcement](../../../../scenarios/sre/docs/faults.md#Strict-Mutual-TLS-Istio-Service-Mesh-Enforcement) +- [Strict Mutual TLS Istio Service Mesh Enforcement](../../../../scenarios/docs/faults.md#Strict-Mutual-TLS-Istio-Service-Mesh-Enforcement) ## Solution Guides diff --git a/documentation/library/scenarios/sre/51.md b/documentation/library/scenarios/sre/51.md index d6f672e72..9b164ee3e 100644 --- a/documentation/library/scenarios/sre/51.md +++ b/documentation/library/scenarios/sre/51.md @@ -3,7 +3,7 @@ # Scenario 51 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/51.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/51.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates Kubernetes API server a surge in request during OpenTele ## Faults -- [Kubernetes API Server Request Surge](../../../../scenarios/sre/docs/faults.md#Kubernetes-API-Server-Request-Surge) +- [Kubernetes API Server Request Surge](../../../../scenarios/docs/faults.md#Kubernetes-API-Server-Request-Surge) ## Solution Guides diff --git a/documentation/library/scenarios/sre/52.md b/documentation/library/scenarios/sre/52.md index 25e5592b1..5f5705f8f 100644 --- a/documentation/library/scenarios/sre/52.md +++ b/documentation/library/scenarios/sre/52.md @@ -3,7 +3,7 @@ # Scenario 52 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/52.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/52.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates OpenTelemetry Demo being unable to scale up with load is ## Faults -- [Insufficient Kubernetes Resource Quota](../../../../scenarios/sre/docs/faults.md#Insufficient-Kubernetes-Resource-Quota) -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [Insufficient Kubernetes Resource Quota](../../../../scenarios/docs/faults.md#Insufficient-Kubernetes-Resource-Quota) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/53.md b/documentation/library/scenarios/sre/53.md index 20808a70e..41d9d42c8 100644 --- a/documentation/library/scenarios/sre/53.md +++ b/documentation/library/scenarios/sre/53.md @@ -3,7 +3,7 @@ # Scenario 53 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/53.json) | Medium Complexity | Kubernetes | Deployment | +| [Source](../../../../scenarios/library/indexes/scenarios/53.json) | Medium Complexity | Kubernetes | Deployment | ## Description @@ -15,7 +15,7 @@ This scenario simulates BookInfo's `reviews-v3` service being unable to start du ## Faults -- [Nonexistent Kubernetes Workload Persistent Volume Claim](../../../../scenarios/sre/docs/faults.md#Nonexistent-Kubernetes-Workload-Persistent-Volume-Claim) +- [Nonexistent Kubernetes Workload Persistent Volume Claim](../../../../scenarios/docs/faults.md#Nonexistent-Kubernetes-Workload-Persistent-Volume-Claim) ## Solution Guides diff --git a/documentation/library/scenarios/sre/54.md b/documentation/library/scenarios/sre/54.md index ee54f003e..a72388e91 100644 --- a/documentation/library/scenarios/sre/54.md +++ b/documentation/library/scenarios/sre/54.md @@ -3,7 +3,7 @@ # Scenario 54 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/54.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/54.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates Kubernetes API server being stressed during OpenTelemetr ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/55.md b/documentation/library/scenarios/sre/55.md index 60bb6781a..ba0fef4b2 100644 --- a/documentation/library/scenarios/sre/55.md +++ b/documentation/library/scenarios/sre/55.md @@ -3,7 +3,7 @@ # Scenario 55 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/55.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/55.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates Kubernetes API server experiencing latency during OpenTe ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/56.md b/documentation/library/scenarios/sre/56.md index 2e804a94b..501a57f6d 100644 --- a/documentation/library/scenarios/sre/56.md +++ b/documentation/library/scenarios/sre/56.md @@ -3,7 +3,7 @@ # Scenario 56 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/56.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/56.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `product-catalog` service using ## Faults -- [Nonexistent Kubernetes Workload Container Image](../../../../scenarios/sre/docs/faults.md#Nonexistent-Kubernetes-Workload-Container-Image) +- [Nonexistent Kubernetes Workload Container Image](../../../../scenarios/docs/faults.md#Nonexistent-Kubernetes-Workload-Container-Image) ## Solution Guides diff --git a/documentation/library/scenarios/sre/57.md b/documentation/library/scenarios/sre/57.md index 4642f4103..e6ff7ea0e 100644 --- a/documentation/library/scenarios/sre/57.md +++ b/documentation/library/scenarios/sre/57.md @@ -3,7 +3,7 @@ # Scenario 57 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/57.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/57.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `checkout` service being unable ## Faults -- [Unsupported Architecture Kubernetes Workload Container Image](../../../../scenarios/sre/docs/faults.md#Unsupported-Architecture-Kubernetes-Workload-Container-Image) +- [Unsupported Architecture Kubernetes Workload Container Image](../../../../scenarios/docs/faults.md#Unsupported-Architecture-Kubernetes-Workload-Container-Image) ## Solution Guides diff --git a/documentation/library/scenarios/sre/58.md b/documentation/library/scenarios/sre/58.md index dd6337505..29ea5d4d3 100644 --- a/documentation/library/scenarios/sre/58.md +++ b/documentation/library/scenarios/sre/58.md @@ -3,7 +3,7 @@ # Scenario 58 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/58.json) | Low Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/58.json) | Low Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `accounting` service being scaled t ## Faults -- [Scaled To Zero Kubernetes Workload](../../../../scenarios/sre/docs/faults.md#Scaled-To-Zero-Kubernetes-Workload) +- [Scaled To Zero Kubernetes Workload](../../../../scenarios/docs/faults.md#Scaled-To-Zero-Kubernetes-Workload) ## Solution Guides diff --git a/documentation/library/scenarios/sre/59.md b/documentation/library/scenarios/sre/59.md index 8cc9aba7c..03f38e7bc 100644 --- a/documentation/library/scenarios/sre/59.md +++ b/documentation/library/scenarios/sre/59.md @@ -3,7 +3,7 @@ # Scenario 59 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/59.json) | Medium Complexity | Kubernetes | Code, Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/59.json) | Medium Complexity | Kubernetes | Code, Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates OpenTelemetry Demo's `recommendation` service crashing d ## Faults -- [Crashing Kubernetes Workload Init Container](../../../../scenarios/sre/docs/faults.md#Crashing-Kubernetes-Workload-Init-Container) +- [Crashing Kubernetes Workload Init Container](../../../../scenarios/docs/faults.md#Crashing-Kubernetes-Workload-Init-Container) ## Solution Guides diff --git a/documentation/library/scenarios/sre/6.md b/documentation/library/scenarios/sre/6.md index 330ab2643..4d010190c 100644 --- a/documentation/library/scenarios/sre/6.md +++ b/documentation/library/scenarios/sre/6.md @@ -3,7 +3,7 @@ # Scenario 6 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/6.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/6.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `ad` service undergoing manual ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/60.md b/documentation/library/scenarios/sre/60.md index 1278e8e2f..f2213dd24 100644 --- a/documentation/library/scenarios/sre/60.md +++ b/documentation/library/scenarios/sre/60.md @@ -3,7 +3,7 @@ # Scenario 60 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/60.json) | Medium Complexity | Kubernetes | Code, Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/60.json) | Medium Complexity | Kubernetes | Code, Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates OpenTelemetry Demo's `recommendation` service crashing d ## Faults -- [Crashing Kubernetes Workload Init Container](../../../../scenarios/sre/docs/faults.md#Crashing-Kubernetes-Workload-Init-Container) -- [Unsupported Architecture Kubernetes Workload Container Image](../../../../scenarios/sre/docs/faults.md#Unsupported-Architecture-Kubernetes-Workload-Container-Image) +- [Crashing Kubernetes Workload Init Container](../../../../scenarios/docs/faults.md#Crashing-Kubernetes-Workload-Init-Container) +- [Unsupported Architecture Kubernetes Workload Container Image](../../../../scenarios/docs/faults.md#Unsupported-Architecture-Kubernetes-Workload-Container-Image) ## Solution Guides diff --git a/documentation/library/scenarios/sre/61.md b/documentation/library/scenarios/sre/61.md index be2df37c9..cf1bdb420 100644 --- a/documentation/library/scenarios/sre/61.md +++ b/documentation/library/scenarios/sre/61.md @@ -3,7 +3,7 @@ # Scenario 61 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/61.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/61.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates network loss between OpenTelemetry Demo `checkout` and ` ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/62.md b/documentation/library/scenarios/sre/62.md index 2ff9f0b95..4647b129e 100644 --- a/documentation/library/scenarios/sre/62.md +++ b/documentation/library/scenarios/sre/62.md @@ -3,7 +3,7 @@ # Scenario 62 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/62.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/62.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,8 +15,8 @@ This scenario simulates a network delay with OpenTelemetry Demo `valkey cart`, w ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/63.md b/documentation/library/scenarios/sre/63.md index 57698beaa..77532c0da 100644 --- a/documentation/library/scenarios/sre/63.md +++ b/documentation/library/scenarios/sre/63.md @@ -3,7 +3,7 @@ # Scenario 63 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/63.json) | Medium Complexity | Kubernetes | Authentication, Deployment | +| [Source](../../../../scenarios/library/indexes/scenarios/63.json) | Medium Complexity | Kubernetes | Authentication, Deployment | ## Description @@ -15,7 +15,7 @@ This scenario simulates a credential failure by corrupting the Secret used by th ## Faults -- [Corrupted Kubernetes Secret Credentials](../../../../scenarios/sre/docs/faults.md#Corrupted-Kubernetes-Secret-Credentials) +- [Corrupted Kubernetes Secret Credentials](../../../../scenarios/docs/faults.md#Corrupted-Kubernetes-Secret-Credentials) ## Solution Guides @@ -31,7 +31,7 @@ A solution can have multiple **variants**. A variant is a different process of d 1. Inspect the corrupted secret to identify the invalid data. ```shell -kubectl -n {{ args.kubernetesObject.metadata.namespace }} get secret {{ args.kubernetesObject.metadata.name }} -o yaml +kubectl -n otel-demo get secret email-service-secret -o yaml ``` 2. Restore the secret with correct credentials from the credential management system. diff --git a/documentation/library/scenarios/sre/7.md b/documentation/library/scenarios/sre/7.md index 17413a566..de3cdf7ae 100644 --- a/documentation/library/scenarios/sre/7.md +++ b/documentation/library/scenarios/sre/7.md @@ -3,7 +3,7 @@ # Scenario 7 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/7.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/7.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `payment` service failing. ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/8.md b/documentation/library/scenarios/sre/8.md index a08b8e562..d4972080a 100644 --- a/documentation/library/scenarios/sre/8.md +++ b/documentation/library/scenarios/sre/8.md @@ -3,7 +3,7 @@ # Scenario 8 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/8.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/8.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates the OpenTelemetry Demo's `payment` service becoming unre ## Faults -- [OpenTelemetry Demo Feature Flag](../../../../scenarios/sre/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) +- [OpenTelemetry Demo Feature Flag](../../../../scenarios/docs/faults.md#OpenTelemetry-Demo-Feature-Flag) ## Solution Guides diff --git a/documentation/library/scenarios/sre/80.md b/documentation/library/scenarios/sre/80.md index 24ba0ab34..d42d21fa6 100644 --- a/documentation/library/scenarios/sre/80.md +++ b/documentation/library/scenarios/sre/80.md @@ -3,7 +3,7 @@ # Scenario 80 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/80.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/80.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates a network disconnection or partion between OpenTelemetry ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/81.md b/documentation/library/scenarios/sre/81.md index 9c049fe4d..498ebf2a2 100644 --- a/documentation/library/scenarios/sre/81.md +++ b/documentation/library/scenarios/sre/81.md @@ -3,7 +3,7 @@ # Scenario 81 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/81.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/81.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates a network disconnection or partion between OpenTelemetry ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/83.md b/documentation/library/scenarios/sre/83.md index d9ad9d7c1..5035aebc8 100644 --- a/documentation/library/scenarios/sre/83.md +++ b/documentation/library/scenarios/sre/83.md @@ -3,7 +3,7 @@ # Scenario 83 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/83.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/83.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates a network disconnection or partion between OpenTelemetry ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/sre/91.md b/documentation/library/scenarios/sre/91.md index b89c53e69..d5876af2b 100644 --- a/documentation/library/scenarios/sre/91.md +++ b/documentation/library/scenarios/sre/91.md @@ -3,7 +3,7 @@ # Scenario 91 -| [Source](../../../../scenarios/sre/library/indexes/scenarios/91.json) | Medium Complexity | Kubernetes | Deployment, Performance | +| [Source](../../../../scenarios/library/indexes/scenarios/91.json) | Medium Complexity | Kubernetes | Deployment, Performance | ## Description @@ -15,7 +15,7 @@ This scenario simulates a network disconnection or partion between OpenTelemetry ## Faults -- [Scheduled Chaos Mesh Experiment](../../../../scenarios/sre/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) +- [Scheduled Chaos Mesh Experiment](../../../../scenarios/docs/faults.md#Scheduled-Chaos-Mesh-Experiment) ## Solution Guides diff --git a/documentation/library/scenarios/statistics.md b/documentation/library/scenarios/statistics.md index 3cf98f5d1..53c4814b5 100644 --- a/documentation/library/scenarios/statistics.md +++ b/documentation/library/scenarios/statistics.md @@ -7,16 +7,16 @@ | BookInfo | OpenTelemetry Demo | | --- | --- | -| 5 | 36 | +| 5 | 62 | ## Category Distribution | FinOps | SRE | | --- | --- | -| 2 | 39 | +| 2 | 65 | ## Complexity Distribution | Low | Medium | High | | --- | --- | --- | -| 17 | 23 | 1 | +| 17 | 50 | 4 | diff --git a/documentation/library/waiters/README.md b/documentation/library/waiters/README.md index c41b0d21f..7c2362a68 100644 --- a/documentation/library/waiters/README.md +++ b/documentation/library/waiters/README.md @@ -11,3 +11,4 @@ ITBench uses waiters before and after fault injection to ensure that certain act | [Pause Execution](./pause-execution.md) | Kubernetes | | [Restart Kubernetes Workload](./restart-kubernetes-workload.md) | Kubernetes | | [Scale Kubernetes Workload](./scale-kubernetes-workload.md) | Kubernetes | +| [Verify Kyverno Policy Report Creation](./verify-kyverno-policy-report-creation.md) | Kubernetes | diff --git a/documentation/library/waiters/delete-workload-pods.md b/documentation/library/waiters/delete-workload-pods.md index 84da8a8fe..3de241ef5 100644 --- a/documentation/library/waiters/delete-workload-pods.md +++ b/documentation/library/waiters/delete-workload-pods.md @@ -3,6 +3,6 @@ # Delete Workload Pods -| [Source](../../../scenarios/sre/library/indexes/waiters/delete-workload-pods.json) | [Schema](../../../schemas/json/waiters/delete-workload-pods.json) | Kubernetes | +| [Source](../../../scenarios/library/indexes/waiters/delete-workload-pods.json) | [Schema](../../../schemas/json/waiters/delete-workload-pods.json) | Kubernetes | Deletes all the pods associated with a Kubernetes workload. diff --git a/documentation/library/waiters/pause-execution.md b/documentation/library/waiters/pause-execution.md index 6d40cb4b6..e7818edd7 100644 --- a/documentation/library/waiters/pause-execution.md +++ b/documentation/library/waiters/pause-execution.md @@ -3,6 +3,6 @@ # Pause Execution -| [Source](../../../scenarios/sre/library/indexes/waiters/pause-execution.json) | [Schema](../../../schemas/json/waiters/pause-execution.json) | Kubernetes | +| [Source](../../../scenarios/library/indexes/waiters/pause-execution.json) | [Schema](../../../schemas/json/waiters/pause-execution.json) | Kubernetes | Pauses for the requested number of seconds. diff --git a/documentation/library/waiters/restart-kubernetes-workload.md b/documentation/library/waiters/restart-kubernetes-workload.md index e8287b355..5d6814d4c 100644 --- a/documentation/library/waiters/restart-kubernetes-workload.md +++ b/documentation/library/waiters/restart-kubernetes-workload.md @@ -3,6 +3,6 @@ # Restart Kubernetes Workload -| [Source](../../../scenarios/sre/library/indexes/waiters/restart-kubernetes-workload.json) | [Schema](../../../schemas/json/waiters/restart-kubernetes-workload.json) | Kubernetes | +| [Source](../../../scenarios/library/indexes/waiters/restart-kubernetes-workload.json) | [Schema](../../../schemas/json/waiters/restart-kubernetes-workload.json) | Kubernetes | Waits for a Kubernetes workload to be restarted. diff --git a/documentation/library/waiters/scale-kubernetes-workload.md b/documentation/library/waiters/scale-kubernetes-workload.md index 886014f15..63019234e 100644 --- a/documentation/library/waiters/scale-kubernetes-workload.md +++ b/documentation/library/waiters/scale-kubernetes-workload.md @@ -3,6 +3,6 @@ # Scale Kubernetes Workload -| [Source](../../../scenarios/sre/library/indexes/waiters/scale-kubernetes-workload.json) | [Schema](../../../schemas/json/waiters/scale-kubernetes-workload.json) | Kubernetes | +| [Source](../../../scenarios/library/indexes/waiters/scale-kubernetes-workload.json) | [Schema](../../../schemas/json/waiters/scale-kubernetes-workload.json) | Kubernetes | Waits for a Kubernetes workload to scale to the requested number of replicas. diff --git a/documentation/library/waiters/verify-kyverno-policy-report-creation.md b/documentation/library/waiters/verify-kyverno-policy-report-creation.md new file mode 100644 index 000000000..4a897b584 --- /dev/null +++ b/documentation/library/waiters/verify-kyverno-policy-report-creation.md @@ -0,0 +1,8 @@ +>[!NOTE] +>This file is autogenerated. Please do not edit. + +# Verify Kyverno Policy Report Creation + +| [Source](../../../scenarios/library/indexes/waiters/verify-kyverno-policy-report-creation.json) | [Schema](../../../schemas/json/waiters/verify-kyverno-policy-report-creation.json) | Kubernetes | + +Verifies that Kyverno has created a PolicyReport scoped to the target Kubernetes workload. diff --git a/pyproject.toml b/pyproject.toml index 7c914ad8a..4d0d841dd 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -10,6 +10,7 @@ dependencies = [ "ansible-runner==2.4.3", "awxkit==24.6.1", "boto3==1.43.70", + "docker==7.2.0", "jsonschema==4.26.0", "kubernetes==36.0.3", "molecule==26.8.0", diff --git a/renovate.json b/renovate.json index 66cb4297b..fa2fd7c76 100644 --- a/renovate.json +++ b/renovate.json @@ -34,7 +34,7 @@ { "enabled": false, "matchFileNames": [ - "scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml" + "scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml" ], "matchManagers": [ "ansible" diff --git a/requirements.yaml b/requirements.yaml index ab6d60929..d60299931 100644 --- a/requirements.yaml +++ b/requirements.yaml @@ -1,9 +1,9 @@ collections: - name: amazon.aws version: 11.4.0 - - name: ansible.posix - version: 2.2.2 - name: awx.awx version: 24.6.1 + - name: community.docker + version: 5.2.2 - name: kubernetes.core version: 6.5.0 diff --git a/scenarios/sre/Makefile b/scenarios/Makefile similarity index 76% rename from scenarios/sre/Makefile rename to scenarios/Makefile index 5739f0abc..b4a4b611e 100644 --- a/scenarios/sre/Makefile +++ b/scenarios/Makefile @@ -1,4 +1,5 @@ UV = $(shell which uv) +DOCKER := $(shell command -v docker 2>/dev/null) .PHONY: help help: ## Display this help. @@ -11,6 +12,8 @@ group-vars: ## Generates the group variables cp inventory/group_vars/environment/applications.yaml.example inventory/group_vars/environment/applications.yaml cp inventory/group_vars/environment/cluster.yaml.example inventory/group_vars/environment/cluster.yaml cp inventory/group_vars/environment/tools.yaml.example inventory/group_vars/environment/tools.yaml + cp inventory/group_vars/environment/virtual_machine.yaml.example inventory/group_vars/environment/virtual_machine.yaml + cp inventory/group_vars/environment/evaluation.yaml.example inventory/group_vars/environment/evaluation.yaml cp inventory/group_vars/runner/agent.yaml.example inventory/group_vars/runner/agent.yaml cp inventory/group_vars/runner/experiments.yaml.example inventory/group_vars/runner/experiments.yaml cp inventory/group_vars/runner/github.yaml.example inventory/group_vars/runner/github.yaml @@ -24,12 +27,12 @@ generate-library: ## Generates library indexes, schemas, and other related docum --playbooks_directory=$(abspath ./project) $(UV) run scripts/generate_library_index_schemas.py \ --library_index_directory=$(abspath ./library/indexes) \ - --schemas_directory=$(abspath ../../schemas/json) \ + --schemas_directory=$(abspath ../schemas/json) \ --templates_directory=$(abspath ./templates/schemas/json/library/index) $(UV) run scripts/generate_library_readmes.py \ --templates_directory=$(abspath ./templates/documentation/library) \ --library_index_directory=$(abspath ./library/indexes) \ - --documentation_directory=$(abspath ../../documentation/library) + --documentation_directory=$(abspath ../documentation/library) .PHONY: generate-fault-index generate-fault-index: ## Generate a new fault index based on user input @@ -42,13 +45,13 @@ generate-scenario-index: ## Generate a new scenario index based on user input .PHONY: generate-resource-files generate-resource-files: ## Generates task files, scenario manifests, and other related files $(UV) run ansible-playbook -i inventory project/manage_resource_files.yaml --tags "generate_files" - cd ../../ && $(UV) run ansible-lint $(abspath project/roles/scenarios/files) --fix + cd ../ && $(UV) run ansible-lint $(abspath project/roles/scenarios/files) --fix .PHONY: validate-library validate-library: ## Validates library indexes $(UV) run scripts/validate_library_indexes.py \ --library_index_directory=$(abspath ./library/indexes) \ - --schemas_directory=$(abspath ../../schemas/json) + --schemas_directory=$(abspath ../schemas/json) .PHONY: deploy-tools deploy-tools: ## Deploys the observability and fault tools to cluster @@ -118,6 +121,31 @@ else @echo "Missing SCENARIO_NUMBER argument. Please run this command with this variable." endif +.PHONY: evaluate-scenario +evaluate-scenario: ## Evaluate scenario compliance (requires SCENARIO_NUMBER) +ifndef SCENARIO_NUMBER + @echo "Usage: make evaluate-scenario SCENARIO_NUMBER=64" + @exit 1 +endif + $(UV) run scripts/evaluate_scenario.py \ + --groundtruth project/roles/scenarios/files/scenario_$(SCENARIO_NUMBER)/groundtruth.yaml \ + --output /tmp/evaluation_result_$(SCENARIO_NUMBER).json + @cat /tmp/evaluation_result_$(SCENARIO_NUMBER).json +.PHONY: watch-scenario-evaluation +watch-scenario-evaluation: ## Watch scenario evaluation until pass (requires SCENARIO_NUMBER) +ifndef SCENARIO_NUMBER + @echo "Usage: make watch-scenario-evaluation SCENARIO_NUMBER=64" + @exit 1 +endif + @echo "Note: Prometheus is accessed at http://prometheus:9090 (set up by tools role)" + @echo " Run 'make display-endpoints' to see all tool URLs" + $(UV) run scripts/watch_scenario_evaluation.py \ + --private_project_directory . \ + --scenario_id $(SCENARIO_NUMBER) + + + + .PHONY: remove-fault-resources remove-fault-resources: ## Removes resources used during fault injection $(UV) run ansible-playbook -i inventory project/manage_faults.yaml --tags "remove_faults" @@ -147,6 +175,14 @@ endif disable-agent-access: ## Removes access controls for llm agent $(UV) run ansible-playbook -i inventory project/manage_agent_access.yaml --tags "revoke_access" +.PHONY: enable-virtual-machine-access +enable-virtual-machine-access: ## Adds SSH access provisioning for RHEL9 virtual machine (scenario 66) + $(UV) run ansible-playbook -i inventory project/manage_virtual_machine_access.yaml --tags "grant_access" + +.PHONY: disable-virtual-machine-access +disable-virtual-machine-access: ## Removes SSH access provisioning for RHEL9 virtual machine + $(UV) run ansible-playbook -i inventory project/manage_virtual_machine_access.yaml --tags "revoke_access" + .PHONY: deploy-awx deploy-awx: ## Deploys AWX to a cluster $(UV) run ansible-playbook -i inventory project/manage_awx.yaml --tags "install_tools" @@ -188,8 +224,18 @@ test-molecule-awx: ## Runs Molecule tests for the AWX role cd project/roles/awx && $(UV) run molecule test --all --report --command-borders .PHONY: test-molecule-faults -test-molecule-faults: ## Runs Molecule tests for the Faults role - cd project/roles/faults && $(UV) run molecule test --all --report --command-borders +test-molecule-faults: ## Runs Molecule tests for the Faults role (excludes Docker-dependent scenarios) + cd project/roles/faults && $(UV) run molecule test --all --report --command-borders \ + --exclude inject_enabled_x11_forwarding_rhel9_sshd +ifneq ($(DOCKER),) + cd project/roles/faults && $(UV) run molecule test --scenario-name inject_enabled_x11_forwarding_rhel9_sshd --report --command-borders +endif + +.PHONY: test-molecule-virtual-machine +test-molecule-virtual-machine: ## Runs Molecule tests for the Virtual Machine role +ifneq ($(DOCKER),) + cd project/roles/virtual_machine && $(UV) run molecule test --all --report --command-borders +endif .PHONY: test-molecule-waiters test-molecule-waiters: ## Runs Molecule tests for the Waiters role @@ -205,7 +251,10 @@ test-scripts: ## Run unit tests for Python scripts .PHONY: generate-agent-bundle generate-agent-bundle: ## Generates a bundle for an LLM Agent to interface with - ANSIBLE_STDOUT_CALLBACK=ansible.posix.json $(UV) run ansible-playbook -i inventory project/generate_agent_bundle.yaml | jq -r '.plays[].tasks[] | select(.task.name == "Print agent bundle") | .hosts.localhost.msg' + @mkdir -p tmp + @$(UV) run ansible-playbook -i inventory project/generate_agent_bundle.yaml >/dev/null 2>&1 + @cat tmp/bundle.json + @rm -rf tmp .PHONY: generate-leaderboard-bundle-status generate-leaderboard-bundle-status: ## Generates a bundle status for Leaderboard to interface with @@ -214,3 +263,13 @@ generate-leaderboard-bundle-status: ## Generates a bundle status for Leaderboard .PHONY: generate-leaderboard-bundle generate-leaderboard-bundle: ## Generates a bundle of scenarios for the Leaderboard to interface $(UV) run ansible-playbook -i inventory project/generate_leaderboard_bundle.yaml + +.PHONY: watch-scenario-evaluation +watch-scenario-evaluation: ## Polls evaluation checks until all pass or the time window expires +ifdef SCENARIO_NUMBER + $(UV) run scripts/watch_scenario_evaluation.py \ + --private_project_directory $(abspath .) \ + --scenario_id $(SCENARIO_NUMBER) +else + @echo "Missing SCENARIO_NUMBER argument. Please run this command with this variable." +endif diff --git a/scenarios/README.md b/scenarios/README.md index dc7666c2a..eeee94167 100644 --- a/scenarios/README.md +++ b/scenarios/README.md @@ -13,6 +13,42 @@ These scenarios simulate compliance-related misconfigurations. Each scenario pro CISO scenarios are located [here](./ciso). +### Agent Access for CISO Scenarios + +CISO scenarios grant the LLM agent restricted, scoped access to the environment rather than full admin credentials. The method depends on whether the scenario targets a Kubernetes cluster or a RHEL9 virtual machine. + +#### Kubernetes-based scenarios (64, 65, 67) + +These scenarios inject faults into the `benchmarks` namespace. Run the command below to create a scoped ServiceAccount, namespace-level RBAC, and a short-lived token, then publish a restricted kubeconfig to the configured storage location: + +```bash +make enable-agent-access SCENARIO_NUMBER=<64|65|67> +``` + +The agent receives the restricted kubeconfig via `make generate-agent-bundle`. The bundle reads the kubeconfig from storage — never from the admin kubeconfig. + +To revoke access after the scenario: + +```bash +make disable-agent-access +``` + +#### Virtual machine scenario (66) + +Scenario 66 has no Kubernetes fault injection. The agent instead needs SSH access to the RHEL9 machine. Run: + +```bash +make enable-virtual-machine-access +``` + +This provisions a dedicated user on the VM, generates an SSH keypair, and writes an Ansible inventory file to local storage for the agent to consume. + +To revoke access after the scenario: + +```bash +make disable-virtual-machine-access +``` + ## [SRE Scenarios](./sre) These scenarios focus on observability and incident response. Each scenario includes: - A comprehensive observability stack deployment featuring: diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/Makefile b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/Makefile deleted file mode 100644 index 49e82541d..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/Makefile +++ /dev/null @@ -1,83 +0,0 @@ -help: - @echo "Makefile commands:" - @echo "deploy_bundle -- [onetime] deploys the bundle to the cluster" - @echo "inject_fault -- [onetime] define a new policy (policies) and enable fault for hitting CIS Benchmark controls" - @echo "destroy_bundle -- [onetime] destroy the target environment" - @echo "revert_bundle -- [onetime] revert the target environment" - @echo "get -- [onetime] get status and evaluation" - @echo "get_status -- [onetime] get status" - @echo "evaluate -- [onetime] evaluate" - @echo "Option FOREGROUND=true for synchronous execution. Default execute as background job." - @echo "help - Display this help information" - -export WORK_DIR = /tmp/scenario - -INPUT_FILE ?= -DEFAULT_INPUT_FILE := input.json -PASSED_INPUT_FILE := $(WORK_DIR)/input.json -export BUNDLE_INPUT_FILE := $(PASSED_INPUT_FILE) - -# parameters to replace default input.json -KUBECONFIG := -SHARED_WORKSPACE := -JQ_UPDATE_TEMPLATE = if [ -n "$(1)" ]; then \ - jq --arg key_value "$(1)" '.$(2) = $$key_value' $(PASSED_INPUT_FILE) > tmp.json && mv tmp.json $(PASSED_INPUT_FILE) ;\ -fi - -ifeq ($(FOREGROUND), true) - REDIRECT := - BG := -else - REDIRECT := &> $$WORK_DIR/$(LOG_FILE) - BG := & -endif - -ifeq ($(TEST), true) - PLAYBOOK_DIR := ./stubs -else - PLAYBOOK_DIR := ./playbooks -endif - -prepare_directory: - @mkdir -p "$(WORK_DIR)" - @if [ -z "$(INPUT_FILE)" ]; then \ - echo "Using default input file with override by parameters" 1>&2;\ - cp $(DEFAULT_INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - $(call JQ_UPDATE_TEMPLATE,$(KUBECONFIG),kubeconfig);\ - $(call JQ_UPDATE_TEMPLATE,$(SHARED_WORKSPACE),shared_workspace);\ - else \ - echo "Using provided input file" 1>&2;\ - cp $(INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - fi - -deploy_bundle: prepare_directory - @cat status.template.json > $$WORK_DIR/status.json - @$(MAKE) run_playbook LOG_FILE=deploy.log PLAYBOOK=deploy.yml - -inject_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=execute.log PLAYBOOK=execute.yml - -destroy_bundle: prepare_directory - @$(MAKE) run_playbook LOG_FILE=destroy.log PLAYBOOK=destroy.yml - -remove_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=remove.log PLAYBOOK=fault_removal.yml - -revert: prepare_directory - @$(MAKE) run_playbook LOG_FILE=revert.log PLAYBOOK=revert.yml - -run_playbook: prepare_directory - @echo "ansible-playbook ./$(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG)" - @ansible-playbook ./$(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG) - -get: prepare_directory - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=goal.log PLAYBOOK=goal.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/goal.json \"" 1>&2 - @jq -s '{metadata: .[0]}' info.json | jq .goal_template=input.goal - $$WORK_DIR/goal.json | jq .vars=input.vars - $$WORK_DIR/goal.json - -get_status: prepare_directory - @cat $$WORK_DIR/status.json - -evaluate: - @echo "ansible-playbook $(PLAYBOOK_DIR)/evaluate.yml --extra-vars \"path_to_output=$(WORK_DIR)/evaluation.json \" &> $$WORK_DIR/evaluate.log" 1>&2 - @ansible-playbook $(PLAYBOOK_DIR)/evaluate.yml --extra-vars "path_to_output=$(WORK_DIR)/evaluation.json" &> $$WORK_DIR/evaluate.log || (cat $$WORK_DIR/evaluate.log && false) - @cat $(WORK_DIR)/evaluation.json diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/evaluation/main.py b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/evaluation/main.py deleted file mode 100644 index 24fafc0fb..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/evaluation/main.py +++ /dev/null @@ -1,130 +0,0 @@ -# Copyright contributors to the ITBench project. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -import argparse -import json -import yaml -import logging -from pathlib import Path - -logger = logging.getLogger(__name__) -log_format = '[%(asctime)s %(levelname)s %(name)s] %(message)s' - - -def main(): - parser = argparse.ArgumentParser( - description="Evaluate if the Playbook to check the provided CIS Kubernetes Benchmark issue(s) exists and is working." - ) - parser.add_argument( - "-polr", "--policy-reports", type=str, help="Path to the aggregated policy report in JSON format (kubectl get polr -A -o json)", required=True - ) - parser.add_argument( - "-cpolr", - "--cluster-policy-reports", - type=str, - help="Path to the aggregated cluster policy report in JSON format (kubectl get cpolr -A -o json)", - required=True, - ) - parser.add_argument( - "--api-version", - type=str, - help="Resource Api Version", - required=True, - ) - parser.add_argument( - "--kind", - type=str, - help="Resource Kind", - required=True, - ) - parser.add_argument( - "--namespace", - type=str, - help="Resource Namespace", - required=True, - ) - parser.add_argument( - "--name", - type=str, - help="Resource Name", - required=True, - ) - parser.add_argument( - "--agent-output", - type=str, - help="Directory of Agent Output", - required=True, - ) - parser.add_argument("-o", "--out", type=str, help="Path to output JSON file (default: stdout)") - - args = parser.parse_args() - - polr_path = Path(args.policy_reports) - with polr_path.open("r") as f: - polr = json.load(f) - - cpolr_path = Path(args.cluster_policy_reports) - with cpolr_path.open("r") as f: - cpolr = json.load(f) - - target = { - "apiVersion": args.api_version, - "kind": args.kind, - "namespace": args.namespace, - "name": args.name, - } - logger.info(f"Checking ApiVersion: {json.dumps(target)}") - policy_reports = polr["items"] + cpolr["items"] - summaries = [] - for p in policy_reports: - scope = p["scope"] - if ( - scope["apiVersion"] == target["apiVersion"] - and scope["kind"] == target["kind"] - and (scope["namespace"] == target["namespace"] if "namespace" in scope else True) - and scope["name"] == target["name"] - ): - summaries.append(p["summary"]) - - failures = [x for x in summaries if x["fail"] > 0] - detected = len(failures) > 0 - - is_generate_policy = False - is_evidence_available = False - agent_output = Path(args.agent_output) - if agent_output.exists(): - is_evidence_available = True - yaml_files = list(agent_output.glob("*.yaml")) + list(agent_output.glob("*.yml")) - for yaml_file in yaml_files: - try: - yaml_data = yaml.safe_load(yaml_file.open("r")) - if yaml_data.get("kind") in ["Policy", "ClusterPolicy"]: - is_generate_policy = True - except Exception as e: - logger.error(f"{e}") - tasks = { - "generate_assessment_posture": detected, - "generate_policy": is_generate_policy, - "evidence_available": is_evidence_available, - } - output = json.dumps({"pass": detected, "tasks": tasks}, indent=2) - if args.out: - with open(args.out, "w") as f: - f.write(output) - else: - print(output) - - -if __name__ == "__main__": - main() diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/examples/example_policy.yaml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/examples/example_policy.yaml deleted file mode 100644 index 570cdfcfc..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/examples/example_policy.yaml +++ /dev/null @@ -1,41 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: disallow-host-namespaces - annotations: - policies.kyverno.io/title: Disallow Host Namespaces - policies.kyverno.io/category: Pod Security Standards (Baseline) - policies.kyverno.io/severity: medium - kyverno.io/kyverno-version: 1.6.0 - kyverno.io/kubernetes-version: "1.22-1.23" - policies.kyverno.io/subject: Pod - policies.kyverno.io/description: >- - Host namespaces (Process ID namespace, Inter-Process Communication namespace, and - network namespace) allow access to shared information and can be used to elevate - privileges. Pods should not be allowed access to host namespaces. This policy ensures - fields which make use of these host namespaces are unset or set to `false`. -spec: - validationFailureAction: Audit - background: true - rules: - - name: host-namespaces - exclude: - any: - - resources: - namespaces: - - kube-system - - local-path-storage - match: - any: - - resources: - kinds: - - Pod - validate: - message: >- - Sharing the host namespaces is disallowed. The fields spec.hostNetwork, - spec.hostIPC, and spec.hostPID must be unset or set to `false`. - pattern: - spec: - =(hostPID): "false" - =(hostIPC): "false" - =(hostNetwork): "false" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/examples/example_report.json b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/examples/example_report.json deleted file mode 100644 index d4ca4b9d4..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/examples/example_report.json +++ /dev/null @@ -1,161 +0,0 @@ -[ - { - "apiVersion": "wgpolicyk8s.io/v1alpha2", - "kind": "PolicyReport", - "metadata": { - "creationTimestamp": "2024-10-05T23:56:09Z", - "generation": 2, - "labels": { - "app.kubernetes.io/managed-by": "kyverno" - }, - "name": "12f91bc5-a630-4f45-a1d9-c4705c81fe47", - "namespace": "paa", - "ownerReferences": [ - { - "apiVersion": "v1", - "kind": "Pod", - "name": "nginx-deployment-7cb5b996ff-p59gj", - "uid": "12f91bc5-a630-4f45-a1d9-c4705c81fe47" - } - ], - "resourceVersion": "36795", - "uid": "902712fa-3ec2-43c5-bd56-1041e1726b6d" - }, - "results": [ - { - "category": "Pod Security Standards (Baseline)", - "message": "validation error: Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must be unset or set to `false`. rule host-namespaces failed at path /spec/hostNetwork/", - "policy": "disallow-host-namespaces", - "result": "fail", - "rule": "host-namespaces", - "scored": true, - "severity": "medium", - "source": "kyverno", - "timestamp": { - "nanos": 0, - "seconds": 1728172579 - } - } - ], - "scope": { - "apiVersion": "v1", - "kind": "Pod", - "name": "nginx-deployment-7cb5b996ff-p59gj", - "namespace": "paa", - "uid": "12f91bc5-a630-4f45-a1d9-c4705c81fe47" - }, - "summary": { - "error": 0, - "fail": 1, - "pass": 0, - "skip": 0, - "warn": 0 - } - }, - { - "apiVersion": "wgpolicyk8s.io/v1alpha2", - "kind": "PolicyReport", - "metadata": { - "creationTimestamp": "2024-10-05T23:56:29Z", - "generation": 1, - "labels": { - "app.kubernetes.io/managed-by": "kyverno" - }, - "name": "4bf816f0-a2bb-444f-ad45-054cc6c3af9a", - "namespace": "paa", - "ownerReferences": [ - { - "apiVersion": "apps/v1", - "kind": "ReplicaSet", - "name": "nginx-deployment-7cb5b996ff", - "uid": "4bf816f0-a2bb-444f-ad45-054cc6c3af9a" - } - ], - "resourceVersion": "36792", - "uid": "888aef5e-d28f-4399-a92b-489ac4d5f4a1" - }, - "results": [ - { - "category": "Pod Security Standards (Baseline)", - "message": "validation error: Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must be unset or set to `false`. rule autogen-host-namespaces failed at path /spec/template/spec/hostNetwork/", - "policy": "disallow-host-namespaces", - "result": "fail", - "rule": "autogen-host-namespaces", - "scored": true, - "severity": "medium", - "source": "kyverno", - "timestamp": { - "nanos": 0, - "seconds": 1728172579 - } - } - ], - "scope": { - "apiVersion": "apps/v1", - "kind": "ReplicaSet", - "name": "nginx-deployment-7cb5b996ff", - "namespace": "paa", - "uid": "4bf816f0-a2bb-444f-ad45-054cc6c3af9a" - }, - "summary": { - "error": 0, - "fail": 1, - "pass": 0, - "skip": 0, - "warn": 0 - } - }, - { - "apiVersion": "wgpolicyk8s.io/v1alpha2", - "kind": "PolicyReport", - "metadata": { - "creationTimestamp": "2024-10-05T23:56:09Z", - "generation": 2, - "labels": { - "app.kubernetes.io/managed-by": "kyverno" - }, - "name": "fe79bc1f-ec25-42df-97bb-45f2122822ef", - "namespace": "paa", - "ownerReferences": [ - { - "apiVersion": "apps/v1", - "kind": "Deployment", - "name": "nginx-deployment", - "uid": "fe79bc1f-ec25-42df-97bb-45f2122822ef" - } - ], - "resourceVersion": "36791", - "uid": "31a089e4-0021-4629-941c-3d10d19c7322" - }, - "results": [ - { - "category": "Pod Security Standards (Baseline)", - "message": "validation error: Sharing the host namespaces is disallowed. The fields spec.hostNetwork, spec.hostIPC, and spec.hostPID must be unset or set to `false`. rule autogen-host-namespaces failed at path /spec/template/spec/hostNetwork/", - "policy": "disallow-host-namespaces", - "result": "fail", - "rule": "autogen-host-namespaces", - "scored": true, - "severity": "medium", - "source": "kyverno", - "timestamp": { - "nanos": 0, - "seconds": 1728172579 - } - } - ], - "scope": { - "apiVersion": "apps/v1", - "kind": "Deployment", - "name": "nginx-deployment", - "namespace": "paa", - "uid": "fe79bc1f-ec25-42df-97bb-45f2122822ef" - }, - "summary": { - "error": 0, - "fail": 1, - "pass": 0, - "skip": 0, - "warn": 0 - } - } -] diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/goal.txt b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/goal.txt deleted file mode 100644 index f19d67b00..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/goal.txt +++ /dev/null @@ -1,13 +0,0 @@ -I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml` - Minimize the admission of containers wishing to share the host network namespace. - -To check the condition, do the following steps. -- deploy a Kyverno policy to the cluster -- chcek if the policy is correctly deployed. - -If deploying the policy failed and if you can fix the issue, you will do it and try deploying again. -Once you get a final answer, you can quit the work. - -The cluster's kubeconfig is at `/tmp/kubeconfig.agent.yaml`. - -You can use \'/tmp/agent-workspace\' as your workdir. diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/info.json b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/info.json deleted file mode 100644 index 66a77f54e..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/info.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "name": "cis-b.5.2.5-gen", - "description": "CIS Benchmark for K8S 5.2.5 (Kyverno)", - "incident_type": "policy_gen", - "scenario_type": "Gen-CIS-b-K8s-Kyverno", - "goal": "Minimize the admission of containers wishing to share the host network namespace." -} diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/input.json b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/input.json deleted file mode 100644 index 57b355327..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/input.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "kubeconfig_data": "", - "shared_workspace": "/tmp/agent", - "kubeconfig": "/etc/ciso-task-scenarios/kubeconfig.yaml" -} diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/manifests/application.yaml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/manifests/application.yaml deleted file mode 100644 index 33febcce1..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/manifests/application.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: nginx-deployment -spec: - selector: - matchLabels: - app: nginx - replicas: 1 - template: - metadata: - labels: - app: nginx - spec: - hostPID: false - hostIPC: false - hostNetwork: true - containers: - - name: nginx - image: nginx:1.14.2 - ports: - - containerPort: 80 diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/deploy.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/deploy.yml deleted file mode 100644 index c31f923af..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/deploy.yml +++ /dev/null @@ -1,147 +0,0 @@ -- name: Deploy the environment - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - - name: debug lookup("env", "PWD") - debug: - var: lookup("env", "PWD") - - name: debug ansible_env - debug: - var: ansible_env - - name: Display contents of vars.yaml - debug: - var: vars - - - block: - - block: - - debug: - msg: "Executing block: Create cluster" - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Deploying KinD Cluster..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - - include_tasks: ../tasks/kind_create.yml - when: provided_kubeconfig == '' - - - block: - - debug: - msg: "Executing block: Use existing cluster" - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Connecting an existing cluster..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - debug: - var: bundle_input_file - - debug: - var: bundle_input - - debug: - var: shared_workspace - - name: "Write kubeconfig to {{ kubeconfig }} for Bundle Setup" - copy: - src: "{{ provided_kubeconfig }}" - dest: "{{ kubeconfig }}" - when: provided_kubeconfig != '' - - # TODO: Create Kubeconfig for a temporal service account - - name: "Write kubeconfig to {{ agent_kubeconfig }} for Agent" - copy: - src: "{{ kubeconfig }}" - dest: "{{ agent_kubeconfig }}" - - - name: Check if namespace exists - kubernetes.core.k8s_info: - kubeconfig: "{{ kubeconfig }}" - kind: Namespace - name: "{{ target_ns }}" - register: namespace_info - failed_when: false # Don't fail if namespace doesn't exist - - - name: Print namespace_info for debugging - debug: - var: namespace_info - - - name: Create namespace if it does not exist - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - definition: - apiVersion: v1 - kind: Namespace - metadata: - name: "{{ target_ns }}" - when: namespace_info.resources | length == 0 - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Installing Kyverno ..." - - - include_tasks: ../tasks/kyverno_install.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentFailed" - message: > - Deployment is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "FaultInjected" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/destroy.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/destroy.yml deleted file mode 100644 index 073b35858..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/destroy.yml +++ /dev/null @@ -1,55 +0,0 @@ ---- -- name: Destroy the environment - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - - include_tasks: ../tasks/fault_remove.yml - - - include_tasks: ../tasks/policy_remove.yml - - - include_tasks: ../tasks/kind_delete.yml - when: provided_kubeconfig == '' - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "AlreadyDestroyed" - - type: "FaultInjected" - status: "False" - reason: "AlreadyDestroyed" - - type: "Destroyed" - status: "True" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyFailed" - message: > - Failed to destroy due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/evaluate.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/evaluate.yml deleted file mode 100644 index 936141c27..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/evaluate.yml +++ /dev/null @@ -1,85 +0,0 @@ ---- -- name: Evaluate the system compliance - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - name: Gather Policy Reports - command: > - kubectl get polr -A -o json - environment: - KUBECONFIG: "{{ kubeconfig }}" - register: result - failed_when: result.rc != 0 - - - name: Write the output to a file - ansible.builtin.copy: - content: "{{ result.stdout }}" - dest: "{{ work_dir }}/polr.json" - - - name: Gather Cluster Policy Reports - command: > - kubectl get cpolr -A -o json - environment: - KUBECONFIG: "{{ kubeconfig }}" - register: result - failed_when: result.rc != 0 - - - name: Write the output to a file - ansible.builtin.copy: - content: "{{ result.stdout }}" - dest: "{{ work_dir }}/cpolr.json" - - - name: Read fault resource manifest (application.yaml) - ansible.builtin.slurp: - src: ../manifests/application.yaml - register: fault_resource - - - name: Parse fault resource manifest - ansible.builtin.set_fact: - fault_resource_data: "{{ fault_resource.content | b64decode | from_yaml }}" - - - name: Check if archive exists - ansible.builtin.stat: - path: "{{ agent_output }}" - register: archive_file - - - name: Ensure destination directory exists - ansible.builtin.file: - path: "{{ agent_output_destination }}" - state: directory - mode: '0755' - when: archive_file.stat.exists - - - name: Extract archive of Agent submitted data - ansible.builtin.command: - cmd: "tar -xf {{ agent_output }} -C {{ agent_output_destination }}" - register: tar_result - changed_when: tar_result.rc == 0 - when: archive_file.stat.exists - - - name: Run evaluation - ansible.builtin.command: - argv: - - python - - ../evaluation/main.py - - -polr - - "{{ work_dir }}/polr.json" - - -cpolr - - "{{ work_dir }}/cpolr.json" - - --api-version - - "{{ fault_resource_data.apiVersion }}" - - --kind - - "{{ fault_resource_data.kind }}" - - --namespace - - "{{ fault_resource_data.metadata.namespace | default(target_ns) }}" - - --name - - "{{ fault_resource_data.metadata.name }}" - - --agent-output - - "{{ agent_output_destination }}" - - -o - - "{{ path_to_output }}" - environment: - KUBECONFIG: "{{ kubeconfig }}" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/execute.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/execute.yml deleted file mode 100644 index 70bceb016..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/execute.yml +++ /dev/null @@ -1,54 +0,0 @@ ---- -- name: Execute fault injection - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - - include_tasks: ../tasks/fault_inject.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionFailed" - message: > - FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "FaultInjectionFailed" - message: "Waiting for the fault injection to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/fault_injection.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/fault_injection.yml deleted file mode 100644 index 1be22df6c..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/fault_injection.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Make the system compliance violation - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/fault_inject.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/fault_removal.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/fault_removal.yml deleted file mode 100644 index e84e76907..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/fault_removal.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Remove the violated resources - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/fault_remove.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/goal.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/goal.yml deleted file mode 100644 index 27c1b0bb9..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/goal.yml +++ /dev/null @@ -1,35 +0,0 @@ ---- -- name: Build a goal descriptioin - hosts: localhost - vars_files: - - ./vars.yaml - vars: - path_to_output: /tmp/goal.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - name: Load info.json - set_fact: - info_content: "{{ lookup('file', '../info.json') | from_json }}" - - - name: Build the goal description - set_fact: - goal_object: - goal: | - I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml` - {{ info_content.goal }} - - To check the condition, do the following steps. - - deploy a Kyverno policy to the cluster - - chcek if the policy is correctly deployed. - - If deploying the policy failed and if you can fix the issue, you will do it and try deploying again. - Once you get a final answer, you can quit the work. - - The cluster's kubeconfig is at `{% raw %}{{ kubeconfig }}{% endraw %}`. - vars: - kubeconfig: "{{ lookup('file', agent_kubeconfig) }}" - - name: Write the goal description to JSON file - copy: - content: "{{ goal_object | to_json }}" - dest: "{{ path_to_output }}" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kind_create.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kind_create.yml deleted file mode 100644 index 92adb184c..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kind_create.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: Create KinD cluster - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/kind_create.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kind_delete.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kind_delete.yml deleted file mode 100644 index 3bc3f8381..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kind_delete.yml +++ /dev/null @@ -1,6 +0,0 @@ -- name: Delete KinD cluster - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/kind_delete.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kyverno_install.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kyverno_install.yml deleted file mode 100644 index c8c488c17..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kyverno_install.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Install Kyverno - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/kyverno_install.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kyverno_uninstall.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kyverno_uninstall.yml deleted file mode 100644 index 09302cac0..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/kyverno_uninstall.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Uninstall Kyvernos - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/kyverno_uninstall.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/policy_creation.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/policy_creation.yml deleted file mode 100644 index bbd60fb38..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/policy_creation.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Create policy - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/policy_create.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/policy_removal.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/policy_removal.yml deleted file mode 100644 index 60f9fdd15..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/policy_removal.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Delete policy - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/policy_remove.yml diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/revert.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/revert.yml deleted file mode 100644 index c62fcb6bd..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/revert.yml +++ /dev/null @@ -1,58 +0,0 @@ ---- -- name: Execute fault injection - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - reason: "FaultInjectionNotReady" - message: "Reverting the injected fault" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be reverted" - - - include_tasks: ../tasks/policy_remove.yml - - - include_tasks: ../tasks/fault_remove.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - reason: "RevertingFaultInjectionFailed" - message: > - Reverting FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "RevertingFaultInjectionFailed" - message: "Waiting for the fault injection to be reverted" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/vars.yaml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/vars.yaml deleted file mode 100644 index de93bba18..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/playbooks/vars.yaml +++ /dev/null @@ -1,17 +0,0 @@ -target_ns: paa -cluster_name: ciso-scenario -bundle_id: "cis-b.5.2.6-gen" -bundle_title: "CIS Benchmark for K8S 5.2.6 (Kyverno)" -work_dir: "{{ lookup('env', 'WORK_DIR') | default('/tmp/caa-bench', true) }}" - -bundle_input_file: "{{ lookup('env', 'BUNDLE_INPUT_FILE') | default('../input.json', true) }}" -bundle_input: "{{ lookup('file', bundle_input_file) | from_json }}" - -provided_kubeconfig: "{{ bundle_input.kubeconfig | default('') }}" -kubeconfig: "{{ work_dir }}/kubeconfig.caa.yaml" -path_to_status: "{{ work_dir }}/status.json" - -shared_workspace: "{{ bundle_input.shared_workspace }}" -agent_kubeconfig: "{{ shared_workspace }}/kubeconfig.yaml" -agent_output: "{{ shared_workspace }}/agent_output.data" -agent_output_destination: "{{ work_dir }}/agent_output" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/status.template.json b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/status.template.json deleted file mode 100644 index 51789b0cb..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/status.template.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "status": { - "conditions": [ - { - "type": "Deployed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "FaultInjected", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "Destroyed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - } - ] - } -} diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/fault_inject.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/fault_inject.yml deleted file mode 100644 index e555c0743..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/fault_inject.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Deploy non compliant pods - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - namespace: "{{ target_ns }}" - src: "../manifests/application.yaml" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/fault_remove.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/fault_remove.yml deleted file mode 100644 index c14045c1f..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/fault_remove.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Delete the non compliant pods - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: absent - namespace: "{{ target_ns }}" - src: "../manifests/application.yaml" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kind_create.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kind_create.yml deleted file mode 100644 index a579ab15f..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kind_create.yml +++ /dev/null @@ -1,26 +0,0 @@ -- name: Check if KinD cluster exists - command: kind get clusters - register: cluster_list - -- name: Create KinD cluster if it doesn't exist - command: kind create cluster --name "{{ cluster_name }}" --kubeconfig "{{ kubeconfig }}" --image kindest/node:v1.28.13 --wait 5m - when: cluster_name not in cluster_list.stdout_lines - register: create_result - ignore_errors: true # Ignore errors if cluster already exists - -- name: Get kubeconfig for existing cluster - command: kind get kubeconfig --name {{ cluster_name }} - when: cluster_name in cluster_list.stdout_lines - register: kubeconfig_result - -- name: Write kubeconfig to /tmp/kubeconfig.yaml - copy: - content: "{{ kubeconfig_result.stdout }}" - dest: "{{ kubeconfig }}" - when: cluster_name in cluster_list.stdout_lines - -- name: Check if KinD cluster is running by getting namespaces - command: kubectl get ns --kubeconfig {{ kubeconfig }} - register: ns_result - failed_when: "'Active' not in ns_result.stdout" - ignore_errors: true diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kind_delete.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kind_delete.yml deleted file mode 100644 index 14045fbd7..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kind_delete.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: Delete KinD cluster exists - command: kind delete cluster --name "{{ cluster_name }}" - register: cluster_list diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kyverno_install.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kyverno_install.yml deleted file mode 100644 index 2173c05cb..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kyverno_install.yml +++ /dev/null @@ -1,38 +0,0 @@ ---- -- name: Add Kyverno Helm repo - kubernetes.core.helm_repository: - name: kyverno - repo_url: https://kyverno.github.io/kyverno/ - -- name: Install Kyverno via Helm - kubernetes.core.helm: - kubeconfig: "{{ kubeconfig }}" - state: present - name: kyverno - chart_ref: kyverno/kyverno - release_namespace: kyverno - create_namespace: true - -- name: Wait until all kyverno deployments are available - command: > - kubectl wait --for=condition=available deployment --all --namespace=kyverno --timeout=300s - environment: - KUBECONFIG: "{{ kubeconfig }}" - register: result - failed_when: result.rc != 0 - -- name: Wait for all kyverno pods to be running - kubernetes.core.k8s_info: - kubeconfig: "{{ kubeconfig }}" - namespace: kyverno - kind: Pod - register: pod_info - until: > - pod_info.resources | selectattr('status.phase', 'in', ['Running', 'Completed']) | list | length == pod_info.resources | length - retries: 1 - delay: 15 - failed_when: pod_info.resources | length == 0 - -- name: Print result of kubectl wait command - debug: - var: result.stdout diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kyverno_uninstall.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kyverno_uninstall.yml deleted file mode 100644 index 47b011498..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/kyverno_uninstall.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Uninstall Kyverno via Helm - kubernetes.core.helm: - kubeconfig: "{{ kubeconfig }}" - state: absent - name: kyverno - chart_ref: kyverno/kyverno - release_namespace: kyverno diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/policy_create.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/policy_create.yml deleted file mode 100644 index 8791a8157..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/policy_create.yml +++ /dev/null @@ -1,6 +0,0 @@ ---- -- name: Apply the policy manifest - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - src: "../manifests/policy.yaml" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/policy_remove.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/policy_remove.yml deleted file mode 100644 index 7000f5d1c..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/policy_remove.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Delete all Kyverno Policies - ansible.builtin.command: - cmd: "kubectl delete policy --all --kubeconfig {{ kubeconfig }}" - -- name: Delete all Kyverno ClusterPolicies - ansible.builtin.command: - cmd: "kubectl delete clusterpolicy --all --kubeconfig {{ kubeconfig }}" diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/precondition_setup.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/precondition_setup.yml deleted file mode 100644 index c3d47cc81..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/precondition_setup.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Check if the directory exists and create it if necessary - file: - path: "{{ work_dir }}" - state: directory diff --git a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/status_update.yml b/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/status_update.yml deleted file mode 100644 index 133434fe3..000000000 --- a/scenarios/ciso/1.gen-cis-b-k8s-kyverno/tasks/status_update.yml +++ /dev/null @@ -1,75 +0,0 @@ ---- -- vars: - new_conditions: - block: - - name: Check if status file exists - stat: - path: "{{ path_to_status }}" - register: status_file - - - name: Define default status - set_fact: - default_status: - status: - conditions: - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "True" - type: "Deployed" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "FaultInjected" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "Destroyed" - - - name: Create default status file if it does not exist - copy: - content: "{{ default_status | to_json(indent=2) }}" - dest: "{{ path_to_status }}" - when: not status_file.stat.exists - - - name: Read existing status from JSON file - slurp: - src: "{{ path_to_status }}" - register: current_status - - - name: Convert current status to dictionary - set_fact: - current_status_dict: "{{ current_status.content | b64decode | from_json }}" - - - name: Initialize updated_conditions as an empty list - set_fact: - updated_conditions: [] - - - name: Loop through each condition and update only matching ones - set_fact: - updated_conditions: "{{ updated_conditions + [ (updated_item | combine({'lastTransitionTime': ansible_date_time.iso8601}) if updated_item != item else item) ] }}" - loop: "{{ current_status_dict.status.conditions }}" - loop_control: - loop_var: item - vars: - updated_item: "{{ new_conditions | selectattr('type', 'equalto', item.type) | first | default(item) }}" - - - name: Check if the kubeconfig.yaml exists - stat: - path: "{{ kubeconfig }}" - register: local_file_status - - - name: Read file content if it exists - slurp: - src: "{{ kubeconfig }}" - register: local_file_content - when: local_file_status.stat.exists - - - name: Set the file content or empty string - set_fact: - local_kubeconfig_raw: "{{ local_file_content.content | b64decode if local_file_status.stat.exists else '' }}" - - - name: Prepare updated JSON data with kubeconfig - set_fact: - updated_json_data: "{{ current_status_dict | combine({'status': {'conditions': updated_conditions, 'kubeconfig': local_kubeconfig_raw }}) }}" - - - name: Write updated status (with or without kubeconfig) back to JSON file - copy: - content: "{{ updated_json_data | to_json(indent=2) }}" - dest: "{{ path_to_status }}" diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/Makefile b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/Makefile deleted file mode 100644 index ca92896b3..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/Makefile +++ /dev/null @@ -1,84 +0,0 @@ -help: - @echo "Makefile commands:" - @echo "deploy_bundle -- [onetime] deploys the bundle to the cluster" - @echo "inject_fault -- [onetime] define a new policy (policies) and enable fault for hitting CIS Benchmark controls" - @echo "destroy_bundle -- [onetime] destroy the target environment" - @echo "revert_bundle -- [onetime] revert the target environment" - @echo "get -- [onetime] get status and evaluation" - @echo "get_status -- [onetime] get status" - @echo "evaluate -- [onetime] evaluate" - @echo "Option FOREGROUND=true for synchronous execution. Default execute as background job." - @echo "Option INPUT_FILE=" - @echo "help - Display this help information" - -export WORK_DIR = /tmp/scenario - -INPUT_FILE ?= -DEFAULT_INPUT_FILE := input.json -PASSED_INPUT_FILE := $(WORK_DIR)/input.json -export BUNDLE_INPUT_FILE := $(PASSED_INPUT_FILE) - -# parameters to replace default input.json -KUBECONFIG := -SHARED_WORKSPACE := -JQ_UPDATE_TEMPLATE = if [ -n "$(1)" ]; then \ - jq --arg key_value "$(1)" '.$(2) = $$key_value' $(PASSED_INPUT_FILE) > tmp.json && mv tmp.json $(PASSED_INPUT_FILE) ;\ -fi - -ifeq ($(FOREGROUND), true) - REDIRECT := - BG := -else - REDIRECT := &> $$WORK_DIR/$(LOG_FILE) - BG := & -endif - -ifeq ($(TEST), true) - PLAYBOOK_DIR := ./stubs -else - PLAYBOOK_DIR := ./playbooks -endif - -prepare_directory: - @mkdir -p "$(WORK_DIR)" - @if [ -z "$(INPUT_FILE)" ]; then \ - echo "Using default input file with override by parameters" 1>&2;\ - cp $(DEFAULT_INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - $(call JQ_UPDATE_TEMPLATE,$(KUBECONFIG),kubeconfig);\ - $(call JQ_UPDATE_TEMPLATE,$(SHARED_WORKSPACE),shared_workspace);\ - else \ - echo "Using provided input file" 1>&2;\ - cp $(INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - fi - -deploy_bundle: prepare_directory - @cat status.template.json > $$WORK_DIR/status.json - @$(MAKE) run_playbook LOG_FILE=deploy.log PLAYBOOK=deploy.yml - -inject_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=execute.log PLAYBOOK=execute.yml - -destroy_bundle: prepare_directory - @$(MAKE) run_playbook LOG_FILE=destroy.log PLAYBOOK=destroy.yml - -remove_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=remove.log PLAYBOOK=fault_removal.yml - -revert: prepare_directory - @$(MAKE) run_playbook LOG_FILE=revert.log PLAYBOOK=revert.yml - -evaluate: prepare_directory - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=evaluate.log PLAYBOOK=evaluate.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/evaluation.json\"" 1>&2; \ - cat $(WORK_DIR)/evaluation.json - -run_playbook: EXTRA_VARS ?= -run_playbook: prepare_directory - @echo "ansible-playbook $(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG)" - @ansible-playbook $(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG) - -get: prepare_directory - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=goal.log PLAYBOOK=goal.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/goal.json \"" 1>&2 - @jq -s '{metadata: .[0]}' info.json | jq .goal_template=input.goal - $$WORK_DIR/goal.json | jq .vars=input.vars - $$WORK_DIR/goal.json - -get_status: prepare_directory - @cat $$WORK_DIR/status.json diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/info.json b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/info.json deleted file mode 100644 index b91f5f154..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/info.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "name": "k8s-opa/cis-b-gen/5.2.5", - "description": "CIS Benchmark for K8S 5.2.5 (OPA)", - "incident_type": "k8s-opa-cis-b-gen", - "scenario_type": "Gen-CIS-b-K8s-Kubectl-OPA", - "goal": "Minimize the admission of containers wishing to share the host network namespace." -} diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/input.json b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/input.json deleted file mode 100644 index 95d51962b..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/input.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "shared_workspace": "/tmp/agent", - "kubeconfig": "/etc/ciso-task-scenarios/kubeconfig.yaml" -} diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/manifests/application.yaml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/manifests/application.yaml deleted file mode 100644 index 33febcce1..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/manifests/application.yaml +++ /dev/null @@ -1,22 +0,0 @@ -apiVersion: apps/v1 -kind: Deployment -metadata: - name: nginx-deployment -spec: - selector: - matchLabels: - app: nginx - replicas: 1 - template: - metadata: - labels: - app: nginx - spec: - hostPID: false - hostIPC: false - hostNetwork: true - containers: - - name: nginx - image: nginx:1.14.2 - ports: - - containerPort: 80 diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/deploy.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/deploy.yml deleted file mode 100644 index 06e590702..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/deploy.yml +++ /dev/null @@ -1,126 +0,0 @@ -- name: Deploy the environment - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - block: - - debug: - msg: "Executing block: Create cluster" - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Deploying KinD Cluster..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - - include_tasks: ../tasks/kind_create.yml - when: provided_kubeconfig == '' - - - block: - - debug: - msg: "Executing block: Use existing cluster" - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Connecting an existing cluster..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - debug: - var: bundle_input_file - - debug: - var: bundle_input - - debug: - var: shared_workspace - - name: "Write kubeconfig to {{ kubeconfig }} for Bundle Setup" - copy: - src: "{{ provided_kubeconfig }}" - dest: "{{ kubeconfig }}" - when: provided_kubeconfig != '' - - # TODO: Create Kubeconfig for a temporal service account - - name: "Write kubeconfig to {{ agent_kubeconfig }} for Agent" - copy: - src: "{{ kubeconfig }}" - dest: "{{ agent_kubeconfig }}" - - - name: Check if namespace exists - kubernetes.core.k8s_info: - kubeconfig: "{{ kubeconfig }}" - kind: Namespace - name: "{{ target_ns }}" - register: namespace_info - failed_when: false # Don't fail if namespace doesn't exist - - - name: Print namespace_info for debugging - debug: - var: namespace_info - - - name: Create namespace if it does not exist - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - definition: - apiVersion: v1 - kind: Namespace - metadata: - name: "{{ target_ns }}" - when: namespace_info.resources | length == 0 - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentFailed" - message: > - Deployment is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "FaultInjected" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/destroy.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/destroy.yml deleted file mode 100644 index fef00951a..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/destroy.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -- name: Destroy the environment - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - - include_tasks: ../tasks/fault_removal.yml - - - include_tasks: ../tasks/kind_delete.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "AlreadyDestroyed" - - type: "FaultInjected" - status: "False" - reason: "AlreadyDestroyed" - - type: "Destroyed" - status: "True" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyFailed" - message: > - Failed to destroy due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/evaluate.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/evaluate.yml deleted file mode 100644 index 521b04fff..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/evaluate.yml +++ /dev/null @@ -1,102 +0,0 @@ ---- -- name: Evaluate the system compliance - hosts: localhost - vars_files: - - ./vars.yaml - vars: - shared_workspace: /tmp - path_to_output: /tmp/evaluate.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - - name: Check if {{ agent_output }} exists - stat: - path: "{{ agent_output }}" - register: agent_output_stat - - - name: Ensure dest directory exists - file: - path: "{{ agent_output_destination }}" - state: directory - mode: '0755' - when: agent_output_stat.stat.exists - - - name: Extract {{ agent_output }} if it exists - unarchive: - src: "{{ agent_output }}" - dest: "{{ agent_output_destination }}" - keep_newer: true - when: agent_output_stat.stat.exists - - - name: Copy items from extracted directory to extracted directory - copy: - src: "{{ agent_output_destination }}/{{ item }}" - dest: "{{ shared_workspace }}/{{ item }}" - with_items: - - "{{ filename_to_generated_fetcher }}" - - "{{ filename_to_generated_policy }}" - when: agent_output_stat.stat.exists - - - name: Run Fetcher - ansible.builtin.command: - argv: - - bash - - "{{ shared_workspace }}/{{ filename_to_generated_fetcher }}" - args: - chdir: "{{ shared_workspace }}" - register: fetcher_result - - - name: Run OPA - ansible.builtin.command: - argv: - - opa - - eval - - --data - - "{{ shared_workspace }}/{{ filename_to_generated_policy }}" - - --input - - "{{ shared_workspace }}/{{ filename_to_collected_data }}" - - data.check.result - - --format - - raw - register: checker_result - - - name: Set pass/fail based on command result (opa should result 'false' since a fault condition is injected.) - set_fact: - pass_result: - pass: "{{ true if checker_result.stdout == 'false' else false }}" - details: | - [fetcher] cmd: {{ fetcher_result.cmd }}, stdout: {{ fetcher_result.stdout }}, stderr: {{ fetcher_result.stderr }} - [checker] cmd: {{ checker_result.cmd }}, stdout: {{ checker_result.stdout }}, stderr: {{ checker_result.stderr }} - - - name: Write pass result to JSON file - copy: - content: "{{ pass_result | to_json }}" - dest: "{{ path_to_output }}" - - - name: Pretty print the - debug: - msg: "{{ pass_result }}" - - rescue: - - name: Set pass result - set_fact: - pass_result: - pass: false - errors: - - code: "{{ ansible_failed_task.name }}" - message: | - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - {{ ansible_failed_result.stdout }} - {{ ansible_failed_result.stderr }} - - - name: Write pass result to JSON file - copy: - content: "{{ pass_result | to_json }}" - dest: "{{ path_to_output }}" - - - name: Pretty print the - debug: - msg: "{{ pass_result }}" diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/execute.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/execute.yml deleted file mode 100644 index 70bceb016..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/execute.yml +++ /dev/null @@ -1,54 +0,0 @@ ---- -- name: Execute fault injection - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - - include_tasks: ../tasks/fault_inject.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionFailed" - message: > - FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "FaultInjectionFailed" - message: "Waiting for the fault injection to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/fault_inject.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/fault_inject.yml deleted file mode 100644 index 665c84fde..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/fault_inject.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: Perform fault injection - hosts: localhost - tasks: - - include_tasks: ../tasks/fault_injection.yml diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/fault_removal.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/fault_removal.yml deleted file mode 100644 index a30bdd8b2..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/fault_removal.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Remove the violated resources - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/fault_removal.yml diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/goal.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/goal.yml deleted file mode 100644 index 4090887f8..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/goal.yml +++ /dev/null @@ -1,43 +0,0 @@ ---- -- name: Build a goal descriptioin - hosts: localhost - vars_files: - - ./vars.yaml - vars: - shared_workspace: /tmp - path_to_output: /tmp/goal.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - name: Load info.json - set_fact: - info_content: "{{ lookup('file', '../info.json') | from_json }}" - - - name: Build the goal description - set_fact: - goal_object: - goal: | - I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml` - {{ info_content.goal }} - - To check the condition, do the following steps. - - get related resource(s) on the cluster by kubectl command - - chcek if the conditions are satisfied by OPA Rego policy - - for those steps, you need to create an OPA Rego policy `policy.rego`. - Also, save the kubectl command as `script.sh` with the following design. - - The script should output the collected related resources to a file named `collected_data.json` in the current working directory. - - Please remove any kubeconfig configuration (e.g. --kubeconfig args) from the script, as users will configure the kubeconfig using environment variables or other methods. - - If running the policy failed and if you can fix the issue, you will do it and try running again. - - Once you get a final answer, you can quit the work. - - The cluster's kubeconfig is at `{% raw %}{{ kubeconfig }}{% endraw %}`. - vars: - kubeconfig: "{{ lookup('file', agent_kubeconfig) }}" - - - name: Write the goal description to JSON file - copy: - content: "{{ goal_object | to_json }}" - dest: "{{ path_to_output }}" diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/revert.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/revert.yml deleted file mode 100644 index 05e4e45a6..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/revert.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: Execute fault injection - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - reason: "FaultInjectionNotReady" - message: "Reverting the injected fault" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be reverted" - - - include_tasks: ../tasks/fault_removal.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - reason: "RevertingFaultInjectionFailed" - message: > - Reverting FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "RevertingFaultInjectionFailed" - message: "Waiting for the fault injection to be reverted" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/vars.yaml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/vars.yaml deleted file mode 100644 index 041a85684..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/vars.yaml +++ /dev/null @@ -1,23 +0,0 @@ -# vars.yaml -target_ns: paa -cluster_name: ciso-scenario - -bundle_id: "k8s-opa/cis-b-gen/5.2.5" -bundle_title: "CIS Benchmark for K8S 5.2.5 (OPA)" -work_dir: "{{ lookup('env', 'WORK_DIR') | default('/tmp/caa-bench', true) }}" - -bundle_input_file: "{{ lookup('env', 'BUNDLE_INPUT_FILE') | default('../input.json', true) }}" -bundle_input: "{{ lookup('file', bundle_input_file) | from_json }}" - -provided_kubeconfig: "{{ bundle_input.kubeconfig | default('') }}" -kubeconfig: "{{ work_dir }}/kubeconfig.caa.yaml" -path_to_status: "{{ work_dir }}/status.json" - -shared_workspace: "{{ bundle_input.shared_workspace }}" -agent_kubeconfig: "{{ shared_workspace }}/kubeconfig.yaml" -agent_output: "{{ shared_workspace }}/agent_output.data" -agent_output_destination: "{{ shared_workspace }}/agent_output" - -filename_to_generated_fetcher: "fetcher.sh" -filename_to_generated_policy: "policy.rego" -filename_to_collected_data: "collected_data.json" diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/status.template.json b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/status.template.json deleted file mode 100644 index 51789b0cb..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/status.template.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "status": { - "conditions": [ - { - "type": "Deployed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "FaultInjected", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "Destroyed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - } - ] - } -} diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/fault_inject.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/fault_inject.yml deleted file mode 100644 index e555c0743..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/fault_inject.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Deploy non compliant pods - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - namespace: "{{ target_ns }}" - src: "../manifests/application.yaml" diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/fault_removal.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/fault_removal.yml deleted file mode 100644 index c14045c1f..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/fault_removal.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Delete the non compliant pods - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: absent - namespace: "{{ target_ns }}" - src: "../manifests/application.yaml" diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/kind_create.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/kind_create.yml deleted file mode 100644 index a579ab15f..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/kind_create.yml +++ /dev/null @@ -1,26 +0,0 @@ -- name: Check if KinD cluster exists - command: kind get clusters - register: cluster_list - -- name: Create KinD cluster if it doesn't exist - command: kind create cluster --name "{{ cluster_name }}" --kubeconfig "{{ kubeconfig }}" --image kindest/node:v1.28.13 --wait 5m - when: cluster_name not in cluster_list.stdout_lines - register: create_result - ignore_errors: true # Ignore errors if cluster already exists - -- name: Get kubeconfig for existing cluster - command: kind get kubeconfig --name {{ cluster_name }} - when: cluster_name in cluster_list.stdout_lines - register: kubeconfig_result - -- name: Write kubeconfig to /tmp/kubeconfig.yaml - copy: - content: "{{ kubeconfig_result.stdout }}" - dest: "{{ kubeconfig }}" - when: cluster_name in cluster_list.stdout_lines - -- name: Check if KinD cluster is running by getting namespaces - command: kubectl get ns --kubeconfig {{ kubeconfig }} - register: ns_result - failed_when: "'Active' not in ns_result.stdout" - ignore_errors: true diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/kind_delete.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/kind_delete.yml deleted file mode 100644 index 14045fbd7..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/kind_delete.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: Delete KinD cluster exists - command: kind delete cluster --name "{{ cluster_name }}" - register: cluster_list diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/precondition_setup.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/precondition_setup.yml deleted file mode 100644 index c3d47cc81..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/precondition_setup.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Check if the directory exists and create it if necessary - file: - path: "{{ work_dir }}" - state: directory diff --git a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/status_update.yml b/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/status_update.yml deleted file mode 100644 index 9b456ca26..000000000 --- a/scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa/tasks/status_update.yml +++ /dev/null @@ -1,60 +0,0 @@ ---- -- vars: - new_conditions: - block: - - name: Check if status file exists - stat: - path: "{{ path_to_status }}" - register: status_file - - - name: Define default status - set_fact: - default_status: - status: - conditions: - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "True" - type: "Deployed" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "FaultInjected" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "Destroyed" - - - name: Create default status file if it does not exist - copy: - content: "{{ default_status | to_json(indent=2) }}" - dest: "{{ path_to_status }}" - when: not status_file.stat.exists - - - name: Read existing status from JSON file - slurp: - src: "{{ path_to_status }}" - register: current_status - - - name: Convert current status to dictionary - set_fact: - current_status_dict: "{{ current_status.content | b64decode | from_json }}" - - - name: Initialize updated_conditions as an empty list - set_fact: - updated_conditions: [] - - - name: Loop through each condition and update only matching ones - set_fact: - updated_conditions: "{{ updated_conditions + [ (updated_item | combine({'lastTransitionTime': ansible_date_time.iso8601}) if updated_item != item else item) ] }}" - loop: "{{ current_status_dict.status.conditions }}" - loop_control: - loop_var: item - vars: - updated_item: "{{ new_conditions | selectattr('type', 'equalto', item.type) | first | default(item) }}" - - - name: Prepare updated JSON data with kubeconfig - set_fact: - updated_json_data: "{{ current_status_dict | combine({'status': {'conditions': updated_conditions }}) }}" - - - name: Write updated status back to JSON file - copy: - content: "{{ updated_json_data | to_json(indent=2) }}" - dest: "{{ path_to_status }}" diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/Makefile b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/Makefile deleted file mode 100644 index 3a2018a6e..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/Makefile +++ /dev/null @@ -1,85 +0,0 @@ -help: - @echo "Makefile commands:" - @echo "deploy_bundle -- [onetime] deploys the bundle to the cluster" - @echo "inject_fault -- [onetime] define a new policy (policies) and enable fault for hitting CIS Benchmark controls" - @echo "destroy_bundle -- [onetime] destroy the target environment" - @echo "revert_bundle -- [onetime] revert the target environment" - @echo "get -- [onetime] get status and evaluation" - @echo "get_status -- [onetime] get status" - @echo "evaluate -- [onetime] evaluate" - @echo "Option FOREGROUND=true for synchronous execution. Default execute as background job." - @echo "Option INPUT_FILE=" - @echo "help - Display this help information" - -export WORK_DIR = /tmp/agent - -INPUT_FILE ?= -DEFAULT_INPUT_FILE := input.json -PASSED_INPUT_FILE := $(WORK_DIR)/input.json -export BUNDLE_INPUT_FILE := $(PASSED_INPUT_FILE) - -# parameters to replace default input.json -KUBECONFIG := -SHARED_WORKSPACE := -JQ_UPDATE_TEMPLATE = if [ -n "$(1)" ]; then \ - jq --arg key_value "$(1)" '.$(2) = $$key_value' $(PASSED_INPUT_FILE) > tmp.json && mv tmp.json $(PASSED_INPUT_FILE) ;\ -fi - -ifeq ($(FOREGROUND), true) - REDIRECT := - BG := -else - REDIRECT := &> $$WORK_DIR/$(LOG_FILE) - BG := & -endif - -ifeq ($(TEST), true) - PLAYBOOK_DIR := ./stubs -else - PLAYBOOK_DIR := ./playbooks -endif - -prepare_directory: - @mkdir -p "$(WORK_DIR)" - @if [ -z "$(INPUT_FILE)" ]; then \ - echo "Using default input file with override by parameters" 1>&2;\ - cp $(DEFAULT_INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - $(call JQ_UPDATE_TEMPLATE,$(KUBECONFIG),kubeconfig);\ - $(call JQ_UPDATE_TEMPLATE,$(SHARED_WORKSPACE),shared_workspace);\ - else \ - echo "Using provided input file" 1>&2;\ - cp $(INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - fi - -deploy_bundle: prepare_directory - @cat status.template.json > $$WORK_DIR/status.json - @$(MAKE) run_playbook LOG_FILE=deploy.log PLAYBOOK=deploy.yml - -inject_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=execute.log PLAYBOOK=execute.yml - -destroy_bundle: prepare_directory - @$(MAKE) run_playbook LOG_FILE=destroy.log PLAYBOOK=destroy.yml - -remove_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=remove.log PLAYBOOK=fault_removal.yml - -revert: prepare_directory - @$(MAKE) run_playbook LOG_FILE=revert.log PLAYBOOK=revert.yml - -evaluate: prepare_directory - @echo $$BUNDLE_INPUT_FILE - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=evaluate.log PLAYBOOK=evaluate.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/evaluation.json \"" 1>&2; \ - cat $(WORK_DIR)/evaluation.json - -run_playbook: EXTRA_VARS ?= -run_playbook: prepare_directory - @echo "ansible-playbook -i dynamic_inventory.py $(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG)" - @ansible-playbook -i dynamic_inventory.py $(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG) - -get: prepare_directory - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=goal.log PLAYBOOK=goal.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/goal.json \"" 1>&2 - @jq -s '{metadata: .[0]}' info.json | jq .goal_template=input.goal - $$WORK_DIR/goal.json | jq .vars=input.vars - $$WORK_DIR/goal.json - -get_status: prepare_directory - @cat $$WORK_DIR/status.json diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/dynamic_inventory.py b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/dynamic_inventory.py deleted file mode 100755 index aeda217c0..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/dynamic_inventory.py +++ /dev/null @@ -1,42 +0,0 @@ -#!/usr/bin/env python3 -# Copyright contributors to the ITBench project. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -import json -import os - -input_file = os.getenv("BUNDLE_INPUT_FILE", "input.json") -with open(input_file, "r") as f: - input = json.load(f) - -inventory_host = input["inventory_host"] -target_server = input["target_server"] -host_alias = target_server["alias"] -username = target_server["username"] -server_address = target_server["address"] -server_sshkey = target_server["sshkey"] - -inventory = { - inventory_host: { - "hosts": [host_alias], - "vars": { - "ansible_user": username, - "ansible_ssh_private_key_file": server_sshkey, - "ansible_ssh_common_args": "-o StrictHostKeyChecking=no", - }, - }, - "_meta": {"hostvars": {host_alias: {"ansible_host": server_address}}}, -} - -print(json.dumps(inventory)) diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_collected_data.json b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_collected_data.json deleted file mode 100644 index b51b37d01..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_collected_data.json +++ /dev/null @@ -1 +0,0 @@ -{"file": "/etc/ssh/sshd_config", "x11_forwarding": "X11Forwarding yes"} diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_playbook.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_playbook.yml deleted file mode 100644 index 248ac1d68..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_playbook.yml +++ /dev/null @@ -1,18 +0,0 @@ -- name: Collect /etc/ssh/sshd_config X11Forwarding setting - hosts: rhel9_servers - gather_facts: no - - tasks: - - name: Extract X11Forwarding setting from /etc/ssh/sshd_config - ansible.builtin.shell: grep '^X11Forwarding' /etc/ssh/sshd_config || echo "X11Forwarding not set" - register: ssh_x11_forwarding - - - name: Save collected setting to JSON - ansible.builtin.copy: - content: | - { - "file": "/etc/ssh/sshd_config", - "x11_forwarding": {{ ssh_x11_forwarding.stdout | to_json }} - } - dest: /tmp/ssh_x11_forwarding_compliance.json - delegate_to: localhost diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_policy.rego b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_policy.rego deleted file mode 100644 index e331e063b..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/examples/example_policy.rego +++ /dev/null @@ -1,7 +0,0 @@ -package check - -default result = false - -result { - input.x11_forwarding == "X11Forwarding no" -} diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/info.json b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/info.json deleted file mode 100644 index a82a630e4..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/info.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "name": "rhel9/cis-b-gen/5.2.12", - "description": "CIS Benchmark for RHEL9 5.2.12", - "incident_type": "rhel9-cis-b-gen", - "scenario_type": "Gen-CIS-b-RHEL9-Ansible-OPA", - "goal": "Ensure SSH X11 forwarding is disabled" -} diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/input.json b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/input.json deleted file mode 100644 index d27e15ef9..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/input.json +++ /dev/null @@ -1,11 +0,0 @@ -{ - "inventory_host": "rhel9_servers", - "target_server": { - "address": "", - "username": "", - "sshkey": "/etc/ciso-task-scenarios/ssh_key", - "python_interpreter": "/usr/bin/python3", - "alias": "RHEL9 Machine" - }, - "shared_workspace": "/tmp/agent" -} diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/deploy.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/deploy.yml deleted file mode 100644 index d74c853c1..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/deploy.yml +++ /dev/null @@ -1,65 +0,0 @@ ---- -- name: Deploy the environment - hosts: rhel9_servers - become: true - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Setting up 'ansible_user' in the remote RHEL9 server..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - - include_tasks: ../tasks/user_create.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentFailed" - message: > - Deployment is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "FaultInjected" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/destroy.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/destroy.yml deleted file mode 100644 index e655106dc..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/destroy.yml +++ /dev/null @@ -1,53 +0,0 @@ ---- -- name: Destroy the environment - hosts: rhel9_servers - become: true - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - - include_tasks: ../tasks/fault_removal.yml - - - include_tasks: ../tasks/user_remove.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "AlreadyDestroyed" - - type: "FaultInjected" - status: "False" - reason: "AlreadyDestroyed" - - type: "Destroyed" - status: "True" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyFailed" - message: > - Failed to destroy due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/evaluate.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/evaluate.yml deleted file mode 100644 index 629c5c4fe..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/evaluate.yml +++ /dev/null @@ -1,104 +0,0 @@ ---- -- name: Evaluate the system compliance - hosts: localhost - vars_files: - - ./vars.yaml - vars: - shared_workspace: /tmp - path_to_output: /tmp/evaluate.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - - name: Check if {{ agent_output }} exists - stat: - path: "{{ agent_output }}" - register: agent_output_stat - - - name: Ensure dest directory exists - file: - path: "{{ agent_output_destination }}" - state: directory - mode: '0755' - when: agent_output_stat.stat.exists - - - name: Extract {{ agent_output }} if it exists - unarchive: - src: "{{ agent_output }}" - dest: "{{ agent_output_destination }}" - keep_newer: true - when: agent_output_stat.stat.exists - - - name: Copy items from extracted directory to extracted directory - copy: - src: "{{ agent_output_destination }}/{{ item }}" - dest: "{{ shared_workspace }}/{{ item }}" - with_items: - - "{{ filename_to_generated_fetcher }}" - - "{{ filename_to_generated_policy }}" - when: agent_output_stat.stat.exists - - - name: Run Ansible - ansible.builtin.command: - argv: - - ansible-playbook - - "{{ shared_workspace }}/{{ filename_to_generated_fetcher }}" - - -i - - "{{ path_to_evaluator_inventory }}" - args: - chdir: "{{ shared_workspace }}" - register: fetcher_result - - - name: Run OPA - ansible.builtin.command: - argv: - - opa - - eval - - --data - - "{{ shared_workspace }}/{{ filename_to_generated_policy }}" - - --input - - "{{ shared_workspace }}/{{ filename_to_collected_data }}" - - data.check.result - - --format - - raw - register: checker_result - - - name: Set pass/fail based on command result (opa should result 'false' since a fault condition is injected.) - set_fact: - pass_result: - pass: "{{ true if checker_result.stdout == 'false' else false }}" - details: | - [fetcher] cmd: {{ fetcher_result.cmd }}, stdout: {{ fetcher_result.stdout }}, stderr: {{ fetcher_result.stderr }} - [checker] cmd: {{ checker_result.cmd }}, stdout: {{ checker_result.stdout }}, stderr: {{ checker_result.stderr }} - - - name: Write pass result to JSON file - copy: - content: "{{ pass_result | to_json }}" - dest: "{{ path_to_output }}" - - - name: Pretty print the - debug: - msg: "{{ pass_result }}" - - rescue: - - name: Set pass result - set_fact: - pass_result: - pass: false - errors: - - code: "{{ ansible_failed_task.name }}" - message: | - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg | default('No error message provided') }} - {{ ansible_failed_result.stdout | default('No stdout provided') }} - {{ ansible_failed_result.stderr | default('No stderr provided') }} - - - name: Write pass result to JSON file - copy: - content: "{{ pass_result | to_json }}" - dest: "{{ path_to_output }}" - - - name: Pretty print the - debug: - msg: "{{ pass_result }}" diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/execute.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/execute.yml deleted file mode 100644 index 2a24cb837..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/execute.yml +++ /dev/null @@ -1,55 +0,0 @@ ---- -- name: Execute fault injection - hosts: rhel9_servers - become: true - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - - include_tasks: ../tasks/fault_inject.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionFailed" - message: > - FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "FaultInjectionFailed" - message: "Waiting for the fault injection to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/fault_inject.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/fault_inject.yml deleted file mode 100644 index a300eb502..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/fault_inject.yml +++ /dev/null @@ -1,5 +0,0 @@ -- name: Perform fault injection - hosts: rhel9_servers - become: true - tasks: - - include_tasks: ../tasks/fault_injection.yml diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/fault_removal.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/fault_removal.yml deleted file mode 100644 index df3745b89..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/fault_removal.yml +++ /dev/null @@ -1,5 +0,0 @@ -- name: Remove fault injection - hosts: rhel9_servers - become: true - tasks: - - include_tasks: ../tasks/fault_removal.yml diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/goal.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/goal.yml deleted file mode 100644 index 55857aefd..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/goal.yml +++ /dev/null @@ -1,39 +0,0 @@ ---- -- name: Build a goal descriptioin - hosts: localhost - vars_files: - - ./vars.yaml - vars: - shared_workspace: /tmp - path_to_output: /tmp/goal.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - name: Load info.json - set_fact: - info_content: "{{ lookup('file', '../info.json') | from_json }}" - - - name: Build the goal description - set_fact: - goal_object: - goal: | - I would like to check if the following condition is satisfiled, given a host name `rhel9_servers`, on RHEL by using Ansible Playbook and OPA Rego policy - {{ info_content.goal }} - - To check the condition, do the following steps. - - collect configuration from the RHEL host and save it locally. you can use ansible-playbook to do that. - - chcek if the condition is met by using rego policy with the input given by the step above. - - for those steps, you need to create ansible playbook `playbook.yml` and OPA rego policy `policy.rego`. - If you can fix the generated code, do it and run the fixed code again. - Once you get a final answer, you can quit the work. - - The Ansible inventory file (inventory.ansible.ini) for the target RHEL server is located at `{% raw %}{{ path_to_inventory }}{% endraw %}`. - vars: - ansible_ini: "{{ lookup('file', path_to_evaluator_inventory) }}" - ansible_user_key: "{{ lookup('file', check_target_ssh_key) }}" - - - name: Write the goal description to JSON file - copy: - content: "{{ goal_object | to_json }}" - dest: "{{ path_to_output }}" diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/revert.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/revert.yml deleted file mode 100644 index 3a6cdbf0f..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/revert.yml +++ /dev/null @@ -1,59 +0,0 @@ ---- -- name: Revert the environment - hosts: rhel9_servers - become: true - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - reason: "FaultInjectionNotReady" - message: "Reverting the injected fault" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be reverted" - - - include_tasks: ../tasks/fault_removal.yml - - - include_tasks: ../tasks/user_remove.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - reason: "RevertingFaultInjectionFailed" - message: > - Reverting FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "RevertingFaultInjectionFailed" - message: "Waiting for the fault injection to be reverted" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/vars.yaml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/vars.yaml deleted file mode 100644 index 31da643e8..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/vars.yaml +++ /dev/null @@ -1,25 +0,0 @@ -# vars.yaml -bundle_id: "rhel9/cis-b-gen/5.2.12" -bundle_title: "CIS Benchmark for RHEL9 5.2.12" -work_dir: "{{ lookup('env', 'WORK_DIR') | default('/tmp/caa-bench', true) }}" - -bundle_input_file: "{{ lookup('env', 'BUNDLE_INPUT_FILE') | default('../input.json', true) }}" -bundle_input: "{{ lookup('file', bundle_input_file) | from_json }}" - -path_to_status: "{{ work_dir }}/status.json" -check_target_hostname: "{{ bundle_input.target_server.address }}" -check_target_user: ansible_user -check_target_ssh_key: "{{ work_dir }}/id_rsa.{{ check_target_user }}" -check_target_python_interpreter: "{{ bundle_input.target_server.python_interpreter | default('/usr/bin/python', true) }}" -path_to_evaluator_inventory: "{{ work_dir }}/inventory.ansible.ini" - -shared_workspace: "{{ bundle_input.shared_workspace }}" -agent_kubeconfig: "{{ shared_workspace }}/kubeconfig.yaml" -agent_output: "{{ shared_workspace }}/agent_output.data" -agent_output_destination: "{{ shared_workspace }}/agent_output" - -filename_to_generated_fetcher: "playbook.yml" -filename_to_generated_policy: "policy.rego" -filename_to_collected_data: "collected_data.json" - -created_user_password: "{{ lookup('env', 'CREATED_USER_PASSWORD') | default('ansiblePassw0rd', true) }}" diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/status.template.json b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/status.template.json deleted file mode 100644 index 51789b0cb..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/status.template.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "status": { - "conditions": [ - { - "type": "Deployed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "FaultInjected", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "Destroyed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - } - ] - } -} diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_removal.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_removal.yml deleted file mode 100644 index cf8c0638e..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_removal.yml +++ /dev/null @@ -1,11 +0,0 @@ -- name: Disable X11 forwarding in SSH configuration - ansible.builtin.lineinfile: - path: /etc/ssh/sshd_config - regexp: '^X11Forwarding' - line: 'X11Forwarding no' - state: present - -- name: Restart SSH service to apply changes - ansible.builtin.service: - name: sshd - state: restarted diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/precondition_setup.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/precondition_setup.yml deleted file mode 100644 index 956589dc4..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/precondition_setup.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Check if the directory exists and create it if necessary - file: - path: "{{ work_dir }}" - state: directory - delegate_to: localhost - become: false diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/status_update.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/status_update.yml deleted file mode 100644 index cc5912998..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/status_update.yml +++ /dev/null @@ -1,62 +0,0 @@ ---- -- vars: - new_conditions: - delegate_to: localhost - become: false - block: - - name: Check if status file exists - stat: - path: "{{ path_to_status }}" - register: status_file - - - name: Define default status - set_fact: - default_status: - status: - conditions: - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "True" - type: "Deployed" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "FaultInjected" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "Destroyed" - - - name: Create default status file if it does not exist - copy: - content: "{{ default_status | to_json(indent=2) }}" - dest: "{{ path_to_status }}" - when: not status_file.stat.exists - - - name: Read existing status from JSON file - slurp: - src: "{{ path_to_status }}" - register: current_status - - - name: Convert current status to dictionary - set_fact: - current_status_dict: "{{ current_status.content | b64decode | from_json }}" - - - name: Initialize updated_conditions as an empty list - set_fact: - updated_conditions: [] - - - name: Loop through each condition and update only matching ones - set_fact: - updated_conditions: "{{ updated_conditions + [ (updated_item | combine({'lastTransitionTime': ansible_date_time.iso8601}) if updated_item != item else item) ] }}" - loop: "{{ current_status_dict.status.conditions }}" - loop_control: - loop_var: item - vars: - updated_item: "{{ new_conditions | selectattr('type', 'equalto', item.type) | first | default(item) }}" - - - name: Prepare updated JSON data with kubeconfig - set_fact: - updated_json_data: "{{ current_status_dict | combine({'status': {'conditions': updated_conditions }}) }}" - - - name: Write updated status back to JSON file - copy: - content: "{{ updated_json_data | to_json(indent=2) }}" - dest: "{{ path_to_status }}" diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/user_create.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/user_create.yml deleted file mode 100644 index c1ad378d6..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/user_create.yml +++ /dev/null @@ -1,75 +0,0 @@ ---- -- become: true - block: - - name: Add ansible user - user: - name: "{{ check_target_user }}" - state: present - shell: /bin/bash - create_home: yes - - - name: Set password for ansible user - user: - name: "{{ check_target_user }}" - password: "{{ 'created_user_password' | password_hash('sha512') }}" - - - name: Create .ssh directory - file: - path: "/home/{{ check_target_user }}/.ssh" - state: directory - mode: '0700' - owner: "{{ check_target_user }}" - group: "{{ check_target_user }}" - - - name: Generate SSH key pair - openssh_keypair: - path: "/home/{{ check_target_user }}/.ssh/id_rsa" - owner: "{{ check_target_user }}" - group: "{{ check_target_user }}" - mode: '0600' - type: rsa - size: 2048 - register: keypair - - - name: Set up public key for SSH access - copy: - content: "{{ keypair.public_key }}" - dest: "/home/{{ check_target_user }}/.ssh/authorized_keys" - mode: '0600' - owner: "{{ check_target_user }}" - group: "{{ check_target_user }}" - - - name: Grant sudo privileges to ansible user for ansible-playbook command - copy: - dest: "/etc/sudoers.d/{{ check_target_user }}" - content: | - {{ check_target_user }} ALL=(ALL) NOPASSWD: /usr/bin/ansible-playbook - {{ check_target_user }} ALL=(ALL) NOPASSWD: /bin/sh - mode: '0440' - - - name: Output user details and private key - debug: - msg: | - User created: "{{ check_target_user }}" - Private Key: - {{ keypair.filename }} - - - name: Fetch a file from remote to local - fetch: - src: "{{ keypair.filename }}" - dest: "{{ check_target_ssh_key }}" - flat: yes - become: false - - - name: Define inventory content - set_fact: - inventory_content: | - [rhel9_servers] - rhel9 ansible_host="{{ check_target_hostname }}" ansible_user="{{ check_target_user }}" ansible_ssh_private_key_file="{{ check_target_ssh_key }}" ansible_python_interpreter="{{ check_target_python_interpreter }}" - - - name: Write inventory content to a file - ansible.builtin.copy: - content: "{{ inventory_content }}" - dest: "{{ path_to_evaluator_inventory }}" - delegate_to: localhost - become: false diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/user_remove.yml b/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/user_remove.yml deleted file mode 100644 index e64963793..000000000 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/user_remove.yml +++ /dev/null @@ -1,24 +0,0 @@ ---- -- become: true - block: - - name: "Remove '{{ check_target_user }}' user " - user: - name: "{{ check_target_user }}" - state: absent - remove: yes - - - name: "Remove '{{ check_target_user }}' sudoers file" - file: - path: "/etc/sudoers.d/{{ check_target_user }}" - state: absent - - rescue: - - name: Show full details of the failed task - ansible.builtin.debug: - var: ansible_failed_result - - always: - - name: Ignore errors and continue - ansible.builtin.debug: - msg: "Ignoring errors and marking as success." - ignore_errors: yes diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/Makefile b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/Makefile deleted file mode 100644 index ca92896b3..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/Makefile +++ /dev/null @@ -1,84 +0,0 @@ -help: - @echo "Makefile commands:" - @echo "deploy_bundle -- [onetime] deploys the bundle to the cluster" - @echo "inject_fault -- [onetime] define a new policy (policies) and enable fault for hitting CIS Benchmark controls" - @echo "destroy_bundle -- [onetime] destroy the target environment" - @echo "revert_bundle -- [onetime] revert the target environment" - @echo "get -- [onetime] get status and evaluation" - @echo "get_status -- [onetime] get status" - @echo "evaluate -- [onetime] evaluate" - @echo "Option FOREGROUND=true for synchronous execution. Default execute as background job." - @echo "Option INPUT_FILE=" - @echo "help - Display this help information" - -export WORK_DIR = /tmp/scenario - -INPUT_FILE ?= -DEFAULT_INPUT_FILE := input.json -PASSED_INPUT_FILE := $(WORK_DIR)/input.json -export BUNDLE_INPUT_FILE := $(PASSED_INPUT_FILE) - -# parameters to replace default input.json -KUBECONFIG := -SHARED_WORKSPACE := -JQ_UPDATE_TEMPLATE = if [ -n "$(1)" ]; then \ - jq --arg key_value "$(1)" '.$(2) = $$key_value' $(PASSED_INPUT_FILE) > tmp.json && mv tmp.json $(PASSED_INPUT_FILE) ;\ -fi - -ifeq ($(FOREGROUND), true) - REDIRECT := - BG := -else - REDIRECT := &> $$WORK_DIR/$(LOG_FILE) - BG := & -endif - -ifeq ($(TEST), true) - PLAYBOOK_DIR := ./stubs -else - PLAYBOOK_DIR := ./playbooks -endif - -prepare_directory: - @mkdir -p "$(WORK_DIR)" - @if [ -z "$(INPUT_FILE)" ]; then \ - echo "Using default input file with override by parameters" 1>&2;\ - cp $(DEFAULT_INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - $(call JQ_UPDATE_TEMPLATE,$(KUBECONFIG),kubeconfig);\ - $(call JQ_UPDATE_TEMPLATE,$(SHARED_WORKSPACE),shared_workspace);\ - else \ - echo "Using provided input file" 1>&2;\ - cp $(INPUT_FILE) $(PASSED_INPUT_FILE) ;\ - fi - -deploy_bundle: prepare_directory - @cat status.template.json > $$WORK_DIR/status.json - @$(MAKE) run_playbook LOG_FILE=deploy.log PLAYBOOK=deploy.yml - -inject_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=execute.log PLAYBOOK=execute.yml - -destroy_bundle: prepare_directory - @$(MAKE) run_playbook LOG_FILE=destroy.log PLAYBOOK=destroy.yml - -remove_fault: prepare_directory - @$(MAKE) run_playbook LOG_FILE=remove.log PLAYBOOK=fault_removal.yml - -revert: prepare_directory - @$(MAKE) run_playbook LOG_FILE=revert.log PLAYBOOK=revert.yml - -evaluate: prepare_directory - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=evaluate.log PLAYBOOK=evaluate.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/evaluation.json\"" 1>&2; \ - cat $(WORK_DIR)/evaluation.json - -run_playbook: EXTRA_VARS ?= -run_playbook: prepare_directory - @echo "ansible-playbook $(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG)" - @ansible-playbook $(PLAYBOOK_DIR)/$(PLAYBOOK) $(EXTRA_VARS) $(REDIRECT) $(BG) - -get: prepare_directory - @$(MAKE) run_playbook BG="" REDIRECT="" LOG_FILE=goal.log PLAYBOOK=goal.yml EXTRA_VARS="--extra-vars \"path_to_output=$(WORK_DIR)/goal.json \"" 1>&2 - @jq -s '{metadata: .[0]}' info.json | jq .goal_template=input.goal - $$WORK_DIR/goal.json | jq .vars=input.vars - $$WORK_DIR/goal.json - -get_status: prepare_directory - @cat $$WORK_DIR/status.json diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/eval_config.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/eval_config.yaml deleted file mode 100644 index ad1d4bac2..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/eval_config.yaml +++ /dev/null @@ -1,11 +0,0 @@ -check_violations: - - policy_name: "container-security-controls" - resource: - name: "test-untrusted-registry" - namespace: "paa" - kind: "Pod" - api_version: "v1" - expected_result: fail - -check_unchanged_policies: - - policy_name: "service-account-requirements" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/evaluation.py b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/evaluation.py deleted file mode 100644 index 6a0b9afb0..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/evaluation.py +++ /dev/null @@ -1,175 +0,0 @@ -# Copyright contributors to the ITBench project. All rights reserved. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# https://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -import argparse -import json -import logging - -import yaml - -logger = logging.getLogger(__name__) -log_format = '[%(asctime)s %(levelname)s %(name)s] %(message)s' - - -def load_yaml(filename): - with open(filename, 'r') as file: - data = yaml.safe_load(file) - return data - - -def load_yaml_docs(filename): - with open(filename, 'r') as file: - documents = yaml.safe_load_all(file) - return list(documents) - - -def check_violation_in_policy_reports(policy_reports, test, strict_check): - - policy_name = test["policy_name"] - ignore_policies = test.get("ignore_policies", []) - resource = test["resource"] - expected_result = test["expected_result"] - name = resource["name"] - namespace = resource.get("namespace", "") - kind = resource["kind"] - api_version = resource["api_version"] - - def is_scoped(r): - s = r.get("scope", {}) - return s.get("namespace", "") == namespace and s.get("name") == name and s.get("kind") == kind and s.get("apiVersion") == api_version - - filtered_by_resource = [r for r in policy_reports if is_scoped(r)] - - for report in filtered_by_resource: - if strict_check: # check if other policies hit and do not accept it - for r in [r for r in report.get("results", []) if not r.get("policy") in [policy_name] + ignore_policies]: - if r.get("result") == expected_result: - return build_check_result( - test, - False, - f"Strict policy strict check failed: Detected expected result '{expected_result}' in a different policy '{policy_name}' for resource '{name}'", - ) - elif r.get("result") != expected_result: - return build_check_result( - test, - False, - f"Strict policy check failed: Detected result '{r.get('result')}' in a different policy '{policy_name}' for resource '{name}', expected '{expected_result}'", - ) - for r in [r for r in report.get("results", []) if r.get("policy") == policy_name]: - if r.get("result") == expected_result: - return build_check_result( - test, True, f"Policy check passed: Detected expected result '{expected_result}' in policy '{policy_name}' for resource '{name}'" - ) - elif r.get("result") != expected_result: - return build_check_result( - test, - False, - f"Policy check failed: Detected result '{r.get('result')}' in policy '{policy_name}' for resource '{name}', expected '{expected_result}'", - ) - - if expected_result == "pass" and not any(r.get("policy") == policy_name for r in filtered_by_resource): - return build_check_result( - test, True, f"Policy check passed: Resource '{name}' not found in policy '{policy_name}', as expected for result '{expected_result}'" - ) - - return build_check_result(test, False, f"Policy check failed: Not found the scoped resource '{name}'") - - -def compare_dicts(expected, actual): - if isinstance(expected, dict) and isinstance(actual, dict): - for key, value in expected.items(): - if key not in actual or not compare_dicts(value, actual[key]): - return False - return True - elif isinstance(expected, list) and isinstance(actual, list): - return all(compare_dicts(e, a) for e, a in zip(expected, actual)) - else: - return expected == actual - - -def check_policy_rules_unchanged(existing_policies, current_policies, test): - policy_name = test["policy_name"] - filtered = [policy for policy in existing_policies if policy.get("metadata", {}).get("name") == policy_name] - if len(filtered) == 0: - return build_check_result(test, False, f"Policy {policy_name} not found in existing policies.") - existing_policy = filtered[0] - - filtered = [policy for policy in current_policies if policy.get("metadata", {}).get("name") == policy_name] - if len(filtered) == 0: - return build_check_result(test, False, f"Policy {policy_name} not found in current policies.") - current_policy = filtered[0] - - expected_rules = existing_policy.get("spec", {}).get("rules", []) - actual_rules = current_policy.get("spec", {}).get("rules", []) - if not compare_dicts(expected_rules, actual_rules): - message = f"Rules mismatch in policy: {policy_name}" - return build_check_result(test, False, message) - - return build_check_result(test, True, f"Policy integrity check passed: No modifications detected in rules for policy '{policy_name}'") - - -def build_check_result(test, result, message, error=None): - - r = {"pass": result, "message": message} - if error: - r["error"] = f"{error}" - logger.info(message) - return r - - -def main(config_path, epol, pol, cpol, polr, cpolr, output_path): - try: - config_data = load_yaml(config_path) - - policies = load_yaml(pol)["items"] + load_yaml(cpol)["items"] - policy_reports = load_yaml(polr)["items"] + load_yaml(cpolr)["items"] - - existing_policies = load_yaml_docs(epol) - - check_results = [] - for test in config_data["check_violations"]: - if test.get("strict_check", False): - check_result = check_violation_in_policy_reports(policy_reports, test, True) - check_results.append(check_result) - check_result = check_violation_in_policy_reports(policy_reports, test, False) - check_results.append(check_result) - - for test in config_data["check_unchanged_policies"]: - check_result = check_policy_rules_unchanged(existing_policies, policies, test) - check_results.append(check_result) - - overall_pass = all(result["pass"] for result in check_results) - output = {"pass": overall_pass, "details": check_results} - except Exception as e: - output = {"pass": False, "details": [], "error": f"{e}"} - - o = json.dumps(output, indent=2) - if output_path: - with open(output_path, "w") as f: - f.write(o) - else: - print(json.dumps(output, indent=2)) - - -if __name__ == "__main__": - parser = argparse.ArgumentParser(description="Validate Kyverno policy checks.") - parser.add_argument("--epol", type=str, help="Path to the existing policies (yaml docs)") - parser.add_argument("--pol", type=str, help="Path to the all policies in JSON (k get pol -A -o yaml)") - parser.add_argument("--cpol", type=str, help="Path to the all cluster policies in JSON (k get cpol -o yaml)") - parser.add_argument("--polr", type=str, help="Path to the all policy reports in JSON (k get polr -A -o yaml)") - parser.add_argument("--cpolr", type=str, help="Path to the all cluster policy reports in JSON (k get cpolr -o yaml)") - parser.add_argument("config_path", type=str, help="Path to the JSON configuration file") - parser.add_argument("-o", "--output", type=str, help="Path to the output JSON file (Default stdout.)") - args = parser.parse_args() - main(args.config_path, args.epol, args.pol, args.cpol, args.polr, args.cpolr, args.output) diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-fix-policy.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-fix-policy.yaml deleted file mode 100644 index 9f65c9d94..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-fix-policy.yaml +++ /dev/null @@ -1,21 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: container-security-controls -spec: - rules: - - name: disallow-privilege-escalation-and-root - match: - resources: - kinds: - - Pod - validate: - message: "Privilege escalation and root user execution are not allowed, and only images from trusted-registry.com are permitted." - pattern: - spec: - containers: - - (name): "*" - securityContext: - allowPrivilegeEscalation: false - runAsNonRoot: true - image: "trusted-registry.com/*" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-policy-report-after-fix.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-policy-report-after-fix.yaml deleted file mode 100644 index 0aae8c9e3..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-policy-report-after-fix.yaml +++ /dev/null @@ -1,49 +0,0 @@ -apiVersion: wgpolicyk8s.io/v1alpha2 -kind: PolicyReport -metadata: - creationTimestamp: "2024-11-13T05:24:34Z" - generation: 3 - labels: - app.kubernetes.io/managed-by: kyverno - name: a7f1666b-cf62-41d6-9b13-ced385d6cea3 - namespace: paa - ownerReferences: - - apiVersion: v1 - kind: Pod - name: test-untrusted-registry - uid: a7f1666b-cf62-41d6-9b13-ced385d6cea3 - resourceVersion: "62948" - uid: ef9b647c-a663-4058-abba-d3822d34744f -results: -- message: validation rule 'require-non-default-service-account' passed. - policy: service-account-requirements - result: pass - rule: require-non-default-service-account - scored: true - source: kyverno - timestamp: - nanos: 0 - seconds: 1731475595 -- message: 'validation error: Privilege escalation and root user execution are not - allowed, and only images from trusted-registry.com are permitted. rule disallow-privilege-escalation-and-root - failed at path /spec/containers/0/image/' - policy: container-security-controls - result: fail - rule: disallow-privilege-escalation-and-root - scored: true - source: kyverno - timestamp: - nanos: 0 - seconds: 1731475595 -scope: - apiVersion: v1 - kind: Pod - name: test-untrusted-registry - namespace: paa - uid: a7f1666b-cf62-41d6-9b13-ced385d6cea3 -summary: - error: 0 - fail: 1 - pass: 1 - skip: 0 - warn: 0 diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-policy-report-before-fix.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-policy-report-before-fix.yaml deleted file mode 100644 index 26cefab6c..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/examples/example-policy-report-before-fix.yaml +++ /dev/null @@ -1,52 +0,0 @@ -apiVersion: v1 -items: -- apiVersion: wgpolicyk8s.io/v1alpha2 - kind: PolicyReport - metadata: - creationTimestamp: "2024-11-13T05:32:51Z" - generation: 1 - labels: - app.kubernetes.io/managed-by: kyverno - name: 4bddea03-cff9-4f23-ab84-d0529354ef53 - namespace: paa - ownerReferences: - - apiVersion: v1 - kind: Pod - name: test-untrusted-registry - uid: 4bddea03-cff9-4f23-ab84-d0529354ef53 - resourceVersion: "64635" - uid: 35869895-af0b-496e-944d-c539a75a1606 - results: - - message: validation rule 'require-non-default-service-account' passed. - policy: service-account-requirements - result: pass - rule: require-non-default-service-account - scored: true - source: kyverno - timestamp: - nanos: 0 - seconds: 1731475961 - - message: validation rule 'disallow-privilege-escalation' passed. - policy: container-security-controls - result: pass - rule: disallow-privilege-escalation - scored: true - source: kyverno - timestamp: - nanos: 0 - seconds: 1731475961 - scope: - apiVersion: v1 - kind: Pod - name: test-untrusted-registry - namespace: paa - uid: 4bddea03-cff9-4f23-ab84-d0529354ef53 - summary: - error: 0 - fail: 0 - pass: 2 - skip: 0 - warn: 0 -kind: List -metadata: - resourceVersion: "" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/info.json b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/info.json deleted file mode 100644 index 8a1f0ec02..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/info.json +++ /dev/null @@ -1,7 +0,0 @@ -{ - "name": "policy-adapt/scenario1", - "description": "Kyverno Policy Adapting: Enhancing Policies for Root and Trusted Registry Requirements", - "incident_type": "policy-adapt", - "scenario_type": "Upd-CIS-b-K8s-Kyverno", - "goal": "Currently, the following Kyverno policies are deployed in the Kubernetes cluster. Review these existing policies and edit them to meet additional security requirements. Please avoid creating new policy resources; instead, make the necessary changes directly to the existing resources.\n\n Prohibit the use of the default service account\n Prohibit privilege escalation\n\nHowever, the new internal security policy now requires the following additional conditions:\n\n Prohibit running as the root user\n Only allow signed images from a trusted registry (trusted-registry.com)\n\nYour task is to review the existing Kyverno policies and directly edit the existing policies to meet these new requirements. Do not change the resource names. Once you have completed the edits, update the existing resources in the Kubernetes cluster.\nSteps\n\n Review and Edit Kyverno Policies\n Directly modify the existing policy resources to meet the new requirements. Ensure that you do not change the names of the resources." -} diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/input.json b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/input.json deleted file mode 100644 index 95d51962b..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/input.json +++ /dev/null @@ -1,4 +0,0 @@ -{ - "shared_workspace": "/tmp/agent", - "kubeconfig": "/etc/ciso-task-scenarios/kubeconfig.yaml" -} diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/manifests/application.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/manifests/application.yaml deleted file mode 100644 index 148e51506..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/manifests/application.yaml +++ /dev/null @@ -1,29 +0,0 @@ -apiVersion: v1 -kind: ServiceAccount -metadata: - namespace: paa - name: non-default-sa ---- -apiVersion: rbac.authorization.k8s.io/v1 -kind: Role -metadata: - namespace: paa - name: test-role -rules: - - apiGroups: [""] - resources: ["pods"] - verbs: ["get", "list"] ---- -apiVersion: v1 -kind: Pod -metadata: - namespace: paa - name: test-untrusted-registry -spec: - serviceAccountName: non-default-sa - containers: - - name: test - image: untrusted-registry.com/test-image - securityContext: - allowPrivilegeEscalation: false - runAsUser: 1000 diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/manifests/existing-policy.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/manifests/existing-policy.yaml deleted file mode 100644 index e2495d4b2..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/manifests/existing-policy.yaml +++ /dev/null @@ -1,36 +0,0 @@ -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: service-account-requirements -spec: - rules: - - name: require-non-default-service-account - match: - resources: - kinds: - - Pod - validate: - message: "A non-default service account must be specified." - pattern: - spec: - serviceAccountName: "!default" ---- -apiVersion: kyverno.io/v1 -kind: ClusterPolicy -metadata: - name: container-security-controls -spec: - rules: - - name: disallow-privilege-escalation - match: - resources: - kinds: - - Pod - validate: - message: "Privilege escalation is not allowed." - pattern: - spec: - containers: - - (name): "*" - securityContext: - allowPrivilegeEscalation: false diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/deploy.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/deploy.yml deleted file mode 100644 index 2be6cd5ef..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/deploy.yml +++ /dev/null @@ -1,129 +0,0 @@ -- name: Deploy the environment - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - - block: - - debug: - msg: "Executing block: Create cluster" - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Deploying KinD Cluster..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - - include_tasks: ../tasks/kind_create.yml - when: provided_kubeconfig == '' - - - block: - - debug: - msg: "Executing block: Use existing cluster" - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentInProgress" - message: "Connecting an existing cluster..." - - type: "FaultInjected" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentNotReady" - message: "Waiting for the deployment to complete" - - debug: - var: bundle_input_file - - debug: - var: bundle_input - - debug: - var: shared_workspace - - name: "Write kubeconfig to {{ kubeconfig }} for Bundle Setup" - copy: - src: "{{ provided_kubeconfig }}" - dest: "{{ kubeconfig }}" - when: provided_kubeconfig != '' - - # TODO: Create Kubeconfig for a temporal service account - - name: "Write kubeconfig to {{ agent_kubeconfig }} for Agent" - copy: - src: "{{ kubeconfig }}" - dest: "{{ agent_kubeconfig }}" - - - name: Check if namespace exists - kubernetes.core.k8s_info: - kubeconfig: "{{ kubeconfig }}" - kind: Namespace - name: "{{ target_ns }}" - register: namespace_info - failed_when: false # Don't fail if namespace doesn't exist - - - name: Print namespace_info for debugging - debug: - var: namespace_info - - - name: Create namespace if it does not exist - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - definition: - apiVersion: v1 - kind: Namespace - metadata: - name: "{{ target_ns }}" - when: namespace_info.resources | length == 0 - - - include_tasks: ../tasks/kyverno_install.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "DeploymentFailed" - message: > - Deployment is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "FaultInjected" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - type: "Destroyed" - status: "False" - reason: "DeploymentFailed" - message: "Waiting for the deployment to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/destroy.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/destroy.yml deleted file mode 100644 index fef00951a..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/destroy.yml +++ /dev/null @@ -1,52 +0,0 @@ ---- -- name: Destroy the environment - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - - include_tasks: ../tasks/fault_removal.yml - - - include_tasks: ../tasks/kind_delete.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "False" - reason: "AlreadyDestroyed" - - type: "FaultInjected" - status: "False" - reason: "AlreadyDestroyed" - - type: "Destroyed" - status: "True" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyFailed" - message: > - Failed to destroy due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/evaluate.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/evaluate.yml deleted file mode 100644 index 39ee5ee09..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/evaluate.yml +++ /dev/null @@ -1,91 +0,0 @@ ---- -- name: Evaluate the system compliance - hosts: localhost - vars_files: - - ./vars.yaml - vars: - shared_workspace: /tmp - path_to_output: /tmp/evaluate.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - name: Ensure virtual environment exists - ansible.builtin.stat: - path: "{{ venv_dir }}/bin/activate" - register: venv_exists - - - name: Create a virtual environment - ansible.builtin.command: - cmd: "python3 -m venv {{ venv_dir }}" - args: - creates: venv_path/bin/activate - when: not venv_exists.stat.exists - - - name: Install modules - ansible.builtin.command: - argv: - - "{{ venv_python }}" - - -m - - pip - - install - - PyYaml - - - name: Download all Policies - shell: "kubectl get policy -A --kubeconfig={{ kubeconfig }} -o yaml > {{ work_dir }}/policies.yaml" - - name: Download all ClusterPolicies - shell: "kubectl get clusterpolicy --kubeconfig={{ kubeconfig }} -o yaml > {{ work_dir }}/clusterpolicies.yaml" - - name: Download all PolicyReports - shell: "kubectl get policyreport -A --kubeconfig={{ kubeconfig }} -o yaml > {{ work_dir }}/policyreports.yaml" - - name: Download all ClusterPolicyReports - shell: "kubectl get clusterpolicyreport --kubeconfig={{ kubeconfig }} -o yaml > {{ work_dir }}/clusterpolicyreports.yaml" - - - name: Run evaluation - ansible.builtin.command: - argv: - - "{{ venv_python }}" - - ../evaluation.py - - ../eval_config.yaml - - --epol - - ../manifests/existing-policy.yaml - - --pol - - "{{ work_dir }}/policies.yaml" - - --cpol - - "{{ work_dir }}/clusterpolicies.yaml" - - --polr - - "{{ work_dir }}/policyreports.yaml" - - --cpolr - - "{{ work_dir }}/clusterpolicyreports.yaml" - register: evaluation_output - - - name: Dump evaluation output to file - ansible.builtin.copy: - content: "{{ evaluation_output.stdout }}" - dest: "{{ path_to_output }}" - - - name: Pretty print the - debug: - msg: "{{ evaluation_output }}" - - rescue: - - name: Set pass result - set_fact: - pass_result: - pass: false - errors: - - code: "{{ ansible_failed_task.name }}" - message: | - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg | default('No error message provided') }} - {{ ansible_failed_result.stdout | default('No stdout provided') }} - {{ ansible_failed_result.stderr | default('No stderr provided'}} - - - - name: Write pass result to JSON file - copy: - content: "{{ pass_result | to_json }}" - dest: "{{ path_to_output }}" - - - name: Pretty print the - debug: - msg: "{{ pass_result }}" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/execute.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/execute.yml deleted file mode 100644 index 70bceb016..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/execute.yml +++ /dev/null @@ -1,54 +0,0 @@ ---- -- name: Execute fault injection - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - - include_tasks: ../tasks/fault_inject.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - - type: "Destroyed" - status: "False" - reason: "DestroyNotReady" - message: "Waiting for the destruction" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionFailed" - message: > - FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "FaultInjectionFailed" - message: "Waiting for the fault injection to complete" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/fault_inject.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/fault_inject.yml deleted file mode 100644 index 665c84fde..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/fault_inject.yml +++ /dev/null @@ -1,4 +0,0 @@ -- name: Perform fault injection - hosts: localhost - tasks: - - include_tasks: ../tasks/fault_injection.yml diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/fault_removal.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/fault_removal.yml deleted file mode 100644 index a30bdd8b2..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/fault_removal.yml +++ /dev/null @@ -1,7 +0,0 @@ ---- -- name: Remove the violated resources - hosts: localhost - vars_files: - - ./vars.yaml - tasks: - - include_tasks: ../tasks/fault_removal.yml diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/goal.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/goal.yml deleted file mode 100644 index 9b9ad5050..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/goal.yml +++ /dev/null @@ -1,29 +0,0 @@ ---- -- name: Build a goal descriptioin - hosts: localhost - vars_files: - - ./vars.yaml - vars: - shared_workspace: /tmp - path_to_output: /tmp/goal.json - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - name: Load info.json - set_fact: - info_content: "{{ lookup('file', '../info.json') | from_json }}" - - - name: Build the goal description - set_fact: - goal_object: - goal: | - {{ info_content.goal }} - - The cluster's kubeconfig is at `{% raw %}{{ kubeconfig }}{% endraw %}`. - vars: - kubeconfig: "{{ lookup('file', agent_kubeconfig) }}" - - - name: Write the goal description to JSON file - copy: - content: "{{ goal_object | to_json }}" - dest: "{{ path_to_output }}" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/revert.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/revert.yml deleted file mode 100644 index 05e4e45a6..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/revert.yml +++ /dev/null @@ -1,56 +0,0 @@ ---- -- name: Execute fault injection - hosts: localhost - vars_files: - - ./vars.yaml - pre_tasks: - - include_tasks: ../tasks/precondition_setup.yml - tasks: - - block: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "True" - reason: "FaultInjectionNotReady" - message: "Reverting the injected fault" - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be reverted" - - - include_tasks: ../tasks/fault_removal.yml - - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "FaultInjected" - status: "False" - reason: "FaultInjectionNotReady" - message: "Fault-injecting ..." - - type: "Destroyed" - status: "False" - reason: "FaultInjectionNotReady" - message: "Waiting for the fault injection to be completed" - - rescue: - - include_tasks: ../tasks/status_update.yml - vars: - new_conditions: - - type: "Deployed" - status: "True" - - type: "FaultInjected" - status: "True" - reason: "RevertingFaultInjectionFailed" - message: > - Reverting FaultInjection is failed due to the following reason. - The task "{{ ansible_failed_task.name }}" failed with error: - {{ ansible_failed_result.msg }} - - type: "Destroyed" - status: "False" - reason: "RevertingFaultInjectionFailed" - message: "Waiting for the fault injection to be reverted" - - - name: Show full details of the failed task - debug: - var: ansible_failed_result diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/vars.yaml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/vars.yaml deleted file mode 100644 index b4d3c9e33..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/playbooks/vars.yaml +++ /dev/null @@ -1,20 +0,0 @@ -target_ns: paa -cluster_name: ciso-scenario -bundle_id: "{{ cookiecutter.bundle_name }}" -bundle_title: "{{ cookiecutter.bundle_title }}" -work_dir: "{{ lookup('env', 'WORK_DIR') | default('/tmp/caa-bench', true) }}" - -bundle_input_file: "{{ lookup('env', 'BUNDLE_INPUT_FILE') | default('../input.json', true) }}" -bundle_input: "{{ lookup('file', bundle_input_file) | from_json }}" - -provided_kubeconfig: "{{ bundle_input.kubeconfig | default('') }}" -kubeconfig: "{{ work_dir }}/kubeconfig.caa.yaml" -path_to_status: "{{ work_dir }}/status.json" - -shared_workspace: "{{ bundle_input.shared_workspace }}" -agent_kubeconfig: "{{ shared_workspace }}/kubeconfig.yaml" -agent_output: "{{ shared_workspace }}/agent_output.data" -agent_output_destination: "{{ work_dir }}/agent_output" - -venv_dir: "{{ work_dir }}/.venv" -venv_python: "{{ venv_dir }}/bin/python" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/status.template.json b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/status.template.json deleted file mode 100644 index 51789b0cb..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/status.template.json +++ /dev/null @@ -1,21 +0,0 @@ -{ - "status": { - "conditions": [ - { - "type": "Deployed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "FaultInjected", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - }, - { - "type": "Destroyed", - "status": "False", - "lastTransitionTime": "2024-01-01T00:00:00Z" - } - ] - } -} diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/fault_inject.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/fault_inject.yml deleted file mode 100644 index bba62352a..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/fault_inject.yml +++ /dev/null @@ -1,13 +0,0 @@ ---- -- name: Deploy non compliant resources - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - namespace: "{{ target_ns }}" - src: "../manifests/application.yaml" -- name: Deploy Policies - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: present - namespace: "{{ target_ns }}" - src: "../manifests/existing-policy.yaml" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/fault_removal.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/fault_removal.yml deleted file mode 100644 index 4d1c4190f..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/fault_removal.yml +++ /dev/null @@ -1,9 +0,0 @@ ---- -- name: Delete the non compliant pods - kubernetes.core.k8s: - kubeconfig: "{{ kubeconfig }}" - state: absent - namespace: "{{ target_ns }}" - src: "../manifests/application.yaml" -- name: Delete all Policies/ClusterPolicies - command: kubectl delete policy,clusterpolicy --all --kubeconfig="{{ kubeconfig }}" diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kind_create.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kind_create.yml deleted file mode 100644 index a579ab15f..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kind_create.yml +++ /dev/null @@ -1,26 +0,0 @@ -- name: Check if KinD cluster exists - command: kind get clusters - register: cluster_list - -- name: Create KinD cluster if it doesn't exist - command: kind create cluster --name "{{ cluster_name }}" --kubeconfig "{{ kubeconfig }}" --image kindest/node:v1.28.13 --wait 5m - when: cluster_name not in cluster_list.stdout_lines - register: create_result - ignore_errors: true # Ignore errors if cluster already exists - -- name: Get kubeconfig for existing cluster - command: kind get kubeconfig --name {{ cluster_name }} - when: cluster_name in cluster_list.stdout_lines - register: kubeconfig_result - -- name: Write kubeconfig to /tmp/kubeconfig.yaml - copy: - content: "{{ kubeconfig_result.stdout }}" - dest: "{{ kubeconfig }}" - when: cluster_name in cluster_list.stdout_lines - -- name: Check if KinD cluster is running by getting namespaces - command: kubectl get ns --kubeconfig {{ kubeconfig }} - register: ns_result - failed_when: "'Active' not in ns_result.stdout" - ignore_errors: true diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kind_delete.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kind_delete.yml deleted file mode 100644 index 14045fbd7..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kind_delete.yml +++ /dev/null @@ -1,4 +0,0 @@ ---- -- name: Delete KinD cluster exists - command: kind delete cluster --name "{{ cluster_name }}" - register: cluster_list diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kyverno_install.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kyverno_install.yml deleted file mode 100644 index 2173c05cb..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kyverno_install.yml +++ /dev/null @@ -1,38 +0,0 @@ ---- -- name: Add Kyverno Helm repo - kubernetes.core.helm_repository: - name: kyverno - repo_url: https://kyverno.github.io/kyverno/ - -- name: Install Kyverno via Helm - kubernetes.core.helm: - kubeconfig: "{{ kubeconfig }}" - state: present - name: kyverno - chart_ref: kyverno/kyverno - release_namespace: kyverno - create_namespace: true - -- name: Wait until all kyverno deployments are available - command: > - kubectl wait --for=condition=available deployment --all --namespace=kyverno --timeout=300s - environment: - KUBECONFIG: "{{ kubeconfig }}" - register: result - failed_when: result.rc != 0 - -- name: Wait for all kyverno pods to be running - kubernetes.core.k8s_info: - kubeconfig: "{{ kubeconfig }}" - namespace: kyverno - kind: Pod - register: pod_info - until: > - pod_info.resources | selectattr('status.phase', 'in', ['Running', 'Completed']) | list | length == pod_info.resources | length - retries: 1 - delay: 15 - failed_when: pod_info.resources | length == 0 - -- name: Print result of kubectl wait command - debug: - var: result.stdout diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kyverno_uninstall.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kyverno_uninstall.yml deleted file mode 100644 index 47b011498..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/kyverno_uninstall.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -- name: Uninstall Kyverno via Helm - kubernetes.core.helm: - kubeconfig: "{{ kubeconfig }}" - state: absent - name: kyverno - chart_ref: kyverno/kyverno - release_namespace: kyverno diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/precondition_setup.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/precondition_setup.yml deleted file mode 100644 index c3d47cc81..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/precondition_setup.yml +++ /dev/null @@ -1,5 +0,0 @@ ---- -- name: Check if the directory exists and create it if necessary - file: - path: "{{ work_dir }}" - state: directory diff --git a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/status_update.yml b/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/status_update.yml deleted file mode 100644 index 9b456ca26..000000000 --- a/scenarios/ciso/4.upd-cis-b-k8s-kyverno/tasks/status_update.yml +++ /dev/null @@ -1,60 +0,0 @@ ---- -- vars: - new_conditions: - block: - - name: Check if status file exists - stat: - path: "{{ path_to_status }}" - register: status_file - - - name: Define default status - set_fact: - default_status: - status: - conditions: - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "True" - type: "Deployed" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "FaultInjected" - - lastTransitionTime: "{{ ansible_date_time.iso8601 }}" - status: "Unknown" - type: "Destroyed" - - - name: Create default status file if it does not exist - copy: - content: "{{ default_status | to_json(indent=2) }}" - dest: "{{ path_to_status }}" - when: not status_file.stat.exists - - - name: Read existing status from JSON file - slurp: - src: "{{ path_to_status }}" - register: current_status - - - name: Convert current status to dictionary - set_fact: - current_status_dict: "{{ current_status.content | b64decode | from_json }}" - - - name: Initialize updated_conditions as an empty list - set_fact: - updated_conditions: [] - - - name: Loop through each condition and update only matching ones - set_fact: - updated_conditions: "{{ updated_conditions + [ (updated_item | combine({'lastTransitionTime': ansible_date_time.iso8601}) if updated_item != item else item) ] }}" - loop: "{{ current_status_dict.status.conditions }}" - loop_control: - loop_var: item - vars: - updated_item: "{{ new_conditions | selectattr('type', 'equalto', item.type) | first | default(item) }}" - - - name: Prepare updated JSON data with kubeconfig - set_fact: - updated_json_data: "{{ current_status_dict | combine({'status': {'conditions': updated_conditions }}) }}" - - - name: Write updated status back to JSON file - copy: - content: "{{ updated_json_data | to_json(indent=2) }}" - dest: "{{ path_to_status }}" diff --git a/scenarios/ciso/Dockerfile b/scenarios/ciso/Dockerfile deleted file mode 100644 index c669dea9a..000000000 --- a/scenarios/ciso/Dockerfile +++ /dev/null @@ -1,57 +0,0 @@ -FROM registry.access.redhat.com/ubi9/python-311:9.8-1779945715 - -USER 0 -RUN dnf update -y && dnf install -y gnupg2 unzip openssh -RUN mkdir /etc/agent-benchmark -RUN ln -sf /bin/bash /bin/sh - -# install `ansible-playbook` -RUN pip install --upgrade setuptools==70.0.0 -RUN pip install ansible-core jmespath kubernetes==31.0.0 --no-cache-dir passlib -# install `helm` -RUN curl -fsSL https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash -# install `jq` -RUN dnf install -y jq -# install `make` -RUN dnf install -y make - -# identify architecture -ENV ARCH=unknown -RUN ARCH=$(uname -m) && \ - case "$ARCH" in \ - x86_64) ARCH=amd64 ;; \ - aarch64) ARCH=arm64 ;; \ - *) echo "unsupported architecture: $ARCH" && exit 1 ;; \ - esac && \ - echo "ARCH=$ARCH" >> /etc/environment - -# install `kubectl` -RUN source /etc/environment && \ - curl -LO https://dl.k8s.io/release/v1.31.0/bin/linux/${ARCH}/kubectl && \ - chmod +x ./kubectl && \ - mv ./kubectl /usr/local/bin/kubectl -# install `aws` (need this for using kubectl against AWS cluster) -RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && \ - unzip awscliv2.zip && \ - ./aws/install -# install `opa` -RUN source /etc/environment && \ - curl -L -o opa https://github.com/open-policy-agent/opa/releases/download/v1.0.0/opa_linux_${ARCH}_static && \ - chmod +x ./opa && \ - mv ./opa /usr/local/bin/opa - -RUN echo "StrictHostKeyChecking no" >> /etc/ssh/ssh_config - -USER 1001 -RUN ansible-galaxy collection install kubernetes.core community.crypto - -WORKDIR /etc/ciso-task-scenarios -ENV FOREGROUND=true -ENV MAKEFLAGS=-s -ENV KUBECONFIG=/etc/ciso-task-scenarios/kubeconfig.yaml -ENV SHARED_WORKSPACE=/tmp/agent - -COPY 1.gen-cis-b-k8s-kyverno ./1.gen-cis-b-k8s-kyverno -COPY 2.gen-cis-b-k8s-kubectl-opa ./2.gen-cis-b-k8s-kubectl-opa -COPY 3.gen-cis-b-rhel9-ansible-opa ./3.gen-cis-b-rhel9-ansible-opa -COPY 4.upd-cis-b-k8s-kyverno ./4.upd-cis-b-k8s-kyverno diff --git a/scenarios/ciso/README.md b/scenarios/ciso/README.md deleted file mode 100644 index 3bfb227a3..000000000 --- a/scenarios/ciso/README.md +++ /dev/null @@ -1,659 +0,0 @@ -# CISO (Chief Information Security Officer) Sample Task Scenarios - -Here is an example of Task Scenario used in an automation package to benchmark Agent for CISOs. - -This repository contains following 4 category of scenarios: - -``` -. -├── 1.gen-cis-b-k8s-kyverno -├── 2.gen-cis-b-k8s-kubectl-opa -├── 3.gen-cis-b-rhel9-ansible-opa -├── 4.upd-cis-b-k8s-kyvernoz -└── README.md -``` - -Each scenario includes a setup for a compliance misconfigured environment and tools to check and address if the misconfiguration is resolved or not. - -## Table of Contents - -1. [Scenarios](#scenarios) - - [1. gen-cis-b-k8s-kyverno](#1-gen-cis-b-k8s-kyverno) - - [2. gen-cis-b-k8s-kubectl-opa](#2-gen-cis-b-k8s-kubectl-opa) - - [3. gen-cis-b-rhel9-ansible-opa](#3-gen-cis-b-rhel9-ansible-opa) - - [4. upd-cis-b-k8s-kyverno](#4-upd-cis-b-k8s-kyverno) -2. [Manual Benchmarking Process for the CISO Task Scenario](#manual-benchmarking-process-for-the-ciso-task-scenario) - - [1. Outline](#1-outline) - - [2. Prerequisites](#2-prerequisites) - - [3a. Task Scenario for Targeting a Kubernetes Cluster](#3a-task-scenario-for-targeting-kubernetes-cluster) - - [3b. Task Scenario for Targeting Red Hat Enterprise Linux 9](#3b-task-scenario-for-targeting-red-hat-enterprise-linux-9) - -## Scenarios - -### 1. gen-cis-b-k8s-kyverno -**Description**: This scenario expects to deploy Kyverno policies to detect injected compliance issues in a Kubernetes environment for the compliance requirement "Minimize the admission of containers wishing to share the host network namespace". - -#### 1.1 The agent is expected to do following task request (template value will be substituted): - -``` -I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml` -Minimize the admission of containers wishing to share the host network namespace - -To check the condition, do the following steps. -- deploy a Kyverno policy to the cluster -- chcek if the policy is correctly deployed. - -If deploying the policy failed and if you can fix the issue, you will do it and try deploying again. -Once you get a final answer, you can quit the work. - -The cluster's kubeconfig is at `{{ kubeconfig }}`. -``` - -When an agent is invoked, an input is provided about this scenario. The input is the json following schema. (You can get the exact value by `make get`) - -```json -{ - "metadata": { - "name": "cis-b.5.2.5-gen", // Scenario Name - "description": "CIS Benchmark for K8S 5.2.5 (Kyverno)", // Scenario Description - "scenario_type": "Gen-CIS-b-K8s-Kyverno" // Scenario Type - }, - // The above goal description - "goal_template": "I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml`\n Minimize the admission of containers wishing to share the host network namespace.\n\nTo check the condition, do the following steps. \n- deploy a Kyverno policy to the cluster\n- chcek if the policy is correctly deployed. \n\nIf deploying the policy failed and if you can fix the issue, you will do it and try deploying again.\nOnce you get a final answer, you can quit the work.\n\nThe cluster's kubeconfig is at `{{ kubeconfig }}`.\n", - "vars": { - "kubeconfig": "apiVersion: v1\ncluster...=" // kubeconfig.yaml contents for access to the target Kubernetes - } -} -``` - -#### 1.2 How it is evaluated - -The evaluation verifies the following to return a pass: -- Verify that the specified Kyverno policy produces the expected Kyverno policy report for the target resource. - -Please refer to [evaluation/main.py](/ciso/1.gen-cis-b-k8s-kyverno/evaluation/main.py) for the details. - -#### The contents of the directory**: -``` -├── 1.k8s-kyverno -│ ├── evaluation # Tools or scripts to check if the injected security issues are detected or not in this scenario -│ ├── manifests # Kubernetes resources to be deployed for compliance violation -│ ├── playbooks # Ansible playbooks to set up the scenario environment -│ ├── examples # Example Kyverno Policy to detect the compliance violation -│ └── Makefile # Commands to simplify setup and execution for the scenario -``` - -### 2. gen-cis-b-k8s-kubectl-opa -**Description**: This scenario expects to use kubectl to collect the Kubernetes resources and OPA (Open Policy Agent) to check if the injected compliance issues are detected or not for the compliance requirement "Minimize the admission of containers wishing to share the host network namespace". - -#### 2.1 The agent is expected to do following task request (template value will be substituted): - -``` -I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml` - Minimize the admission of containers wishing to share the host network namespace - -To check the condition, do the following steps. -- get related resource(s) on the cluster by kubectl command -- chcek if the conditions are satisfied by OPA Rego policy - -for those steps, you need to create an OPA Rego policy `policy.rego`. -Also, save the kubectl command as `script.sh` with the following design. -- The script should output the collected related resources to a file named `collected_data.json` in the current working directory. -- Please remove any kubeconfig configuration (e.g. --kubeconfig args) from the script, as users will configure the kubeconfig using environment variables or other methods. - -If running the policy failed and if you can fix the issue, you will do it and try running again. - -Once you get a final answer, you can quit the work. - -The cluster's kubeconfig is at `{{ kubeconfig }}`. -``` - -When an agent is invoked, an input is provided about this scenario. The input is the json following schema. (You can get the exact value by `make get`) -```json -{ - "metadata": { - "name": "k8s-opa/cis-b-gen/5.2.5", // Scenario Name - "description": "CIS Benchmark for K8S 5.2.5 (OPA)", // Scenario Description - "scenario_type": "Gen-CIS-b-K8s-Kubectl-OPA" // Scenario Type - }, - // The above goal description - "goal_template": "I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml`\n Minimize the admission of containers wishing to share the host network namespace. \n\nTo check the condition, do the following steps. \n- get related resource(s) on the cluster by kubectl command\n- chcek if the conditions are satisfied by OPA Rego policy\n\nfor those steps, you need to create an OPA Rego policy `policy.rego`. \nAlso, save the kubectl command as `script.sh` with the following design. \n- The script should output the collected related resources to a file named `collected_data.json` in the current working directory.\n- Please remove any kubeconfig configuration (e.g. --kubeconfig args) from the script, as users will configure the kubeconfig using environment variables or other methods.\n\nIf running the policy failed and if you can fix the issue, you will do it and try running again.\n\nOnce you get a final answer, you can quit the work.\n\nThe cluster's kubeconfig is at `{{ kubeconfig }}`.\n", - "vars": { - "kubeconfig": "apiVersion: v1\nclusters:\n- ..." // kubeconfig.yaml contents for access to the target Kubernetes - } -} -``` - -#### 2.2 How it is evaluated - -The evaluation verifies the following to return a pass: -- Confirm that the script.sh and policy.rego are produced. -- Ensure that script.sh runs successfuly and verify that the collected_data.json is produced. -- Ensure that OPA command runs successfully with the policy.rego against the collected_data.json. -- Verify that the OPA outputs expected result. - -Please refer to [evaluate.yml](/ciso/2.gen-cis-b-k8s-kubectl-opa/playbooks/evaluate.yml) for the details. - -#### The contents of the directory -``` -├── 2.k8s-kubectl-opa -│ ├── evaluation # Tools or scripts to check if the injected security issues are detected or not in this scenario -│ ├── manifests # Kubernetes resources to be deployed for compliance violation -│ ├── playbooks # Ansible playbooks to set up the scenario environment -│ ├── examples # Example scripts to fetch Kubernetes resources and OPA Rego policy to check if the statuses complies or not -│ └── Makefile # Commands to simplify setup and execution for the scenario -``` - -### 3. gen-cis-b-rhel9-ansible-opa -**Description**: This scenario expects to use Ansible Playbooks to collect system status from RHEL9 and OPA to check if the injected compliance issues are detected or not for the compliance requirement "Ensure SSH X11 forwarding is disabled". - -#### 3.1 The agent is expected to do following task request (template value will be substituted): - -``` -I would like to check if the following condition is satisfiled, given a host name `rhel9_servers`, on RHEL by using Ansible Playbook and OPA Rego policy - Ensure SSH X11 forwarding is disabled - -To check the condition, do the following steps. -- collect configuration from the RHEL host and save it locally. you can use ansible-playbook to do that. -- chcek if the condition is met by using rego policy with the input given by the step above. - -for those steps, you need to create ansible playbook `playbook.yml` and OPA rego policy `policy.rego`. -The playbook is implemented to locate the collected data to a file named `collected_data.json` in the current working directory. - -If you can fix the generated code, do it and run the fixed code again. -Once you get a final answer, you can quit the work. - -The Ansible inventory file (inventory.ansible.ini) for the target RHEL server is located at `{{ path_to_inventory }}`. -``` - -When an agent is invoked, an input is provided about this scenario. The input is the json following schema. (You can get the exact value by `make get`) -```json -{ -"metadata": { - "name": "rhel9/cis-b-gen/5.2.12", // Scenario Name - "description": "CIS Benchmark for RHEL9 5.2.12", // Scenario Description - "scenario_type": "Gen-CIS-b-RHEL9-Ansible-OPA" // Scenario Type - }, - // The above goal description - "goal_template": "I would like to check if the following condition is satisfiled, given a host name `rhel9_servers`, on RHEL by using Ansible Playbook and OPA Rego policy\n Ensure SSH X11 forwarding is disabled \n\nTo check the condition, do the following steps. \n- collect configuration from the RHEL host and save it locally. you can use ansible-playbook to do that. \n- chcek if the condition is met by using rego policy with the input given by the step above. \n\nfor those steps, you need to create ansible playbook `playbook.yml` and OPA rego policy `policy.rego`.\nIf you can fix the generated code, do it and run the fixed code again.\nOnce you get a final answer, you can quit the work.\n\nThe Ansible inventory file (inventory.ansible.ini) for the target RHEL server is located at `{{ path_to_inventory }}`.\n", - "vars": { - "ansible_ini": "[rhel9_servers]\nrhel9 ansible_host=...", // Ansible Ini file to acceess to the target RHEL system - "ansible_user_key": "***" // SSH Key - } -} -``` - -#### 3.2 How it is evaluated - -The evaluation verifies the following to return a pass: -- Confirm that the playbook.yml and policy.rego are produced. -- Ensure that playbook.yml runs successfuly and verify that the collected_data.json is produced. -- Ensure that OPA command runs successfully with the policy.rego against the collected_data.json. -- Verify that the OPA outputs expected result. - -Please refer to [evaluate.yml](/ciso/3.gen-cis-b-rhel9-ansible-opa/playbooks/evaluate.yml) for the details. - -#### The contents of the directory -``` -├── 3.rhel9-ansible-opa -│ ├── evaluation # Tools or scripts to check if the injected security issues are detected or not in this scenario -│ ├── playbooks # Ansible playbooks to set up the scenario environment -│ ├── examples # Example Ansible Playbook to fetch system statuses and OPA Rego policy to check if the statuses complies or not -│ └── Makefile # Commands to simplify setup and execution for the scenario -│ └── tasks -│ ├── fault_inject.yml # Ansible task to make the RHEL system compliance violation -``` - -### 4. upd-cis-b-k8s-kyvernoz -**Description**: This scenario expects to inspect the current Kyvero policies and Kubernetes resources, then update the existing policies to comply the new compliance requirements. - -#### 4.1 The agent is expected to do following task request (template value will be substituted): - -``` -Currently, the following Kyverno policies are deployed in the Kubernetes cluster. Review these existing policies and edit them to meet additional security requirements. Please avoid creating new policy resources; instead, make the necessary changes directly to the existing resources. - - Prohibit the use of the default service account - Prohibit privilege escalation - -However, the new internal security policy now requires the following additional conditions: - - Prohibit running as the root user - Only allow signed images from a trusted registry (trusted-registry.com) - -Your task is to review the existing Kyverno policies and directly edit the existing policies to meet these new requirements. Do not change the resource names. Once you have completed the edits, update the existing resources in the Kubernetes cluster. -Steps - - Review and Edit Kyverno Policies - Directly modify the existing policy resources to meet the new requirements. Ensure that you do not change the names of the resources. - -The cluster's kubeconfig is at `{{ kubeconfig }}`. -``` - -When an agent is invoked, an input is provided about this scenario. The input is the json following schema. (You can get the exact value by `make get`) -```json -{ - "metadata": { - "name": "policy-adapt/scenario1", // Scenario Name - "description": "Kyverno Policy Adapting: Enhancing Policies for Root and Trusted Registry Requirements", // Scenario Description - "scenario_type": "Upd-CIS-b-K8s-Kyverno" // Scenario Type - }, - // The above goal description - "goal_template": "Currently, the following Kyverno policies are deployed in the Kubernetes cluster. Review these existing policies and edit them to meet additional security requirements. Please avoid creating new policy resources; instead, make the necessary changes directly to the existing resources.\n\n Prohibit the use of the default service account\n Prohibit privilege escalation\n\nHowever, the new internal security policy now requires the following additional conditions:\n\n Prohibit running as the root user\n Only allow signed images from a trusted registry (trusted-registry.com)\n\nYour task is to review the existing Kyverno policies and directly edit the existing policies to meet these new requirements. Do not change the resource names. Once you have completed the edits, update the existing resources in the Kubernetes cluster.\nSteps\n\n Review and Edit Kyverno Policies\n Directly modify the existing policy resources to meet the new requirements. Ensure that you do not change the names of the resources. \n\nThe cluster's kubeconfig is at `{{ kubeconfig }}`.\n", - "vars": { - "kubeconfig": "apiVersion: v1\nclusters..." // kubeconfig.yaml contents for access to the target Kubernetes - } -} -``` - - -#### 4.2 How it is evaluated - -The evaluation verifies the following to return a pass: -- Verify that the specified Kyverno policy produces the expected Kyverno policy report for the target resource. -- Ensure that no modifications have been made to policies that should not be updated, and that no new policies have been created. - -Please refer to [evaluation.py](/ciso/4.upd-cis-b-k8s-kyverno/evaluation.py) for the details. - -#### The contents of the directory -``` -├── 4.updating-k8s-kyverno -│ ├── evaluation # Tools or scripts to check if the injected security issues are detected or not in this scenario -│ ├── manifests # Kubernetes resources to be deployed for compliance violation -│ ├── playbooks # Ansible playbooks to set up the scenario environment -│ ├── examples # Example Kyverno Policy to detect the compliance violation -│ └── Makefile # Commands to simplify setup and execution for the scenario -``` - -## Manual Benchmarking Process for the CISO Task Scenario -In this process, you will prepare a base environment, configure it to intentionally violate compliance requirements, run the Agent to address these issues, and evaluate the results. - -**Important: Perform all steps in a secure, non-production environment to prevent any impact on live systems, as the process involves configuring the environment to intentionally violate compliance requirements.** - -### 1. Outline - -![Outline](/ciso//images/overview-step.png) - -1. Prepare a target environment for benchmarking your Agent based on the CISO Scenario - - Since the scenario configuration process involves creating temporary users and applying various configurations that violate compliance requirements, **ensure that the Kubernetes cluster or RHEL machine used is a test or sandbox environment. Do not use production systems.** -1. Configure the environment to violate the provided compliance requirements. -1. Provide the required information (task goal, credentials, etc.) to the Agent once the environment setup is complete. -1. Run the Agent to complete the task. -1. Evaluate the target environment to verify if the task was properly completed after the Agent has finished. -1. Clean up the environment to restore it to its original state. - -### 2. Prerequisites - -Before starting the task scenario, ensure that all necessary tools and environments are set up correctly to maintain security and stability throughout the process. - -1. Build a Docker Image for the Task Scenario Makefile Runner Securely - - **To execute the task scenario in a controlled and secure manner, build the Docker image for the Makefile runner using the following steps. This ensures that the environment is isolated and minimizes security risks during the execution of compliance-related tasks.** - - ``` - cd ciso - docker build . -f Dockerfile -t ciso-task-scenarios:latest - ``` - -2. Use the following syntax to invoke a `make` command via the Docker image: - - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/kubeconfig.yaml \ - ciso-task-scenarios:latest \ - make -C \ - - ``` - - **Notes on Input Values** - - Replace `` with the actual path for your workdir for scenario - - Replace `` with the actual path for your workdir for agent, which must be consistent with the `` used in [ciso-caa-agent](https://github.com/itbench-hub/itbench-ciso-caa-agent). - - Replace `` with the actual path for your kubeconfig file - - - Makefile targets for task scenarios. - - - deploy_bundle: setup the target environment - - inject_fault: deploy or configure the target environment so it violates the compliance requirement - - get: get the scenario details that would be passed as the input for Agent - - evaluate: valuate - - get_status: get status - - revert_bundle: revert the target environment - - destroy_bundle: delete the target environment - -### 3a. Task Scenario for Targeting Kubernetes Cluster - -The following steps apply to the scenario targting Kubernetes Cluster. The corresponding `` values are as follows: -- 1.gen-cis-b-k8s-kyverno -- 2.gen-cis-b-k8s-kubectl-opa -- 4.upd-cis-b-k8s-kyvern - -The example below demonstrates the steps for `1.gen-cis-b-k8s-kyverno`. When trying other scenarios, replace `` accordingly. - -#### Prerequisites -1. Prepare kubeconfig file for Kubernetes cluster used this benchmark - - For Kind, [prepare-kubeconfig-kind.md](/ciso/prepare-kubeconfig-kind.md) - - For EKS, [prepare-kubeconfig-eks.md](/ciso/prepare-kubeconfig-eks.md) -1. Prepare two working directories to be mounted by the Docker container - - One directory will be used for the Task Scenario (referenced as `` in later steps). - - The other will be used for the Agent (referenced as ``). - - **These directories will be actively accessed during the benchmark, so make sure to use directories that are safe to modify.** - - Examples: - - `/tmp/ciso-scenario` for `` - - `/tmp/ciso-agent` for `` - -#### Steps -1. Setup a scenario environment against the Kubernetes cluster. - This command installs Kyverno to the provided kubeconfig.yaml cluster. It takes few minutes to finish. - - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/kubeconfig.yaml \ - ciso-task-scenarios:latest \ - make -C 1.gen-cis-b-k8s-kyverno \ - deploy_bundle - ``` - - Example output - ``` - ... - TASK [Prepare updated JSON data with kubeconfig] ************************************************************************************** - ok: [localhost] - - TASK [Write updated status (with or without kubeconfig) back to JSON file] ************************************************************ - changed: [localhost] - - PLAY RECAP **************************************************************************************************************************** - localhost : ok=55 changed=7 unreachable=0 failed=0 skipped=8 rescued=0 ignored=0 - ``` -1. Inject compliance issues into the environment - This command deploys nginx that violates the given policy, for example, "minimize the admission of containers wishing to share the host network namespace" in the case of `1.gen-cis-b-k8s-kyverno`, where hostNetwork in the pod manifest is set to true. - - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/kubeconfig.yaml \ - ciso-task-scenarios:latest \ - make -C 1.gen-cis-b-k8s-kyverno \ - inject_fault - ``` - - Example output - - ``` - PLAY [Execute fault injection] ******************************************************************************************* - ... - PLAY RECAP *************************************************************************************************************** - localhost : ok=29 changed=3 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 - ``` - - Now a pod that violates the policy to minimize the admission of containers wishing to share the host network namespace. (Check that hostNetwork is set to true) - ``` - $ kubectl get pod -n paa - NAME READY STATUS RESTARTS AGE - nginx-deployment-7cb5b996ff-vb8mz 1/1 Running 0 1m - ``` - ``` - $ kubectl get pod -n paa nginx-deployment-7cb5b996ff-vb8mz -o yaml - apiVersion: v1 - kind: Pod - metadata: - creationTimestamp: "2025-01-17T06:26:41Z" - spec: - containers: - - image: nginx:1.14.2 - imagePullPolicy: IfNotPresent - ... - hostNetwork: true - ... - ``` -1. Get the goal description for the Agent - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/scenario \ - -v :/tmp/agent \ - -v :/etc/ciso-task-scenarios/kubeconfig.yaml \ - ciso-task-scenarios:latest \ - sh -c \ - "make -s -C 1.gen-cis-b-k8s-kyverno \ - get \ - 2>/dev/null | jq -r .goal_template" - ``` - - Example output - ``` - I would like to check if the following condition is satisfiled, given a Kubernetes cluster with `kubeconfig.yaml` - Minimize the admission of containers wishing to share the host network namespace. - - To check the condition, do the following steps. - - deploy a Kyverno policy to the cluster - - chcek if the policy is correctly deployed. - - If deploying the policy failed and if you can fix the issue, you will do it and try deploying again. - Once you get a final answer, you can quit the work. - - The cluster's kubeconfig is at `{{ kubeconfig }}`. - ``` -1. Run your Agent with the goal description to achieve the objective. You can also use the CISO CAA agent (https://github.com/itbench-hub/itbench-ciso-caa-agent) as an example. - - For the scenario [2.gen-cis-b-k8s-kubectl-opa](#2-gen-cis-b-k8s-kubectl-opa), the goal requires the Agent to submit generated policy and scripts. In that case, please place the Agent's output files in `` (The CISO CAA agent is already configured to place its output files in this directory by adding a single sentence `You can use "/tmp/agent" as your workdir."`. See [ciso-caa-agent#4-start-the-agent](https://github.com/itbench-hub/itbench-ciso-caa-agent?tab=readme-ov-file#4-start-the-agent) for the details.) These files will be used in the next step, "Evaluation". -1. Once your agent is finished, run evaluation. - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/agent \ - -v :/tmp/scenario \ - -v :/etc/ciso-task-scenarios/kubeconfig.yaml \ - ciso-task-scenarios:latest \ - make -C 1.gen-cis-b-k8s-kyverno \ - evaluate - ``` - - Example output - ``` - ansible-playbook ./playbooks/evaluate.yml --extra-vars "path_to_output=/tmp/scenario-ciso-1/evaluation.json " &> /tmp/scenario-ciso-1/evaluate.log - { - "pass": true, - "tasks": { - "generate_assessment_posture": true, - "generate_policy": false, - "evidence_available": false - } - } - ``` - - If the `pass` is `true`, the CISO CAA Agent has successfully deployed the correct Kyverno Policy. You can check the Kyverno Policy that the CISO CAA Agent created. - ``` - $ kubectl get clusterpolicy - NAME ADMISSION BACKGROUND READY AGE MESSAGE - deny-host-network-namespace true true True 5m39s Ready - ``` - - Also, you can check that Kyverno reports the policy alert based againt the injected fault deployment on this policy. - ``` - $ kubectl get policyreport -n paa - NAME KIND NAME PASS FAIL WARN ERROR SKIP AGE - 2f6bbe6e-4f1c-4381-b5c8-b1ff4adb7121 ReplicaSet nginx-deployment-7cb5b996ff 0 1 0 0 0 6m45s - 335b8723-9c40-41ce-acc1-5cad0f5bdfb7 Deployment nginx-deployment 0 1 0 0 0 6m45s - 4868fc81-2b55-4981-9bc7-def313f74619 Pod nginx-deployment-7cb5b996ff-vb8mz 0 1 0 0 0 6m45s - ``` -1. Now you successfully finished a single evaluation of the Agent. You can cleanup the scenario environment by `revert` command, which removes all the injected fault resources and Kyverno policies/policy reports. - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/kubeconfig.yaml \ - ciso-task-scenarios:latest \ - make -C 1.gen-cis-b-k8s-kyverno \ - revert - ``` - - Example output - ``` - Using default input file with override by parameters - Using default input file with override by parameters - ansible-playbook -i dynamic_inventory.py ./playbooks/revert.yml - - PLAY [Revert the environment] ********************************************************************************************************* - ... - TASK [Write updated status back to JSON file] ***************************************************************************************** - changed: [RHEL9 Machine -> localhost] - - PLAY RECAP **************************************************************************************************************************** - RHEL9 Machine : ok=28 changed=6 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 - ``` - -### 3b. Task Scenario for Targeting Red Hat Enterprise Linux 9 - -#### Prerequisites -1. Prepare a Red Hat Enterprise Linux 9 machine with administrative access - - The task scenario requires permission to create a temporary user. -1. The access information to the RHEL machine is passed through json file so please create `input.json` by referring to [3.gen-cis-b-rhel9-ansible-opa/input.json](/ciso/3.gen-cis-b-rhel9-ansible-opa/input.json) - - Fill in the following fields: - - `` - - `` - - Save the completed `input.json` in a designated location (e.g., /tmp/input.json). -1. Prepare SSH Key to access the RHEL machine -1. Prepare working directories to be mounted by the Docker container - These directories will be actively accessed during the benchmark, so make sure to use directories that are safe to modify. - - For example: /tmp/ciso-agent for `` - - Unlike to [3a. Task Scenario for Targeting Kubernetes Cluster](#3a-task-scenario-for-targeting-kubernetes-cluster), `` is not required. - -#### Steps -1. Setup a scenario environment - The following command creates a temporal user for the scenario. It takes few minutes to finish. (Replace `` and `` with the path input.json and the ssh key.) - - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/3.gen-cis-b-rhel9-ansible-opa/input.json \ - -v :/etc/ciso-task-scenarios/ssh_key \ - ciso-task-scenarios:latest \ - make -C 3.gen-cis-b-rhel9-ansible-opa \ - deploy_bundle - ``` - - Example output - ``` - ... - TASK [Prepare updated JSON data with kubeconfig] ************************************************************************************** - ok: [RHEL9 Machine -> localhost] - - TASK [Write updated status back to JSON file] ***************************************************************************************** - changed: [RHEL9 Machine -> localhost] - - PLAY RECAP **************************************************************************************************************************** - RHEL9 Machine : ok=32 changed=6 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 - ``` -1. Inject compliance issues into the environment - This command applies non-compliant settings to the system to simulate compliance issues. Please see [3.gen-cis-b-rhel9-ansible-opa/tasks/fault_inject.yml](/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_inject.yml) for what is injected. - - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/3.gen-cis-b-rhel9-ansible-opa/input.json \ - -v :/etc/ciso-task-scenarios/ssh_key \ - ciso-task-scenarios:latest \ - make -C 3.gen-cis-b-rhel9-ansible-opa \ - inject_fault - ``` - - Example output - ``` - PLAY [Execute fault injection] ******************************************************************************************* - ... - PLAY RECAP **************************************************************************************************************************** - RHEL9 Machine : ok=24 changed=4 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 - ``` - - Now the target RHEL machine is configured as hitting the required compliance issue (X11Forwarding is enabled.) - - Login to your RHEL machine and check the /etc/ssh/sshd_config. - ``` - cat /etc/ssh/sshd_config | grep X11Forwarding - #X11Forwarding no - # X11Forwarding no - # Conflicting X11Forwarding setting - X11Forwarding yes - ``` -1. Get the goal description for the Agent - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/3.gen-cis-b-rhel9-ansible-opa/input.json \ - -v :/etc/ciso-task-scenarios/ssh_key \ - ciso-task-scenarios:latest \ - sh -c \ - "make -C 3.gen-cis-b-rhel9-ansible-opa \ - get \ - 2>/dev/null | jq -r .goal_template" - ``` - - Example output - ``` - I would like to check if the following condition is satisfiled, given a host name `rhel9_servers`, on RHEL by using Ansible Playbook and OPA Rego policy - Ensure SSH X11 forwarding is disabled - - To check the condition, do the following steps. - - collect configuration from the RHEL host and save it locally. you can use ansible-playbook to do that. - - chcek if the condition is met by using rego policy with the input given by the step above. - - for those steps, you need to create ansible playbook `playbook.yml` and OPA rego policy `policy.rego`. - If you can fix the generated code, do it and run the fixed code again. - Once you get a final answer, you can quit the work. - - The Ansible inventory file (inventory.ansible.ini) for the target RHEL server is located at `{{ path_to_inventory }}`. - ``` -1. Run your Agent with the goal description to achieve the objective. You can also use the CISO CAA agent (https://github.com/itbench-hub/itbench-ciso-caa-agent) as an example. - - Please place `playbook.yml` and `policy.rego` in `` (The CISO CAA agent is already configured to place its output files in this directory by adding a single sentence `You can use "/tmp/agent" as your workdir."`. See [ciso-caa-agent#4-start-the-agent](https://github.com/itbench-hub/itbench-ciso-caa-agent?tab=readme-ov-file#4-start-the-agent) for the details.) These files will be used in the next step, "Evaluation". - 1. To run the CISO CAA agent (https://github.com/itbench-hub/itbench-ciso-caa-agent). - - Replace `{{ path_to_inventory }}` with `/tmp/agent/inventory.ansible.ini` in the above goal description. - - Add on sentence "You can use `/tmp/agent` as your workdir." - ``` - docker run --rm -ti --name ciso-agent \ - -v :/tmp/agent \ - -v :/etc/ciso-agent/.env \ - ciso-agent:latest \ - python src/ciso_agent/main.py \ - --goal "$(cat /tmp/goal.txt)" \ - --auto-approve - ``` -1. Once your agent is finished, run evaluation. - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/3.gen-cis-b-rhel9-ansible-opa/input.json \ - -v :/etc/ciso-task-scenarios/ssh_key \ - ciso-task-scenarios:latest \ - make -C 3.gen-cis-b-rhel9-ansible-opa \ - evaluate - ``` - - Example output - ``` - {"pass": true, "details": "[fetcher] cmd: ['ansible-playbook', '/tmp/agent/playbook.yml', '-i', '/tmp/agent/inventory.ansible.ini'], stdout: \nPLAY [Collect SSH configuration to check X11 forwarding] ***********************\n\nTASK [Gathering Facts] *********************************************************\nok: [rhel9]\n\nTASK [Check if X11 forwarding is disabled in SSH configuration] ****************\nchanged: [rhel9]\n\nTASK [Save the SSH configuration check result] *********************************\nchanged: [rhel9 -> localhost]\n\nTASK [Collect additional information if X11 forwarding is enabled] *************\nchanged: [rhel9]\n\nTASK [Save additional information if X11 forwarding is enabled] ****************\nchanged: [rhel9 -> localhost]\n\nPLAY RECAP *********************************************************************\nrhel9 : ok=5 changed=4 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 , stderr: \n[checker] cmd: ['opa', 'eval', '--data', '/tmp/agent/policy.rego', '--input', '/tmp/agent/collected_data.json', 'data.check.result', '--format', 'raw'], stdout: false, stderr: \n"} - ``` - - If the `pass` is `true`, the CISO CAA Agent has successfully created playbook for status collection and OPA policy for compliance checking aganst the collected data. -1. Now you successfully finished a single evaluation of the Agent. You can cleanup the scenario environment by `revert` command, which revert all the injected fault configuration and remove a temporary created user (the username is ansible_user). - ``` - docker run --rm -ti --name ciso-task-scenario \ - -v :/tmp/agent\ - -v :/etc/ciso-task-scenarios/3.gen-cis-b-rhel9-ansible-opa/input.json \ - -v :/etc/ciso-task-scenarios/ssh_key \ - ciso-task-scenarios:latest \ - make -C 3.gen-cis-b-rhel9-ansible-opa \ - revert - ``` - - Example output - ``` - Using default input file with override by parameters - Using default input file with override by parameters - ansible-playbook -i dynamic_inventory.py ./playbooks/revert.yml - - PLAY [Revert the environment] ********************************************************************************************************* - ... - TASK [Write updated status back to JSON file] ***************************************************************************************** - changed: [RHEL9 Machine -> localhost] - - PLAY RECAP **************************************************************************************************************************** - RHEL9 Machine : ok=28 changed=6 unreachable=0 failed=0 skipped=2 rescued=0 ignored=0 - ``` diff --git a/scenarios/ciso/images/leaderboard.png b/scenarios/ciso/images/leaderboard.png deleted file mode 100644 index f1e86a99c..000000000 Binary files a/scenarios/ciso/images/leaderboard.png and /dev/null differ diff --git a/scenarios/ciso/images/overview-step.drawio b/scenarios/ciso/images/overview-step.drawio deleted file mode 100644 index bff9b11ed..000000000 --- a/scenarios/ciso/images/overview-step.drawio +++ /dev/null @@ -1,75 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/scenarios/ciso/images/overview-step.png b/scenarios/ciso/images/overview-step.png deleted file mode 100644 index 25732cbda..000000000 Binary files a/scenarios/ciso/images/overview-step.png and /dev/null differ diff --git a/scenarios/ciso/images/registration.png b/scenarios/ciso/images/registration.png deleted file mode 100644 index 4b393af49..000000000 Binary files a/scenarios/ciso/images/registration.png and /dev/null differ diff --git a/scenarios/ciso/prepare-kubeconfig-eks.md b/scenarios/ciso/prepare-kubeconfig-eks.md deleted file mode 100644 index 310c1bdb6..000000000 --- a/scenarios/ciso/prepare-kubeconfig-eks.md +++ /dev/null @@ -1,103 +0,0 @@ -# How to use AWS EKS cluster for scenario environment - -When using an AWS EKS cluster for the scenario environment, some additional configurations are required. - -## Key Points -- By default, an EKS cluster's kubeconfig file uses `aws` command which requires aws credentials. -- Those credentials are not available in the scenario container. -- You need to get a token by running the command manually and edit the kubeconfig file to use it by the following steps to access your EKS cluster. - -## Steps - -### 1. Obtain a Kubeconfig File - -First, retrieve the kubeconfig file for your EKS cluster using the following command: - -```bash -$ aws eks update-kubeconfig --region --name -Added new context arn:aws:eks:(...):cluster/ to /Users//.kube/config -``` - -Replace and with the actual values for your cluster. - -Then copy the kubeconfig file to edit. - -```bash -$ kubectl config view --minify --raw > ./kubeconfig.yaml -$ cp ~/.kube/config ./kubeconfig.yaml -``` - -### 2. Run the command to get token - -The obtained kubeconfig file should look like this: - -```yaml -apiVersion: v1 -clusters: - ... -kind: Config -preferences: {} -users: -- name: arn:aws:eks:(...):cluster/ - user: - exec: - apiVersion: client.authentication.k8s.io/v1beta1 - args: - - --region - - - - eks - - get-token - - --cluster-name - - - - --output - - json - command: aws -``` - -Then, you can manually get token for this cluster by the following command: - -```bash -$ aws --region eks get-token --cluster-name --output json -{ - "kind": "ExecCredential", - "apiVersion": "client.authentication.k8s.io/v1beta1", - "spec": {}, - "status": { - "expirationTimestamp": "2025-01-31T09:15:30Z", - "token": "k8s-aws-v1.a ... Y" - } -} -``` - -In the response json, you can find `token` field. This is the token which you will put into the kubeconfig file. - -**NOTE**: This token expires in 15 minutes, so if you takes more than 15 minutes during scenario operations, please renew the token. - -Modify the following: - -1. Remove the `exec` field under `user` in the kubeconfig file. -1. Add a `token` field under `user` instead. -1. Set the token you just obtained to the `token` field. - -The final version of your kubeconfig file should look like this: - -```bash -$ vim ./kubeconfig.yaml -``` - -```yaml -apiVersion: v1 -clusters: - ... -kind: Config -preferences: {} -users: -- name: arn:aws:eks:(...):cluster/ - user: - token: k8s-aws-v1.a ... Y -``` - -Ensure that you retain the original values for `clusters` and `contexts`. What you need to change is only `user` part. - -Now, you are ready to use your AWS EKS cluster! -Place this kubeconfig file in your workding directory. diff --git a/scenarios/ciso/prepare-kubeconfig-kind.md b/scenarios/ciso/prepare-kubeconfig-kind.md deleted file mode 100644 index 4587cf5c9..000000000 --- a/scenarios/ciso/prepare-kubeconfig-kind.md +++ /dev/null @@ -1,66 +0,0 @@ -# How to use KinD cluster for scenario environment - -When using a KinD cluster for the scenario environment, some additional configurations are required. - -## Key Points -- By default, a KinD cluster's kubeconfig file uses `127.0.0.1` as its API endpoint. -- This address is not accessible from the scenario container. -- You need to edit the kubeconfig file by the following steps to allow the container to access your KinD cluster. - -## Steps - -### 1. Obtain a Kubeconfig File - -First, retrieve the kubeconfig file for your KinD cluster using the following command: - -```bash -$ kind get kubeconfig --name > ./kubeconfig.yaml -``` - -Replace with the actual name of your cluster. You can find the correct name by running: - -```bash -$ kind get clusters -``` - -### 2. Edit the Kubeconfig file - -``` -$ vim ./kubeconfig.yaml -``` - -The kubeconfig file should look like this: - -```yaml -apiVersion: v1 -clusters: -- cluster: - certificate-authority-data: LS0t ... LS0K - server: https://127.0.0.1: - name: kind- -... -``` - -Modify the following: - -1. Replace `127.0.0.1` with `host.docker.internal`. This address is accessible from the scenario container. -1. Remove the line containing `certificate-authority-data`:. -1. Add `insecure-skip-tls-verify: true` instead. - -The final version of your kubeconfig file should look like this: - - -```yaml -apiVersion: v1 -clusters: -- cluster: - server: https://host.docker.internal: - insecure-skip-tls-verify: true - name: kind- -... -``` - -Ensure that you retain the original values for `` and ``. - -Now, you are ready to use your KinD cluster! -Place this kubeconfig file in your workding directory. diff --git a/scenarios/ciso/scenario-bundles.json b/scenarios/ciso/scenario-bundles.json deleted file mode 100644 index f44311d2b..000000000 --- a/scenarios/ciso/scenario-bundles.json +++ /dev/null @@ -1,182 +0,0 @@ -[ - { - "scenario": { - "instance_id": "TBD", - "name": "cis-b.5.2.6-gen", - "type": "Compliance", - "description": "CIS Benchmark for K8S 5.2.6 (Kyverno)", - "category": "Kubernetes in Kyverno", - "complexity": "Low", - "scenario_class": "Kubernetes in Kyverno" - }, - "bundle": { - "name": "cis-b.5.2.6-gen", - "path": "sample-task-scenarios/ciso/1.gen-cis-b-k8s-kyverno", - "scenario_type": "Gen-CIS-b-K8s-Kyverno", - "description": "CIS Benchmark for K8S 5.2.6 (Kyverno)", - "version": "v0.0.1", - "make_target_mapping": { - "deploy": { - "target": "deploy_bundle" - }, - "inject_fault": { - "target": "inject_fault" - }, - "evaluate": { - "target": "evaluate" - }, - "delete": { - "target": "delete" - }, - "status": { - "target": "get_status" - }, - "get": { - "target": "get" - }, - "revert": { - "target": "revert" - } - }, - "params": { - "KUBECONFIG": "/tmp/kubeconfig.yaml" - }, - "enable_evaluation_wait": true - } - }, - { - "scenario": { - "instance_id": "TBD", - "name": "policy-adapt/scenario1", - "type": "Compliance", - "description": "Kyverno Policy Adapting: Enhancing Policies for Root and Trusted Registry Requirements", - "category": "Kubernetes in Kyverno Update", - "complexity": "High", - "scenario_class": "Kubernetes in Kyverno Update" - }, - "bundle": { - "name": "policy-adapt/scenario1", - "path": "sample-task-scenarios/ciso/4.upd-cis-b-k8s-kyverno", - "scenario_type": "Upd-CIS-b-K8s-Kyverno", - "description": "Kyverno Policy Adapting: Enhancing Policies for Root and Trusted Registry Requirements", - "version": "v0.0.1", - "make_target_mapping": { - "deploy": { - "target": "deploy_bundle" - }, - "inject_fault": { - "target": "inject_fault" - }, - "evaluate": { - "target": "evaluate" - }, - "delete": { - "target": "delete" - }, - "status": { - "target": "get_status" - }, - "get": { - "target": "get" - }, - "revert": { - "target": "revert" - } - }, - "params": { - "KUBECONFIG": "/tmp/kubeconfig.yaml" - }, - "enable_evaluation_wait": true - } - }, - { - "scenario": { - "instance_id": "TBD", - "name": "k8s-opa/cis-b-gen/5.2.5", - "type": "Compliance", - "description": "CIS Benchmark for K8S 5.2.5 (OPA)", - "category": "Kubernetes in OPA", - "complexity": "Medium", - "scenario_class": "Kubernetes in OPA" - }, - "bundle": { - "name": "k8s-opa/cis-b-gen/5.2.5", - "path": "sample-task-scenarios/ciso/2.gen-cis-b-k8s-kubectl-opa", - "scenario_type": "Gen-CIS-b-K8s-Kubectl-OPA", - "description": "CIS Benchmark for K8S 5.2.5 (OPA)", - "version": "v0.0.1", - "make_target_mapping": { - "deploy": { - "target": "deploy_bundle" - }, - "inject_fault": { - "target": "inject_fault" - }, - "evaluate": { - "target": "evaluate" - }, - "delete": { - "target": "delete" - }, - "status": { - "target": "get_status" - }, - "get": { - "target": "get" - }, - "revert": { - "target": "revert" - } - }, - "params": { - "KUBECONFIG": "/tmp/kubeconfig.yaml" - }, - "enable_evaluation_wait": true - } - }, - { - "scenario": { - "instance_id": "TBD", - "name": "rhel9/cis-b-gen/5.2.12", - "type": "Compliance", - "description": "CIS Benchmark for RHEL9 5.2.12", - "category": "RHEL9 in OPA", - "complexity": "High", - "scenario_class": "RHEL9 in OPA" - }, - "bundle": { - "name": "rhel9/cis-b-gen/5.2.12", - "path": "sample-task-scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa", - "scenario_type": "Gen-CIS-b-RHEL9-Ansible-OPA", - "description": "CIS Benchmark for RHEL9 5.2.12", - "version": "v0.0.1", - "make_target_mapping": { - "deploy": { - "target": "deploy_bundle" - }, - "inject_fault": { - "target": "inject_fault" - }, - "evaluate": { - "target": "evaluate" - }, - "delete": { - "target": "delete" - }, - "status": { - "target": "get_status" - }, - "get": { - "target": "get" - }, - "revert": { - "target": "revert" - } - }, - "params": { - "DEFAULT_INPUT_FILE": "/tmp/rhel-bundle-config/input.json" - }, - "enable_evaluation_wait": true - } - } -] diff --git a/scenarios/sre/inventory/group_vars/all/storage.yaml.example b/scenarios/inventory/group_vars/all/storage.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/all/storage.yaml.example rename to scenarios/inventory/group_vars/all/storage.yaml.example diff --git a/scenarios/sre/inventory/group_vars/environment/applications.yaml.example b/scenarios/inventory/group_vars/environment/applications.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/environment/applications.yaml.example rename to scenarios/inventory/group_vars/environment/applications.yaml.example diff --git a/scenarios/sre/inventory/group_vars/environment/cluster.yaml.example b/scenarios/inventory/group_vars/environment/cluster.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/environment/cluster.yaml.example rename to scenarios/inventory/group_vars/environment/cluster.yaml.example diff --git a/scenarios/inventory/group_vars/environment/evaluation.yaml.example b/scenarios/inventory/group_vars/environment/evaluation.yaml.example new file mode 100644 index 000000000..52057f7f2 --- /dev/null +++ b/scenarios/inventory/group_vars/environment/evaluation.yaml.example @@ -0,0 +1,8 @@ +--- +# Optional — override evaluation timing defaults for this environment. +# Remove this file or leave evaluation_overrides empty to use role defaults: +# window: 300, interval: 30, pass_mark: 2 +evaluation_overrides: + window: 300 # total seconds the watcher polls before declaring failure + interval: 30 # seconds between poll cycles + pass_mark: 2 # consecutive passing poll cycles required to declare success diff --git a/scenarios/sre/inventory/group_vars/environment/tools.yaml.example b/scenarios/inventory/group_vars/environment/tools.yaml.example similarity index 73% rename from scenarios/sre/inventory/group_vars/environment/tools.yaml.example rename to scenarios/inventory/group_vars/environment/tools.yaml.example index c115e1a41..b9e7346c3 100644 --- a/scenarios/sre/inventory/group_vars/environment/tools.yaml.example +++ b/scenarios/inventory/group_vars/environment/tools.yaml.example @@ -1,4 +1,5 @@ --- tools: + ciso: false finops: true sre: true diff --git a/scenarios/inventory/group_vars/environment/virtual_machine.yaml.example b/scenarios/inventory/group_vars/environment/virtual_machine.yaml.example new file mode 100644 index 000000000..aac4ca2d5 --- /dev/null +++ b/scenarios/inventory/group_vars/environment/virtual_machine.yaml.example @@ -0,0 +1,6 @@ +--- +# virtual_machine: +# host: "" # IP address or hostname of the RHEL9 machine +# username: "" # SSH username used to connect to the machine initially +# ssh_key: "" # Path to the SSH private key for the initial connection +# python_interpreter: /usr/bin/python3 # Python interpreter path on the remote host diff --git a/scenarios/sre/inventory/group_vars/runner/agent.yaml.example b/scenarios/inventory/group_vars/runner/agent.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/runner/agent.yaml.example rename to scenarios/inventory/group_vars/runner/agent.yaml.example diff --git a/scenarios/sre/inventory/group_vars/runner/experiments.yaml.example b/scenarios/inventory/group_vars/runner/experiments.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/runner/experiments.yaml.example rename to scenarios/inventory/group_vars/runner/experiments.yaml.example diff --git a/scenarios/sre/inventory/group_vars/runner/github.yaml.example b/scenarios/inventory/group_vars/runner/github.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/runner/github.yaml.example rename to scenarios/inventory/group_vars/runner/github.yaml.example diff --git a/scenarios/sre/inventory/group_vars/runner/stack.yaml.example b/scenarios/inventory/group_vars/runner/stack.yaml.example similarity index 100% rename from scenarios/sre/inventory/group_vars/runner/stack.yaml.example rename to scenarios/inventory/group_vars/runner/stack.yaml.example diff --git a/scenarios/sre/inventory/host_vars/localhost/connection.yaml b/scenarios/inventory/host_vars/localhost/connection.yaml similarity index 100% rename from scenarios/sre/inventory/host_vars/localhost/connection.yaml rename to scenarios/inventory/host_vars/localhost/connection.yaml diff --git a/scenarios/sre/inventory/inventory.yaml b/scenarios/inventory/inventory.yaml similarity index 100% rename from scenarios/sre/inventory/inventory.yaml rename to scenarios/inventory/inventory.yaml diff --git a/scenarios/sre/library/indexes/applications/1.json b/scenarios/library/indexes/applications/1.json similarity index 100% rename from scenarios/sre/library/indexes/applications/1.json rename to scenarios/library/indexes/applications/1.json diff --git a/scenarios/sre/library/indexes/applications/2.json b/scenarios/library/indexes/applications/2.json similarity index 100% rename from scenarios/sre/library/indexes/applications/2.json rename to scenarios/library/indexes/applications/2.json diff --git a/scenarios/sre/library/indexes/faults/1.json b/scenarios/library/indexes/faults/1.json similarity index 100% rename from scenarios/sre/library/indexes/faults/1.json rename to scenarios/library/indexes/faults/1.json diff --git a/scenarios/sre/library/indexes/faults/10.json b/scenarios/library/indexes/faults/10.json similarity index 100% rename from scenarios/sre/library/indexes/faults/10.json rename to scenarios/library/indexes/faults/10.json diff --git a/scenarios/sre/library/indexes/faults/11.json b/scenarios/library/indexes/faults/11.json similarity index 100% rename from scenarios/sre/library/indexes/faults/11.json rename to scenarios/library/indexes/faults/11.json diff --git a/scenarios/sre/library/indexes/faults/12.json b/scenarios/library/indexes/faults/12.json similarity index 100% rename from scenarios/sre/library/indexes/faults/12.json rename to scenarios/library/indexes/faults/12.json diff --git a/scenarios/sre/library/indexes/faults/13.json b/scenarios/library/indexes/faults/13.json similarity index 100% rename from scenarios/sre/library/indexes/faults/13.json rename to scenarios/library/indexes/faults/13.json diff --git a/scenarios/sre/library/indexes/faults/14.json b/scenarios/library/indexes/faults/14.json similarity index 100% rename from scenarios/sre/library/indexes/faults/14.json rename to scenarios/library/indexes/faults/14.json diff --git a/scenarios/sre/library/indexes/faults/15.json b/scenarios/library/indexes/faults/15.json similarity index 100% rename from scenarios/sre/library/indexes/faults/15.json rename to scenarios/library/indexes/faults/15.json diff --git a/scenarios/sre/library/indexes/faults/16.json b/scenarios/library/indexes/faults/16.json similarity index 100% rename from scenarios/sre/library/indexes/faults/16.json rename to scenarios/library/indexes/faults/16.json diff --git a/scenarios/sre/library/indexes/faults/17.json b/scenarios/library/indexes/faults/17.json similarity index 100% rename from scenarios/sre/library/indexes/faults/17.json rename to scenarios/library/indexes/faults/17.json diff --git a/scenarios/sre/library/indexes/faults/18.json b/scenarios/library/indexes/faults/18.json similarity index 100% rename from scenarios/sre/library/indexes/faults/18.json rename to scenarios/library/indexes/faults/18.json diff --git a/scenarios/sre/library/indexes/faults/19.json b/scenarios/library/indexes/faults/19.json similarity index 100% rename from scenarios/sre/library/indexes/faults/19.json rename to scenarios/library/indexes/faults/19.json diff --git a/scenarios/sre/library/indexes/faults/2.json b/scenarios/library/indexes/faults/2.json similarity index 100% rename from scenarios/sre/library/indexes/faults/2.json rename to scenarios/library/indexes/faults/2.json diff --git a/scenarios/sre/library/indexes/faults/20.json b/scenarios/library/indexes/faults/20.json similarity index 100% rename from scenarios/sre/library/indexes/faults/20.json rename to scenarios/library/indexes/faults/20.json diff --git a/scenarios/sre/library/indexes/faults/21.json b/scenarios/library/indexes/faults/21.json similarity index 100% rename from scenarios/sre/library/indexes/faults/21.json rename to scenarios/library/indexes/faults/21.json diff --git a/scenarios/sre/library/indexes/faults/22.json b/scenarios/library/indexes/faults/22.json similarity index 100% rename from scenarios/sre/library/indexes/faults/22.json rename to scenarios/library/indexes/faults/22.json diff --git a/scenarios/sre/library/indexes/faults/23.json b/scenarios/library/indexes/faults/23.json similarity index 100% rename from scenarios/sre/library/indexes/faults/23.json rename to scenarios/library/indexes/faults/23.json diff --git a/scenarios/sre/library/indexes/faults/24.json b/scenarios/library/indexes/faults/24.json similarity index 100% rename from scenarios/sre/library/indexes/faults/24.json rename to scenarios/library/indexes/faults/24.json diff --git a/scenarios/sre/library/indexes/faults/25.json b/scenarios/library/indexes/faults/25.json similarity index 100% rename from scenarios/sre/library/indexes/faults/25.json rename to scenarios/library/indexes/faults/25.json diff --git a/scenarios/sre/library/indexes/faults/26.json b/scenarios/library/indexes/faults/26.json similarity index 100% rename from scenarios/sre/library/indexes/faults/26.json rename to scenarios/library/indexes/faults/26.json diff --git a/scenarios/sre/library/indexes/faults/27.json b/scenarios/library/indexes/faults/27.json similarity index 100% rename from scenarios/sre/library/indexes/faults/27.json rename to scenarios/library/indexes/faults/27.json diff --git a/scenarios/sre/library/indexes/faults/28.json b/scenarios/library/indexes/faults/28.json similarity index 100% rename from scenarios/sre/library/indexes/faults/28.json rename to scenarios/library/indexes/faults/28.json diff --git a/scenarios/sre/library/indexes/faults/29.json b/scenarios/library/indexes/faults/29.json similarity index 100% rename from scenarios/sre/library/indexes/faults/29.json rename to scenarios/library/indexes/faults/29.json diff --git a/scenarios/sre/library/indexes/faults/3.json b/scenarios/library/indexes/faults/3.json similarity index 100% rename from scenarios/sre/library/indexes/faults/3.json rename to scenarios/library/indexes/faults/3.json diff --git a/scenarios/sre/library/indexes/faults/30.json b/scenarios/library/indexes/faults/30.json similarity index 100% rename from scenarios/sre/library/indexes/faults/30.json rename to scenarios/library/indexes/faults/30.json diff --git a/scenarios/sre/library/indexes/faults/36.json b/scenarios/library/indexes/faults/31.json similarity index 99% rename from scenarios/sre/library/indexes/faults/36.json rename to scenarios/library/indexes/faults/31.json index d1aa483dc..140820a0d 100644 --- a/scenarios/sre/library/indexes/faults/36.json +++ b/scenarios/library/indexes/faults/31.json @@ -55,7 +55,7 @@ "description": "This fault corrupts a Kubernetes Secret by replacing its data with invalid credentials, simulating real-world incidents where secret rotation failures, registry authentication issues, or Vault access problems cause service outages.", "expectation": "Workloads that depend on the corrupted Secret will fail to authenticate with external services.", "id": "corrupted-kubernetes-secret-credentials", - "index": 36, + "index": 31, "name": "Corrupted Kubernetes Secret Credentials", "platform": "Kubernetes", "resources": [ diff --git a/scenarios/library/indexes/faults/32.json b/scenarios/library/indexes/faults/32.json new file mode 100644 index 000000000..f7d224650 --- /dev/null +++ b/scenarios/library/indexes/faults/32.json @@ -0,0 +1,81 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "application": [] + }, + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "This fault deploys a Kubernetes workload with hostNetwork set to true, granting the container access to the host network namespace.", + "expectation": "Kyverno PolicyReport will record a policy failure against the Deployment for violating the disallow-host-namespaces rule.", + "id": "active-host-network-kubernetes-deployment", + "index": 32, + "name": "Active Host Network Kubernetes Deployment", + "platform": "Kubernetes", + "resources": [ + "https://kubernetes.io/docs/concepts/security/pod-security-standards/" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "command": "kubectl -n {{ args.kubernetesObject.metadata.namespace }} delete {{ args.kubernetesObject.kind | lower }} {{ args.kubernetesObject.metadata.name }}", + "text": "Delete the non-compliant Deployment that uses hostNetwork." + }, + { + "text": "Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads." + } + ] + } + ] + }, + "tags": [ + "Compliance", + "Deployment" + ] +} diff --git a/scenarios/library/indexes/faults/33.json b/scenarios/library/indexes/faults/33.json new file mode 100644 index 000000000..41e379531 --- /dev/null +++ b/scenarios/library/indexes/faults/33.json @@ -0,0 +1,50 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "application": [] + }, + "arguments": { + "jsonSchema": { + "properties": { + "virtualMachine": { + "properties": { + "hostname": { + "type": "string" + } + }, + "required": [ + "hostname" + ], + "type": "object" + } + }, + "required": [ + "virtualMachine" + ], + "type": "object" + } + }, + "description": "This fault enables X11 forwarding in /etc/ssh/sshd_config on a RHEL9 host, violating the requirement for it to be disabled.", + "expectation": "OPA evaluation of the collected SSH configuration data will return false, indicating the host is non-compliant with the applicable benchmark rule.", + "id": "enabled-x11-forwarding-rhel9-sshd", + "index": 33, + "name": "Enabled X11 Forwarding RHEL9 SSHD", + "platform": "RHEL9", + "resources": [ + "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/securing_networks/assembly_using-secure-communications-between-two-systems-with-openssh_securing-networks" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "text": "Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service." + } + ] + } + ] + }, + "tags": [ + "Compliance" + ] +} diff --git a/scenarios/library/indexes/faults/34.json b/scenarios/library/indexes/faults/34.json new file mode 100644 index 000000000..0185f40e6 --- /dev/null +++ b/scenarios/library/indexes/faults/34.json @@ -0,0 +1,81 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "application": [] + }, + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "This fault deploys a Pod that violates active security policies, such as pulling from an untrusted image registry or permitting privilege escalation.", + "expectation": "Policy evaluation will flag the Pod as non-compliant, producing a policy failure result for the target resource.", + "id": "non-compliant-kubernetes-pod-deployment", + "index": 34, + "name": "Non Compliant Kubernetes Pod Deployment", + "platform": "Kubernetes", + "resources": [ + "https://kubernetes.io/docs/concepts/security/pod-security-standards/" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "command": "kubectl -n {{ args.kubernetesObject.metadata.namespace }} delete {{ args.kubernetesObject.kind | lower }} {{ args.kubernetesObject.metadata.name }}", + "text": "Delete the non-compliant Pod." + }, + { + "text": "Author and apply a policy that enforces the required security controls for the workload." + } + ] + } + ] + }, + "tags": [ + "Compliance", + "Deployment" + ] +} diff --git a/scenarios/sre/library/indexes/faults/4.json b/scenarios/library/indexes/faults/4.json similarity index 100% rename from scenarios/sre/library/indexes/faults/4.json rename to scenarios/library/indexes/faults/4.json diff --git a/scenarios/sre/library/indexes/faults/5.json b/scenarios/library/indexes/faults/5.json similarity index 100% rename from scenarios/sre/library/indexes/faults/5.json rename to scenarios/library/indexes/faults/5.json diff --git a/scenarios/sre/library/indexes/faults/6.json b/scenarios/library/indexes/faults/6.json similarity index 100% rename from scenarios/sre/library/indexes/faults/6.json rename to scenarios/library/indexes/faults/6.json diff --git a/scenarios/sre/library/indexes/faults/7.json b/scenarios/library/indexes/faults/7.json similarity index 100% rename from scenarios/sre/library/indexes/faults/7.json rename to scenarios/library/indexes/faults/7.json diff --git a/scenarios/sre/library/indexes/faults/8.json b/scenarios/library/indexes/faults/8.json similarity index 100% rename from scenarios/sre/library/indexes/faults/8.json rename to scenarios/library/indexes/faults/8.json diff --git a/scenarios/sre/library/indexes/faults/9.json b/scenarios/library/indexes/faults/9.json similarity index 100% rename from scenarios/sre/library/indexes/faults/9.json rename to scenarios/library/indexes/faults/9.json diff --git a/scenarios/sre/library/indexes/scenarios/1.json b/scenarios/library/indexes/scenarios/1.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/1.json rename to scenarios/library/indexes/scenarios/1.json diff --git a/scenarios/sre/library/indexes/scenarios/10.json b/scenarios/library/indexes/scenarios/10.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/10.json rename to scenarios/library/indexes/scenarios/10.json diff --git a/scenarios/sre/library/indexes/scenarios/102.json b/scenarios/library/indexes/scenarios/102.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/102.json rename to scenarios/library/indexes/scenarios/102.json diff --git a/scenarios/sre/library/indexes/scenarios/105.json b/scenarios/library/indexes/scenarios/105.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/105.json rename to scenarios/library/indexes/scenarios/105.json diff --git a/scenarios/sre/library/indexes/scenarios/11.json b/scenarios/library/indexes/scenarios/11.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/11.json rename to scenarios/library/indexes/scenarios/11.json diff --git a/scenarios/sre/library/indexes/scenarios/114.json b/scenarios/library/indexes/scenarios/114.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/114.json rename to scenarios/library/indexes/scenarios/114.json diff --git a/scenarios/sre/library/indexes/scenarios/12.json b/scenarios/library/indexes/scenarios/12.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/12.json rename to scenarios/library/indexes/scenarios/12.json diff --git a/scenarios/sre/library/indexes/scenarios/13.json b/scenarios/library/indexes/scenarios/13.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/13.json rename to scenarios/library/indexes/scenarios/13.json diff --git a/scenarios/sre/library/indexes/scenarios/14.json b/scenarios/library/indexes/scenarios/14.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/14.json rename to scenarios/library/indexes/scenarios/14.json diff --git a/scenarios/sre/library/indexes/scenarios/15.json b/scenarios/library/indexes/scenarios/15.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/15.json rename to scenarios/library/indexes/scenarios/15.json diff --git a/scenarios/sre/library/indexes/scenarios/16.json b/scenarios/library/indexes/scenarios/16.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/16.json rename to scenarios/library/indexes/scenarios/16.json diff --git a/scenarios/sre/library/indexes/scenarios/17.json b/scenarios/library/indexes/scenarios/17.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/17.json rename to scenarios/library/indexes/scenarios/17.json diff --git a/scenarios/sre/library/indexes/scenarios/18.json b/scenarios/library/indexes/scenarios/18.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/18.json rename to scenarios/library/indexes/scenarios/18.json diff --git a/scenarios/sre/library/indexes/scenarios/19.json b/scenarios/library/indexes/scenarios/19.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/19.json rename to scenarios/library/indexes/scenarios/19.json diff --git a/scenarios/sre/library/indexes/scenarios/2.json b/scenarios/library/indexes/scenarios/2.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/2.json rename to scenarios/library/indexes/scenarios/2.json diff --git a/scenarios/sre/library/indexes/scenarios/20.json b/scenarios/library/indexes/scenarios/20.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/20.json rename to scenarios/library/indexes/scenarios/20.json diff --git a/scenarios/sre/library/indexes/scenarios/21.json b/scenarios/library/indexes/scenarios/21.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/21.json rename to scenarios/library/indexes/scenarios/21.json diff --git a/scenarios/sre/library/indexes/scenarios/22.json b/scenarios/library/indexes/scenarios/22.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/22.json rename to scenarios/library/indexes/scenarios/22.json diff --git a/scenarios/sre/library/indexes/scenarios/23.json b/scenarios/library/indexes/scenarios/23.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/23.json rename to scenarios/library/indexes/scenarios/23.json diff --git a/scenarios/sre/library/indexes/scenarios/24.json b/scenarios/library/indexes/scenarios/24.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/24.json rename to scenarios/library/indexes/scenarios/24.json diff --git a/scenarios/sre/library/indexes/scenarios/25.json b/scenarios/library/indexes/scenarios/25.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/25.json rename to scenarios/library/indexes/scenarios/25.json diff --git a/scenarios/sre/library/indexes/scenarios/26.json b/scenarios/library/indexes/scenarios/26.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/26.json rename to scenarios/library/indexes/scenarios/26.json diff --git a/scenarios/sre/library/indexes/scenarios/27.json b/scenarios/library/indexes/scenarios/27.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/27.json rename to scenarios/library/indexes/scenarios/27.json diff --git a/scenarios/sre/library/indexes/scenarios/29.json b/scenarios/library/indexes/scenarios/29.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/29.json rename to scenarios/library/indexes/scenarios/29.json diff --git a/scenarios/sre/library/indexes/scenarios/3.json b/scenarios/library/indexes/scenarios/3.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/3.json rename to scenarios/library/indexes/scenarios/3.json diff --git a/scenarios/sre/library/indexes/scenarios/30.json b/scenarios/library/indexes/scenarios/30.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/30.json rename to scenarios/library/indexes/scenarios/30.json diff --git a/scenarios/sre/library/indexes/scenarios/31.json b/scenarios/library/indexes/scenarios/31.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/31.json rename to scenarios/library/indexes/scenarios/31.json diff --git a/scenarios/sre/library/indexes/scenarios/33.json b/scenarios/library/indexes/scenarios/33.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/33.json rename to scenarios/library/indexes/scenarios/33.json diff --git a/scenarios/sre/library/indexes/scenarios/34.json b/scenarios/library/indexes/scenarios/34.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/34.json rename to scenarios/library/indexes/scenarios/34.json diff --git a/scenarios/sre/library/indexes/scenarios/35.json b/scenarios/library/indexes/scenarios/35.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/35.json rename to scenarios/library/indexes/scenarios/35.json diff --git a/scenarios/sre/library/indexes/scenarios/36.json b/scenarios/library/indexes/scenarios/36.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/36.json rename to scenarios/library/indexes/scenarios/36.json diff --git a/scenarios/sre/library/indexes/scenarios/37.json b/scenarios/library/indexes/scenarios/37.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/37.json rename to scenarios/library/indexes/scenarios/37.json diff --git a/scenarios/sre/library/indexes/scenarios/38.json b/scenarios/library/indexes/scenarios/38.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/38.json rename to scenarios/library/indexes/scenarios/38.json diff --git a/scenarios/sre/library/indexes/scenarios/39.json b/scenarios/library/indexes/scenarios/39.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/39.json rename to scenarios/library/indexes/scenarios/39.json diff --git a/scenarios/sre/library/indexes/scenarios/4.json b/scenarios/library/indexes/scenarios/4.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/4.json rename to scenarios/library/indexes/scenarios/4.json diff --git a/scenarios/sre/library/indexes/scenarios/40.json b/scenarios/library/indexes/scenarios/40.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/40.json rename to scenarios/library/indexes/scenarios/40.json diff --git a/scenarios/sre/library/indexes/scenarios/41.json b/scenarios/library/indexes/scenarios/41.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/41.json rename to scenarios/library/indexes/scenarios/41.json diff --git a/scenarios/sre/library/indexes/scenarios/42.json b/scenarios/library/indexes/scenarios/42.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/42.json rename to scenarios/library/indexes/scenarios/42.json diff --git a/scenarios/sre/library/indexes/scenarios/43.json b/scenarios/library/indexes/scenarios/43.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/43.json rename to scenarios/library/indexes/scenarios/43.json diff --git a/scenarios/sre/library/indexes/scenarios/44.json b/scenarios/library/indexes/scenarios/44.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/44.json rename to scenarios/library/indexes/scenarios/44.json diff --git a/scenarios/sre/library/indexes/scenarios/45.json b/scenarios/library/indexes/scenarios/45.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/45.json rename to scenarios/library/indexes/scenarios/45.json diff --git a/scenarios/sre/library/indexes/scenarios/46.json b/scenarios/library/indexes/scenarios/46.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/46.json rename to scenarios/library/indexes/scenarios/46.json diff --git a/scenarios/sre/library/indexes/scenarios/47.json b/scenarios/library/indexes/scenarios/47.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/47.json rename to scenarios/library/indexes/scenarios/47.json diff --git a/scenarios/sre/library/indexes/scenarios/48.json b/scenarios/library/indexes/scenarios/48.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/48.json rename to scenarios/library/indexes/scenarios/48.json diff --git a/scenarios/sre/library/indexes/scenarios/49.json b/scenarios/library/indexes/scenarios/49.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/49.json rename to scenarios/library/indexes/scenarios/49.json diff --git a/scenarios/sre/library/indexes/scenarios/5.json b/scenarios/library/indexes/scenarios/5.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/5.json rename to scenarios/library/indexes/scenarios/5.json diff --git a/scenarios/sre/library/indexes/scenarios/50.json b/scenarios/library/indexes/scenarios/50.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/50.json rename to scenarios/library/indexes/scenarios/50.json diff --git a/scenarios/sre/library/indexes/scenarios/51.json b/scenarios/library/indexes/scenarios/51.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/51.json rename to scenarios/library/indexes/scenarios/51.json diff --git a/scenarios/sre/library/indexes/scenarios/52.json b/scenarios/library/indexes/scenarios/52.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/52.json rename to scenarios/library/indexes/scenarios/52.json diff --git a/scenarios/sre/library/indexes/scenarios/53.json b/scenarios/library/indexes/scenarios/53.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/53.json rename to scenarios/library/indexes/scenarios/53.json diff --git a/scenarios/sre/library/indexes/scenarios/54.json b/scenarios/library/indexes/scenarios/54.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/54.json rename to scenarios/library/indexes/scenarios/54.json diff --git a/scenarios/sre/library/indexes/scenarios/55.json b/scenarios/library/indexes/scenarios/55.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/55.json rename to scenarios/library/indexes/scenarios/55.json diff --git a/scenarios/sre/library/indexes/scenarios/56.json b/scenarios/library/indexes/scenarios/56.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/56.json rename to scenarios/library/indexes/scenarios/56.json diff --git a/scenarios/sre/library/indexes/scenarios/57.json b/scenarios/library/indexes/scenarios/57.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/57.json rename to scenarios/library/indexes/scenarios/57.json diff --git a/scenarios/sre/library/indexes/scenarios/58.json b/scenarios/library/indexes/scenarios/58.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/58.json rename to scenarios/library/indexes/scenarios/58.json diff --git a/scenarios/sre/library/indexes/scenarios/59.json b/scenarios/library/indexes/scenarios/59.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/59.json rename to scenarios/library/indexes/scenarios/59.json diff --git a/scenarios/sre/library/indexes/scenarios/6.json b/scenarios/library/indexes/scenarios/6.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/6.json rename to scenarios/library/indexes/scenarios/6.json diff --git a/scenarios/sre/library/indexes/scenarios/60.json b/scenarios/library/indexes/scenarios/60.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/60.json rename to scenarios/library/indexes/scenarios/60.json diff --git a/scenarios/sre/library/indexes/scenarios/61.json b/scenarios/library/indexes/scenarios/61.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/61.json rename to scenarios/library/indexes/scenarios/61.json diff --git a/scenarios/sre/library/indexes/scenarios/62.json b/scenarios/library/indexes/scenarios/62.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/62.json rename to scenarios/library/indexes/scenarios/62.json diff --git a/scenarios/sre/library/indexes/scenarios/63.json b/scenarios/library/indexes/scenarios/63.json similarity index 94% rename from scenarios/sre/library/indexes/scenarios/63.json rename to scenarios/library/indexes/scenarios/63.json index 15c3ad854..9705bd3ad 100644 --- a/scenarios/sre/library/indexes/scenarios/63.json +++ b/scenarios/library/indexes/scenarios/63.json @@ -59,7 +59,7 @@ { "steps": [ { - "command": "kubectl -n {{ args.kubernetesObject.metadata.namespace }} get secret {{ args.kubernetesObject.metadata.name }} -o yaml", + "command": "kubectl -n otel-demo get secret email-service-secret -o yaml", "text": "Inspect the corrupted secret to identify the invalid data." }, { diff --git a/scenarios/library/indexes/scenarios/64.json b/scenarios/library/indexes/scenarios/64.json new file mode 100644 index 000000000..df82f3ec0 --- /dev/null +++ b/scenarios/library/indexes/scenarios/64.json @@ -0,0 +1,82 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "medium", + "description": "This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using Kyverno and generate a policy to prevent it.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "active-host-network-kubernetes-deployment" + } + ], + "waitFor": { + "postInjection": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "verify-kyverno-policy-report-creation" + } + ] + } + } + ], + "environment": { + "applications": [] + }, + "id": 64, + "index": 64, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n benchmarks delete deployment backend", + "text": "Delete the non-compliant Deployment that uses hostNetwork." + }, + { + "text": "Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads." + } + ] + } + ] + ], + "states": [ + { + "backend": "kyverno-policy-report", + "expectedResult": "fail", + "resource": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "name": "backend", + "namespace": "benchmarks" + } + } + ], + "tags": [ + "Compliance", + "Deployment" + ] +} diff --git a/scenarios/library/indexes/scenarios/65.json b/scenarios/library/indexes/scenarios/65.json new file mode 100644 index 000000000..b60edc33a --- /dev/null +++ b/scenarios/library/indexes/scenarios/65.json @@ -0,0 +1,66 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "medium", + "description": "This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using kubectl and OPA and generate a policy to prevent it.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "active-host-network-kubernetes-deployment" + } + ] + } + ], + "environment": { + "applications": [] + }, + "id": 65, + "index": 65, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n benchmarks delete deployment backend", + "text": "Delete the non-compliant Deployment that uses hostNetwork." + }, + { + "text": "Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads." + } + ] + } + ] + ], + "states": [ + { + "backend": "opa-eval", + "expectedResult": "false", + "fetcherType": "bash", + "resource": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "name": "backend", + "namespace": "benchmarks" + } + } + ], + "tags": [ + "Compliance", + "Deployment" + ] +} diff --git a/scenarios/library/indexes/scenarios/66.json b/scenarios/library/indexes/scenarios/66.json new file mode 100644 index 000000000..38bf97258 --- /dev/null +++ b/scenarios/library/indexes/scenarios/66.json @@ -0,0 +1,54 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "medium", + "description": "This scenario simulates a RHEL9 host with X11 forwarding enabled in the SSH configuration, violating CIS RHEL9 Benchmark 5.2.6. The agent must detect the violation using Ansible and OPA and generate a policy to prevent it.", + "disruptions": [ + { + "injections": [ + { + "args": { + "virtualMachine": { + "hostname": "rhel9-benchmark" + } + }, + "id": "enabled-x11-forwarding-rhel9-sshd" + } + ] + } + ], + "environment": { + "applications": [] + }, + "id": 66, + "index": 66, + "platforms": [ + "RHEL9" + ], + "solutions": [ + [ + { + "steps": [ + { + "text": "Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service." + } + ] + } + ] + ], + "states": [ + { + "backend": "opa-eval", + "expectedResult": "false", + "fetcherType": "ansible-playbook", + "resource": { + "kind": "Host", + "name": "rhel9-benchmark" + } + } + ], + "tags": [ + "Compliance" + ] +} diff --git a/scenarios/library/indexes/scenarios/67.json b/scenarios/library/indexes/scenarios/67.json new file mode 100644 index 000000000..dcef977ca --- /dev/null +++ b/scenarios/library/indexes/scenarios/67.json @@ -0,0 +1,71 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "high", + "description": "This scenario simulates a Kubernetes cluster with existing Kyverno policies that have gaps in their security controls. The agent must extend the policies to remediate the violations without modifying the existing policy rules.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "non-compliant-kubernetes-pod-deployment" + } + ] + } + ], + "environment": { + "applications": [] + }, + "id": 67, + "index": 67, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n benchmarks delete deployment backend", + "text": "Delete the non-compliant Pod." + }, + { + "text": "Author and apply a policy that enforces the required security controls for the workload." + } + ] + } + ] + ], + "states": [ + { + "backend": "kyverno-policy-report", + "expectedResult": "fail", + "policyName": "container-security-controls", + "resource": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "name": "backend", + "namespace": "benchmarks" + } + }, + { + "backend": "policy-unchanged", + "expectedResult": "unchanged", + "policyName": "service-account-requirements" + } + ], + "tags": [ + "Compliance", + "Deployment" + ] +} diff --git a/scenarios/sre/library/indexes/scenarios/7.json b/scenarios/library/indexes/scenarios/7.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/7.json rename to scenarios/library/indexes/scenarios/7.json diff --git a/scenarios/sre/library/indexes/scenarios/8.json b/scenarios/library/indexes/scenarios/8.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/8.json rename to scenarios/library/indexes/scenarios/8.json diff --git a/scenarios/sre/library/indexes/scenarios/80.json b/scenarios/library/indexes/scenarios/80.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/80.json rename to scenarios/library/indexes/scenarios/80.json diff --git a/scenarios/sre/library/indexes/scenarios/81.json b/scenarios/library/indexes/scenarios/81.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/81.json rename to scenarios/library/indexes/scenarios/81.json diff --git a/scenarios/sre/library/indexes/scenarios/83.json b/scenarios/library/indexes/scenarios/83.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/83.json rename to scenarios/library/indexes/scenarios/83.json diff --git a/scenarios/sre/library/indexes/scenarios/91.json b/scenarios/library/indexes/scenarios/91.json similarity index 100% rename from scenarios/sre/library/indexes/scenarios/91.json rename to scenarios/library/indexes/scenarios/91.json diff --git a/scenarios/sre/library/indexes/waiters/1.json b/scenarios/library/indexes/waiters/1.json similarity index 100% rename from scenarios/sre/library/indexes/waiters/1.json rename to scenarios/library/indexes/waiters/1.json diff --git a/scenarios/sre/library/indexes/waiters/2.json b/scenarios/library/indexes/waiters/2.json similarity index 100% rename from scenarios/sre/library/indexes/waiters/2.json rename to scenarios/library/indexes/waiters/2.json diff --git a/scenarios/sre/library/indexes/waiters/3.json b/scenarios/library/indexes/waiters/3.json similarity index 100% rename from scenarios/sre/library/indexes/waiters/3.json rename to scenarios/library/indexes/waiters/3.json diff --git a/scenarios/sre/library/indexes/waiters/4.json b/scenarios/library/indexes/waiters/4.json similarity index 100% rename from scenarios/sre/library/indexes/waiters/4.json rename to scenarios/library/indexes/waiters/4.json diff --git a/scenarios/library/indexes/waiters/5.json b/scenarios/library/indexes/waiters/5.json new file mode 100644 index 000000000..0205ad19e --- /dev/null +++ b/scenarios/library/indexes/waiters/5.json @@ -0,0 +1,55 @@ +{ + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/waiter.json", + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "Verifies that Kyverno has created a PolicyReport scoped to the target Kubernetes workload.", + "id": "verify-kyverno-policy-report-creation", + "index": 5, + "name": "Verify Kyverno Policy Report Creation", + "platform": "Kubernetes" +} diff --git a/scenarios/sre/project/clear_kubernetes_events.yaml b/scenarios/project/clear_kubernetes_events.yaml similarity index 100% rename from scenarios/sre/project/clear_kubernetes_events.yaml rename to scenarios/project/clear_kubernetes_events.yaml diff --git a/scenarios/sre/project/display_gateway_endpoints.yaml b/scenarios/project/display_gateway_endpoints.yaml similarity index 100% rename from scenarios/sre/project/display_gateway_endpoints.yaml rename to scenarios/project/display_gateway_endpoints.yaml diff --git a/scenarios/sre/project/generate_agent_bundle.yaml b/scenarios/project/generate_agent_bundle.yaml similarity index 90% rename from scenarios/sre/project/generate_agent_bundle.yaml rename to scenarios/project/generate_agent_bundle.yaml index e39aebd13..95ef3cf7b 100644 --- a/scenarios/sre/project/generate_agent_bundle.yaml +++ b/scenarios/project/generate_agent_bundle.yaml @@ -56,15 +56,18 @@ when: - storage.local is ansible.builtin.defined - - name: Print agent bundle - ansible.builtin.debug: - msg: | + - name: Save agent bundle + ansible.builtin.copy: + content: |- {{ { "prometheus_url": tools_prometheus_endpoint.host, "kubeconfig": lookup("ansible.builtin.file", "/tmp/kubeconfig") - } + } | + ansible.builtin.to_json }} + dest: "{{ [playbook_dir, '..', 'tmp', 'bundle.json'] | ansible.builtin.path_join }}" + mode: "0644" vars: restricted_kubeconfig_exists: "{{ '/tmp/kubeconfig' is exists }}" when: diff --git a/scenarios/sre/project/generate_documentation_index.yaml b/scenarios/project/generate_documentation_index.yaml similarity index 100% rename from scenarios/sre/project/generate_documentation_index.yaml rename to scenarios/project/generate_documentation_index.yaml diff --git a/scenarios/sre/project/generate_leaderboard_bundle.yaml b/scenarios/project/generate_leaderboard_bundle.yaml similarity index 100% rename from scenarios/sre/project/generate_leaderboard_bundle.yaml rename to scenarios/project/generate_leaderboard_bundle.yaml diff --git a/scenarios/sre/project/generate_leaderboard_bundle_status.yaml b/scenarios/project/generate_leaderboard_bundle_status.yaml similarity index 100% rename from scenarios/sre/project/generate_leaderboard_bundle_status.yaml rename to scenarios/project/generate_leaderboard_bundle_status.yaml diff --git a/scenarios/sre/project/manage_agent_access.yaml b/scenarios/project/manage_agent_access.yaml similarity index 100% rename from scenarios/sre/project/manage_agent_access.yaml rename to scenarios/project/manage_agent_access.yaml diff --git a/scenarios/sre/project/manage_agent_transition.yaml b/scenarios/project/manage_agent_transition.yaml similarity index 100% rename from scenarios/sre/project/manage_agent_transition.yaml rename to scenarios/project/manage_agent_transition.yaml diff --git a/scenarios/sre/project/manage_applications.yaml b/scenarios/project/manage_applications.yaml similarity index 100% rename from scenarios/sre/project/manage_applications.yaml rename to scenarios/project/manage_applications.yaml diff --git a/scenarios/sre/project/manage_awx.yaml b/scenarios/project/manage_awx.yaml similarity index 100% rename from scenarios/sre/project/manage_awx.yaml rename to scenarios/project/manage_awx.yaml diff --git a/scenarios/sre/project/manage_faults.yaml b/scenarios/project/manage_faults.yaml similarity index 100% rename from scenarios/sre/project/manage_faults.yaml rename to scenarios/project/manage_faults.yaml diff --git a/scenarios/sre/project/manage_recorders.yaml b/scenarios/project/manage_recorders.yaml similarity index 100% rename from scenarios/sre/project/manage_recorders.yaml rename to scenarios/project/manage_recorders.yaml diff --git a/scenarios/sre/project/manage_resource_files.yaml b/scenarios/project/manage_resource_files.yaml similarity index 100% rename from scenarios/sre/project/manage_resource_files.yaml rename to scenarios/project/manage_resource_files.yaml diff --git a/scenarios/sre/project/manage_tools.yaml b/scenarios/project/manage_tools.yaml similarity index 94% rename from scenarios/sre/project/manage_tools.yaml rename to scenarios/project/manage_tools.yaml index d83d2d1f4..edf4696a2 100644 --- a/scenarios/sre/project/manage_tools.yaml +++ b/scenarios/project/manage_tools.yaml @@ -43,10 +43,12 @@ - name: Create tool installation variable ansible.builtin.set_fact: tools_configuration: - sre: - enabled: "{{ tools.sre | ansible.builtin.default(false) }}" + ciso: + enabled: "{{ tools.ciso | ansible.builtin.default(false) }}" finops: enabled: "{{ tools.finops | ansible.builtin.default(false) }}" + sre: + enabled: "{{ tools.sre | ansible.builtin.default(false) }}" - name: Import tools role ansible.builtin.import_role: diff --git a/scenarios/project/manage_virtual_machine_access.yaml b/scenarios/project/manage_virtual_machine_access.yaml new file mode 100644 index 000000000..4b33af062 --- /dev/null +++ b/scenarios/project/manage_virtual_machine_access.yaml @@ -0,0 +1,42 @@ +--- +- name: Manage Virtual Machine Access + hosts: + - localhost + pre_tasks: + - name: Import executables role + ansible.builtin.import_role: + name: executables + tags: + - always + + - name: Configure storage + tags: + - always + block: + - name: Override storage configuration + ansible.builtin.set_fact: + storage: |- + {{ + lookup("ansible.builtin.template", template_path) | + ansible.builtin.from_yaml + }} + vars: + template_path: "{{ playbook_dir }}/templates/group_variables/storage.j2" + when: + - scenario_id is ansible.builtin.defined + - storage is ansible.builtin.defined + - storage_overrides is ansible.builtin.defined + + - name: Create directory for local storage export + ansible.builtin.file: + mode: "0755" + path: "{{ storage.local.directory | ansible.builtin.default('/tmp') }}" + state: directory + when: + - storage.local is ansible.builtin.defined + tasks: + - name: Import virtual_machine role + ansible.builtin.import_role: + name: virtual_machine + vars: + virtual_machine_storage: "{{ storage }}" diff --git a/scenarios/sre/project/pause_execution.yaml b/scenarios/project/pause_execution.yaml similarity index 100% rename from scenarios/sre/project/pause_execution.yaml rename to scenarios/project/pause_execution.yaml diff --git a/scenarios/sre/project/roles/agent/meta/argument_specs.yaml b/scenarios/project/roles/agent/meta/argument_specs.yaml similarity index 100% rename from scenarios/sre/project/roles/agent/meta/argument_specs.yaml rename to scenarios/project/roles/agent/meta/argument_specs.yaml diff --git a/scenarios/sre/project/roles/agent/molecule/grant_access/cleanup.yml b/scenarios/project/roles/agent/molecule/grant_access/cleanup.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/grant_access/cleanup.yml rename to scenarios/project/roles/agent/molecule/grant_access/cleanup.yml diff --git a/scenarios/sre/project/roles/agent/molecule/grant_access/converge.yml b/scenarios/project/roles/agent/molecule/grant_access/converge.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/grant_access/converge.yml rename to scenarios/project/roles/agent/molecule/grant_access/converge.yml diff --git a/scenarios/sre/project/roles/agent/molecule/grant_access/create.yml b/scenarios/project/roles/agent/molecule/grant_access/create.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/grant_access/create.yml rename to scenarios/project/roles/agent/molecule/grant_access/create.yml diff --git a/scenarios/sre/project/roles/agent/molecule/grant_access/destroy.yml b/scenarios/project/roles/agent/molecule/grant_access/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/grant_access/destroy.yml rename to scenarios/project/roles/agent/molecule/grant_access/destroy.yml diff --git a/scenarios/sre/project/roles/agent/molecule/grant_access/molecule.yml b/scenarios/project/roles/agent/molecule/grant_access/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/grant_access/molecule.yml rename to scenarios/project/roles/agent/molecule/grant_access/molecule.yml diff --git a/scenarios/sre/project/roles/agent/molecule/grant_access/verify.yml b/scenarios/project/roles/agent/molecule/grant_access/verify.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/grant_access/verify.yml rename to scenarios/project/roles/agent/molecule/grant_access/verify.yml diff --git a/scenarios/sre/project/roles/agent/molecule/revoke_access/converge.yml b/scenarios/project/roles/agent/molecule/revoke_access/converge.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/revoke_access/converge.yml rename to scenarios/project/roles/agent/molecule/revoke_access/converge.yml diff --git a/scenarios/sre/project/roles/agent/molecule/revoke_access/create.yml b/scenarios/project/roles/agent/molecule/revoke_access/create.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/revoke_access/create.yml rename to scenarios/project/roles/agent/molecule/revoke_access/create.yml diff --git a/scenarios/sre/project/roles/agent/molecule/revoke_access/destroy.yml b/scenarios/project/roles/agent/molecule/revoke_access/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/revoke_access/destroy.yml rename to scenarios/project/roles/agent/molecule/revoke_access/destroy.yml diff --git a/scenarios/sre/project/roles/agent/molecule/revoke_access/molecule.yml b/scenarios/project/roles/agent/molecule/revoke_access/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/revoke_access/molecule.yml rename to scenarios/project/roles/agent/molecule/revoke_access/molecule.yml diff --git a/scenarios/sre/project/roles/agent/molecule/revoke_access/verify.yml b/scenarios/project/roles/agent/molecule/revoke_access/verify.yml similarity index 100% rename from scenarios/sre/project/roles/agent/molecule/revoke_access/verify.yml rename to scenarios/project/roles/agent/molecule/revoke_access/verify.yml diff --git a/scenarios/sre/project/roles/agent/tasks/grant.yaml b/scenarios/project/roles/agent/tasks/grant.yaml similarity index 100% rename from scenarios/sre/project/roles/agent/tasks/grant.yaml rename to scenarios/project/roles/agent/tasks/grant.yaml diff --git a/scenarios/sre/project/roles/agent/tasks/main.yaml b/scenarios/project/roles/agent/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/agent/tasks/main.yaml rename to scenarios/project/roles/agent/tasks/main.yaml diff --git a/scenarios/sre/project/roles/agent/tasks/revoke.yaml b/scenarios/project/roles/agent/tasks/revoke.yaml similarity index 100% rename from scenarios/sre/project/roles/agent/tasks/revoke.yaml rename to scenarios/project/roles/agent/tasks/revoke.yaml diff --git a/scenarios/sre/project/roles/applications/meta/argument_specs.yaml b/scenarios/project/roles/applications/meta/argument_specs.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/meta/argument_specs.yaml rename to scenarios/project/roles/applications/meta/argument_specs.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/install.yaml b/scenarios/project/roles/applications/tasks/install.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/install.yaml rename to scenarios/project/roles/applications/tasks/install.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/install_book_info.yaml b/scenarios/project/roles/applications/tasks/install_book_info.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/install_book_info.yaml rename to scenarios/project/roles/applications/tasks/install_book_info.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/install_opentelemetry_demo.yaml b/scenarios/project/roles/applications/tasks/install_opentelemetry_demo.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/install_opentelemetry_demo.yaml rename to scenarios/project/roles/applications/tasks/install_opentelemetry_demo.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/main.yaml b/scenarios/project/roles/applications/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/main.yaml rename to scenarios/project/roles/applications/tasks/main.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/uninstall.yaml b/scenarios/project/roles/applications/tasks/uninstall.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/uninstall.yaml rename to scenarios/project/roles/applications/tasks/uninstall.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/uninstall_book_info.yaml b/scenarios/project/roles/applications/tasks/uninstall_book_info.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/uninstall_book_info.yaml rename to scenarios/project/roles/applications/tasks/uninstall_book_info.yaml diff --git a/scenarios/sre/project/roles/applications/tasks/uninstall_opentelemetry_demo.yaml b/scenarios/project/roles/applications/tasks/uninstall_opentelemetry_demo.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/tasks/uninstall_opentelemetry_demo.yaml rename to scenarios/project/roles/applications/tasks/uninstall_opentelemetry_demo.yaml diff --git a/scenarios/sre/project/roles/applications/templates/helm/otel_demo/values.j2 b/scenarios/project/roles/applications/templates/helm/otel_demo/values.j2 similarity index 100% rename from scenarios/sre/project/roles/applications/templates/helm/otel_demo/values.j2 rename to scenarios/project/roles/applications/templates/helm/otel_demo/values.j2 diff --git a/scenarios/sre/project/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 b/scenarios/project/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 similarity index 100% rename from scenarios/sre/project/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 rename to scenarios/project/roles/applications/templates/kubernetes/book_info/prometheusrules.j2 diff --git a/scenarios/sre/project/roles/applications/templates/kubernetes/common/prometheusrules.j2 b/scenarios/project/roles/applications/templates/kubernetes/common/prometheusrules.j2 similarity index 100% rename from scenarios/sre/project/roles/applications/templates/kubernetes/common/prometheusrules.j2 rename to scenarios/project/roles/applications/templates/kubernetes/common/prometheusrules.j2 diff --git a/scenarios/sre/project/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 b/scenarios/project/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 similarity index 100% rename from scenarios/sre/project/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 rename to scenarios/project/roles/applications/templates/kubernetes/otel_demo/prometheusrules.j2 diff --git a/scenarios/sre/project/roles/applications/vars/main/releases.yaml b/scenarios/project/roles/applications/vars/main/releases.yaml similarity index 100% rename from scenarios/sre/project/roles/applications/vars/main/releases.yaml rename to scenarios/project/roles/applications/vars/main/releases.yaml diff --git a/scenarios/sre/project/roles/awx/files/awx/credential_types/kubeconfig_injectors.json b/scenarios/project/roles/awx/files/awx/credential_types/kubeconfig_injectors.json similarity index 100% rename from scenarios/sre/project/roles/awx/files/awx/credential_types/kubeconfig_injectors.json rename to scenarios/project/roles/awx/files/awx/credential_types/kubeconfig_injectors.json diff --git a/scenarios/sre/project/roles/awx/meta/argument_specs.yaml b/scenarios/project/roles/awx/meta/argument_specs.yaml similarity index 97% rename from scenarios/sre/project/roles/awx/meta/argument_specs.yaml rename to scenarios/project/roles/awx/meta/argument_specs.yaml index deaf9af41..1a6eb5317 100644 --- a/scenarios/sre/project/roles/awx/meta/argument_specs.yaml +++ b/scenarios/project/roles/awx/meta/argument_specs.yaml @@ -149,6 +149,11 @@ argument_specs: - 60 - 61 - 62 + - 63 + - 64 + - 65 + - 66 + - 67 - 80 - 81 - 83 diff --git a/scenarios/sre/project/roles/awx/molecule/configure/cleanup.yml b/scenarios/project/roles/awx/molecule/configure/cleanup.yml similarity index 100% rename from scenarios/sre/project/roles/awx/molecule/configure/cleanup.yml rename to scenarios/project/roles/awx/molecule/configure/cleanup.yml diff --git a/scenarios/sre/project/roles/awx/molecule/configure/converge.yml b/scenarios/project/roles/awx/molecule/configure/converge.yml similarity index 100% rename from scenarios/sre/project/roles/awx/molecule/configure/converge.yml rename to scenarios/project/roles/awx/molecule/configure/converge.yml diff --git a/scenarios/sre/project/roles/awx/molecule/configure/create.yml b/scenarios/project/roles/awx/molecule/configure/create.yml similarity index 100% rename from scenarios/sre/project/roles/awx/molecule/configure/create.yml rename to scenarios/project/roles/awx/molecule/configure/create.yml diff --git a/scenarios/sre/project/roles/awx/molecule/configure/molecule.yml b/scenarios/project/roles/awx/molecule/configure/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/awx/molecule/configure/molecule.yml rename to scenarios/project/roles/awx/molecule/configure/molecule.yml diff --git a/scenarios/sre/project/roles/awx/molecule/configure/verify.yml b/scenarios/project/roles/awx/molecule/configure/verify.yml similarity index 100% rename from scenarios/sre/project/roles/awx/molecule/configure/verify.yml rename to scenarios/project/roles/awx/molecule/configure/verify.yml diff --git a/scenarios/sre/project/roles/awx/tasks/configure.yaml b/scenarios/project/roles/awx/tasks/configure.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/configure.yaml rename to scenarios/project/roles/awx/tasks/configure.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/configure_credentials.yaml b/scenarios/project/roles/awx/tasks/configure_credentials.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/configure_credentials.yaml rename to scenarios/project/roles/awx/tasks/configure_credentials.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/configure_inventory.yaml b/scenarios/project/roles/awx/tasks/configure_inventory.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/configure_inventory.yaml rename to scenarios/project/roles/awx/tasks/configure_inventory.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/configure_jobs.yaml b/scenarios/project/roles/awx/tasks/configure_jobs.yaml similarity index 87% rename from scenarios/sre/project/roles/awx/tasks/configure_jobs.yaml rename to scenarios/project/roles/awx/tasks/configure_jobs.yaml index 57433afbe..3a9c0fe91 100644 --- a/scenarios/sre/project/roles/awx/tasks/configure_jobs.yaml +++ b/scenarios/project/roles/awx/tasks/configure_jobs.yaml @@ -18,45 +18,45 @@ state: present loop: - name: Deploy-Tools - playbook: scenarios/sre/project/manage_tools.yaml + playbook: scenarios/project/manage_tools.yaml job_tags: install_tools - name: Undeploy-Tools - playbook: scenarios/sre/project/manage_tools.yaml + playbook: scenarios/project/manage_tools.yaml job_tags: uninstall_tools - name: Deploy-Applications - playbook: scenarios/sre/project/manage_applications.yaml + playbook: scenarios/project/manage_applications.yaml job_tags: install_applications - name: Undeploy-Applications - playbook: scenarios/sre/project/manage_applications.yaml + playbook: scenarios/project/manage_applications.yaml job_tags: uninstall_applications - name: Clear-Kubernetes-Events - playbook: scenarios/sre/project/clear_kubernetes_events.yaml + playbook: scenarios/project/clear_kubernetes_events.yaml - name: Inject-Faults - playbook: scenarios/sre/project/manage_faults.yaml + playbook: scenarios/project/manage_faults.yaml job_tags: inject_faults - name: Remove-Faults - playbook: scenarios/sre/project/manage_faults.yaml + playbook: scenarios/project/manage_faults.yaml job_tags: remove_faults - name: Deploy-Data-Recorders - playbook: scenarios/sre/project/manage_recorders.yaml + playbook: scenarios/project/manage_recorders.yaml job_tags: install_recorders - name: Undeploy-Data-Recorders - playbook: scenarios/sre/project/manage_recorders.yaml + playbook: scenarios/project/manage_recorders.yaml job_tags: uninstall_recorders - name: Grant-Access-To-Agent - playbook: scenarios/sre/project/manage_agent_access.yaml + playbook: scenarios/project/manage_agent_access.yaml job_tags: grant_access - name: Remove-Access-From-Agent - playbook: scenarios/sre/project/manage_agent_access.yaml + playbook: scenarios/project/manage_agent_access.yaml job_tags: revoke_access - name: Pause - playbook: scenarios/sre/project/pause_execution.yaml + playbook: scenarios/project/pause_execution.yaml job_tags: pause - name: Handover-To-Agent - playbook: scenarios/sre/project/manage_agent_transition.yaml + playbook: scenarios/project/manage_agent_transition.yaml job_tags: agent_handover - name: Handback-From-Agent - playbook: scenarios/sre/project/manage_agent_transition.yaml + playbook: scenarios/project/manage_agent_transition.yaml job_tags: agent_handback loop_control: label: jobtemplate/{{ job_template.name }} diff --git a/scenarios/sre/project/roles/awx/tasks/configure_projects.yaml b/scenarios/project/roles/awx/tasks/configure_projects.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/configure_projects.yaml rename to scenarios/project/roles/awx/tasks/configure_projects.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/configure_workflows.yaml b/scenarios/project/roles/awx/tasks/configure_workflows.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/configure_workflows.yaml rename to scenarios/project/roles/awx/tasks/configure_workflows.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/generate_files.yaml b/scenarios/project/roles/awx/tasks/generate_files.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/generate_files.yaml rename to scenarios/project/roles/awx/tasks/generate_files.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/install.yaml b/scenarios/project/roles/awx/tasks/install.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/install.yaml rename to scenarios/project/roles/awx/tasks/install.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/install_awx_instances.yaml b/scenarios/project/roles/awx/tasks/install_awx_instances.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/install_awx_instances.yaml rename to scenarios/project/roles/awx/tasks/install_awx_instances.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/install_awx_operator.yaml b/scenarios/project/roles/awx/tasks/install_awx_operator.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/install_awx_operator.yaml rename to scenarios/project/roles/awx/tasks/install_awx_operator.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/launch_workflows.yaml b/scenarios/project/roles/awx/tasks/launch_workflows.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/launch_workflows.yaml rename to scenarios/project/roles/awx/tasks/launch_workflows.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/main.yaml b/scenarios/project/roles/awx/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/main.yaml rename to scenarios/project/roles/awx/tasks/main.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/set_awx_controller_host.yaml b/scenarios/project/roles/awx/tasks/set_awx_controller_host.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/set_awx_controller_host.yaml rename to scenarios/project/roles/awx/tasks/set_awx_controller_host.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/set_awx_controller_password.yaml b/scenarios/project/roles/awx/tasks/set_awx_controller_password.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/set_awx_controller_password.yaml rename to scenarios/project/roles/awx/tasks/set_awx_controller_password.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/uninstall.yaml b/scenarios/project/roles/awx/tasks/uninstall.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/uninstall.yaml rename to scenarios/project/roles/awx/tasks/uninstall.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/uninstall_awx_instances.yaml b/scenarios/project/roles/awx/tasks/uninstall_awx_instances.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/uninstall_awx_instances.yaml rename to scenarios/project/roles/awx/tasks/uninstall_awx_instances.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/uninstall_awx_operator.yaml b/scenarios/project/roles/awx/tasks/uninstall_awx_operator.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/uninstall_awx_operator.yaml rename to scenarios/project/roles/awx/tasks/uninstall_awx_operator.yaml diff --git a/scenarios/sre/project/roles/awx/tasks/validate.yaml b/scenarios/project/roles/awx/tasks/validate.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/tasks/validate.yaml rename to scenarios/project/roles/awx/tasks/validate.yaml diff --git a/scenarios/sre/project/roles/awx/templates/awx/workflows/launch_variables.j2 b/scenarios/project/roles/awx/templates/awx/workflows/launch_variables.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/awx/workflows/launch_variables.j2 rename to scenarios/project/roles/awx/templates/awx/workflows/launch_variables.j2 diff --git a/scenarios/sre/project/roles/awx/templates/awx/workflows/node_credentials.j2 b/scenarios/project/roles/awx/templates/awx/workflows/node_credentials.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/awx/workflows/node_credentials.j2 rename to scenarios/project/roles/awx/templates/awx/workflows/node_credentials.j2 diff --git a/scenarios/sre/project/roles/awx/templates/awx/workflows/nodes/scenario_execution.j2 b/scenarios/project/roles/awx/templates/awx/workflows/nodes/scenario_execution.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/awx/workflows/nodes/scenario_execution.j2 rename to scenarios/project/roles/awx/templates/awx/workflows/nodes/scenario_execution.j2 diff --git a/scenarios/sre/project/roles/awx/templates/awx/workflows/nodes/scenario_orchestration.j2 b/scenarios/project/roles/awx/templates/awx/workflows/nodes/scenario_orchestration.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/awx/workflows/nodes/scenario_orchestration.j2 rename to scenarios/project/roles/awx/templates/awx/workflows/nodes/scenario_orchestration.j2 diff --git a/scenarios/sre/project/roles/awx/templates/kubernetes/awx.j2 b/scenarios/project/roles/awx/templates/kubernetes/awx.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/kubernetes/awx.j2 rename to scenarios/project/roles/awx/templates/kubernetes/awx.j2 diff --git a/scenarios/sre/project/roles/awx/templates/meta/argument_specs.j2 b/scenarios/project/roles/awx/templates/meta/argument_specs.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/meta/argument_specs.j2 rename to scenarios/project/roles/awx/templates/meta/argument_specs.j2 diff --git a/scenarios/sre/project/roles/awx/templates/vars/scenario_fault_count.j2 b/scenarios/project/roles/awx/templates/vars/scenario_fault_count.j2 similarity index 100% rename from scenarios/sre/project/roles/awx/templates/vars/scenario_fault_count.j2 rename to scenarios/project/roles/awx/templates/vars/scenario_fault_count.j2 diff --git a/scenarios/sre/project/roles/awx/vars/main/releases.yaml b/scenarios/project/roles/awx/vars/main/releases.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/vars/main/releases.yaml rename to scenarios/project/roles/awx/vars/main/releases.yaml diff --git a/scenarios/sre/project/roles/awx/vars/main/scenario_fault_count.yaml b/scenarios/project/roles/awx/vars/main/scenario_fault_count.yaml similarity index 93% rename from scenarios/sre/project/roles/awx/vars/main/scenario_fault_count.yaml rename to scenarios/project/roles/awx/vars/main/scenario_fault_count.yaml index 33906b3d2..f5dab7b2a 100644 --- a/scenarios/sre/project/roles/awx/vars/main/scenario_fault_count.yaml +++ b/scenarios/project/roles/awx/vars/main/scenario_fault_count.yaml @@ -59,6 +59,11 @@ awx_scenario_fault_count: 60: 2 61: 1 62: 1 + 63: 1 + 64: 1 + 65: 1 + 66: 1 + 67: 1 80: 1 81: 1 83: 1 diff --git a/scenarios/sre/project/roles/awx/vars/main/workflows_suffixes.yaml b/scenarios/project/roles/awx/vars/main/workflows_suffixes.yaml similarity index 100% rename from scenarios/sre/project/roles/awx/vars/main/workflows_suffixes.yaml rename to scenarios/project/roles/awx/vars/main/workflows_suffixes.yaml diff --git a/scenarios/sre/project/roles/cluster/meta/argument_specs.yaml b/scenarios/project/roles/cluster/meta/argument_specs.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/meta/argument_specs.yaml rename to scenarios/project/roles/cluster/meta/argument_specs.yaml diff --git a/scenarios/sre/project/roles/cluster/tasks/approve_certificate_requests.yaml b/scenarios/project/roles/cluster/tasks/approve_certificate_requests.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/tasks/approve_certificate_requests.yaml rename to scenarios/project/roles/cluster/tasks/approve_certificate_requests.yaml diff --git a/scenarios/sre/project/roles/cluster/tasks/main.yaml b/scenarios/project/roles/cluster/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/tasks/main.yaml rename to scenarios/project/roles/cluster/tasks/main.yaml diff --git a/scenarios/sre/project/roles/cluster/tasks/set_cluster_platform.yaml b/scenarios/project/roles/cluster/tasks/set_cluster_platform.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/tasks/set_cluster_platform.yaml rename to scenarios/project/roles/cluster/tasks/set_cluster_platform.yaml diff --git a/scenarios/sre/project/roles/cluster/tasks/set_cluster_provider.yaml b/scenarios/project/roles/cluster/tasks/set_cluster_provider.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/tasks/set_cluster_provider.yaml rename to scenarios/project/roles/cluster/tasks/set_cluster_provider.yaml diff --git a/scenarios/sre/project/roles/cluster/tasks/validate_server_version.yaml b/scenarios/project/roles/cluster/tasks/validate_server_version.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/tasks/validate_server_version.yaml rename to scenarios/project/roles/cluster/tasks/validate_server_version.yaml diff --git a/scenarios/sre/project/roles/cluster/vars/main/minimum_versions.yaml b/scenarios/project/roles/cluster/vars/main/minimum_versions.yaml similarity index 100% rename from scenarios/sre/project/roles/cluster/vars/main/minimum_versions.yaml rename to scenarios/project/roles/cluster/vars/main/minimum_versions.yaml diff --git a/scenarios/sre/project/roles/executables/tasks/check_binary_path.yaml b/scenarios/project/roles/executables/tasks/check_binary_path.yaml similarity index 100% rename from scenarios/sre/project/roles/executables/tasks/check_binary_path.yaml rename to scenarios/project/roles/executables/tasks/check_binary_path.yaml diff --git a/scenarios/sre/project/roles/executables/tasks/main.yaml b/scenarios/project/roles/executables/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/executables/tasks/main.yaml rename to scenarios/project/roles/executables/tasks/main.yaml diff --git a/scenarios/project/roles/executables/tasks/validate_docker.yaml b/scenarios/project/roles/executables/tasks/validate_docker.yaml new file mode 100644 index 000000000..461bf0288 --- /dev/null +++ b/scenarios/project/roles/executables/tasks/validate_docker.yaml @@ -0,0 +1,6 @@ +--- +- name: Import binary path validation tasks + ansible.builtin.import_tasks: + file: check_binary_path.yaml + vars: + binary_name: docker diff --git a/scenarios/sre/project/roles/executables/tasks/validate_helm.yaml b/scenarios/project/roles/executables/tasks/validate_helm.yaml similarity index 100% rename from scenarios/sre/project/roles/executables/tasks/validate_helm.yaml rename to scenarios/project/roles/executables/tasks/validate_helm.yaml diff --git a/scenarios/sre/project/roles/executables/tasks/validate_kubectl.yaml b/scenarios/project/roles/executables/tasks/validate_kubectl.yaml similarity index 100% rename from scenarios/sre/project/roles/executables/tasks/validate_kubectl.yaml rename to scenarios/project/roles/executables/tasks/validate_kubectl.yaml diff --git a/scenarios/sre/project/roles/executables/tasks/validate_oc.yaml b/scenarios/project/roles/executables/tasks/validate_oc.yaml similarity index 100% rename from scenarios/sre/project/roles/executables/tasks/validate_oc.yaml rename to scenarios/project/roles/executables/tasks/validate_oc.yaml diff --git a/scenarios/project/roles/executables/tasks/validate_opa.yaml b/scenarios/project/roles/executables/tasks/validate_opa.yaml new file mode 100644 index 000000000..0df1fb780 --- /dev/null +++ b/scenarios/project/roles/executables/tasks/validate_opa.yaml @@ -0,0 +1,39 @@ +--- +- name: Import binary path validation tasks + ansible.builtin.import_tasks: + file: check_binary_path.yaml + vars: + binary_name: opa + +- name: Check opa executable version + ansible.builtin.command: + argv: + - "{{ executables_opa_path }}" + - version + register: executables_opa_raw_version + changed_when: + - false + +- name: Parse opa executable version string + ansible.builtin.set_fact: + executables_opa_version: |- + {{ + ( + executables_opa_raw_version.stdout | + ansible.builtin.from_yaml + ).Version + }} + +- name: Fail playbook due to `wrong binary version` error + ansible.builtin.fail: + msg: "`opa` version: {{ executables_opa_version }}. please update `opa` to version {{ executables_minimum_versions.opa }} or higher." + when: + - executables_opa_version is ansible.builtin.version(executables_minimum_versions.opa, "<") + +- name: Display opa executable information + ansible.builtin.debug: + var: info + vars: + info: + path: "{{ executables_opa_path }}" + version: "{{ executables_opa_version }}" diff --git a/scenarios/sre/project/roles/executables/vars/main/minimum_versions.yaml b/scenarios/project/roles/executables/vars/main/minimum_versions.yaml similarity index 88% rename from scenarios/sre/project/roles/executables/vars/main/minimum_versions.yaml rename to scenarios/project/roles/executables/vars/main/minimum_versions.yaml index 5c61954d0..a4f31778a 100644 --- a/scenarios/sre/project/roles/executables/vars/main/minimum_versions.yaml +++ b/scenarios/project/roles/executables/vars/main/minimum_versions.yaml @@ -3,4 +3,5 @@ executables_minimum_versions: helm: "4.0" kubectl: "1.34" oc: "4.19" + opa: "1.0" python: "3.12" diff --git a/scenarios/sre/project/roles/faults/defaults/main/injection_tasks.yaml b/scenarios/project/roles/faults/defaults/main/injection_tasks.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/defaults/main/injection_tasks.yaml rename to scenarios/project/roles/faults/defaults/main/injection_tasks.yaml diff --git a/scenarios/sre/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/invalid_config.json b/scenarios/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/invalid_config.json similarity index 100% rename from scenarios/sre/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/invalid_config.json rename to scenarios/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/invalid_config.json diff --git a/scenarios/sre/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/load_config.py b/scenarios/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/load_config.py similarity index 100% rename from scenarios/sre/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/load_config.py rename to scenarios/project/roles/faults/files/scripts/crashing_kubernetes_workload_init_container/load_config.py diff --git a/scenarios/sre/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/generate_load.py b/scenarios/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/generate_load.py similarity index 100% rename from scenarios/sre/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/generate_load.py rename to scenarios/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/generate_load.py diff --git a/scenarios/sre/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/requirements.txt b/scenarios/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/requirements.txt similarity index 100% rename from scenarios/sre/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/requirements.txt rename to scenarios/project/roles/faults/files/scripts/kubernetes_api_server_request_surge/requirements.txt diff --git a/scenarios/sre/project/roles/faults/files/scripts/valkey_workload_out_of_memory/fill_storage.sh b/scenarios/project/roles/faults/files/scripts/valkey_workload_out_of_memory/fill_storage.sh similarity index 100% rename from scenarios/sre/project/roles/faults/files/scripts/valkey_workload_out_of_memory/fill_storage.sh rename to scenarios/project/roles/faults/files/scripts/valkey_workload_out_of_memory/fill_storage.sh diff --git a/scenarios/sre/project/roles/faults/meta/argument_specs.yaml b/scenarios/project/roles/faults/meta/argument_specs.yaml similarity index 93% rename from scenarios/sre/project/roles/faults/meta/argument_specs.yaml rename to scenarios/project/roles/faults/meta/argument_specs.yaml index f21ab0edc..e6f2a67a9 100644 --- a/scenarios/sre/project/roles/faults/meta/argument_specs.yaml +++ b/scenarios/project/roles/faults/meta/argument_specs.yaml @@ -20,11 +20,13 @@ argument_specs: type: dict id: choices: + - active-host-network-kubernetes-deployment - cordoned-kubernetes-worker-node - corrupted-kubernetes-secret-credentials - crashing-kubernetes-workload-init-container - deleted-kubernetes-service - disabled-istio-ambient-mode-kubernetes-namespace + - enabled-x11-forwarding-rhel9-sshd - failing-name-resolution-kubernetes-workload-dns-policy - hanging-kubernetes-workload-init-container - ingress-port-blocking-network-policy @@ -37,6 +39,7 @@ argument_specs: - misconfigured-kubernetes-workload-container-readiness-probe - modified-kubernetes-workload-container-environment-variable - modified-target-port-kubernetes-service + - non-compliant-kubernetes-pod-deployment - nonexistent-kubernetes-workload-container-image - nonexistent-kubernetes-workload-node - nonexistent-kubernetes-workload-persistent-volume-claim diff --git a/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/converge.yml b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/converge.yml new file mode 100644 index 000000000..7013f8f9a --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/converge.yml @@ -0,0 +1,18 @@ +--- +- name: Run fault injection test + hosts: + - localhost + tasks: + - name: Import faults role + ansible.builtin.import_role: + name: faults + vars: + faults_cluster: + kubeconfig: "{{ cluster.kubeconfig }}" + faults_injection_tasks: + - id: active-host-network-kubernetes-deployment + args: + kubernetesObject: + metadata: + name: host-network-workload + namespace: active-host-network-k8s-deployment-test diff --git a/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/create.yml b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/create.yml new file mode 100644 index 000000000..b48ca9785 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/create.yml @@ -0,0 +1,14 @@ +--- +- name: Create Kubernetes objects + hosts: + - localhost + tasks: + - name: Create namespace + kubernetes.core.k8s: + kubeconfig: "{{ cluster.kubeconfig }}" + resource_definition: + apiVersion: v1 + kind: Namespace + metadata: + name: active-host-network-k8s-deployment-test + state: present diff --git a/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/destroy.yml b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/destroy.yml new file mode 100644 index 000000000..50e1acac6 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/destroy.yml @@ -0,0 +1,13 @@ +--- +- name: Destroy Kubernetes objects + hosts: + - localhost + tasks: + - name: Delete namespace + kubernetes.core.k8s: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: v1 + kind: Namespace + name: active-host-network-k8s-deployment-test + state: absent + wait: true diff --git a/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/molecule.yml b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/molecule.yml new file mode 100644 index 000000000..ac07f64cf --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +ansible: + env: + ANSIBLE_ROLES_PATH: ../../.. + executor: + backend: ansible-playbook + args: + ansible_playbook: + - --inventory=${MOLECULE_PROJECT_DIRECTORY}/../../../inventory + - --tags=inject_faults,untagged + playbooks: + create: create.yml + converge: converge.yml + destroy: destroy.yml + verify: verify.yml + +scenario: + name: inject_active_host_network_kubernetes_deployment + test_sequence: + - syntax + - create + - converge + - verify + - destroy diff --git a/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/verify.yml b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/verify.yml new file mode 100644 index 000000000..cb05ccfe2 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_active_host_network_kubernetes_deployment/verify.yml @@ -0,0 +1,27 @@ +--- +- name: Verify fault injection + hosts: + - localhost + tasks: + - name: Retrieve deployment + kubernetes.core.k8s_info: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: apps/v1 + kind: Deployment + name: host-network-workload + namespace: active-host-network-k8s-deployment-test + register: faults_deployment + + - name: Validate deployment exists + ansible.builtin.assert: + that: + - faults_deployment.resources | ansible.builtin.length == 1 + fail_msg: Deployment was not created. Fault injection failed. + success_msg: Deployment was created. + + - name: Validate hostNetwork is enabled + ansible.builtin.assert: + that: + - faults_deployment.resources[0].spec.template.spec.hostNetwork == true + fail_msg: hostNetwork is not true. Fault injection failed. + success_msg: hostNetwork is true. diff --git a/scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/cleanup.yml b/scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/cleanup.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/cleanup.yml rename to scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/cleanup.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/converge.yml b/scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/converge.yml rename to scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/create.yml b/scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/create.yml rename to scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/destroy.yml b/scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/molecule.yml b/scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/verify.yml b/scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/verify.yml rename to scenarios/project/roles/faults/molecule/inject_cordoned_kubernetes_worker_node/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/converge.yml b/scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/converge.yml rename to scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/create.yml b/scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/create.yml rename to scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/destroy.yml b/scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/molecule.yml b/scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/verify.yml b/scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/verify.yml rename to scenarios/project/roles/faults/molecule/inject_corrupted_kubernetes_secret_credentials/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/converge.yml b/scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/converge.yml rename to scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/create.yml b/scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/create.yml rename to scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/destroy.yml b/scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/molecule.yml b/scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/verify.yml b/scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/verify.yml rename to scenarios/project/roles/faults/molecule/inject_crashing_kubernetes_workload_init_container/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/converge.yml b/scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/converge.yml rename to scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/create.yml b/scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/create.yml rename to scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/destroy.yml b/scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/molecule.yml b/scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/verify.yml b/scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_deleted_kubernetes_service/verify.yml rename to scenarios/project/roles/faults/molecule/inject_deleted_kubernetes_service/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/converge.yml b/scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/converge.yml rename to scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/create.yml b/scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/create.yml rename to scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/destroy.yml b/scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/molecule.yml b/scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/verify.yml b/scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/verify.yml rename to scenarios/project/roles/faults/molecule/inject_disabled_istio_ambient_mode_kubernetes_namespace/verify.yml diff --git a/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/converge.yml b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/converge.yml new file mode 100644 index 000000000..8696e68f8 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/converge.yml @@ -0,0 +1,21 @@ +--- +- name: Run fault injection test + hosts: + - localhost + tasks: + - name: Add container to inventory + ansible.builtin.add_host: + name: x11-forwarding-test + ansible_connection: community.docker.docker + + - name: Import faults role + ansible.builtin.import_role: + name: faults + vars: + faults_cluster: + kubeconfig: "" + faults_injection_tasks: + - id: enabled-x11-forwarding-rhel9-sshd + args: + virtualMachine: + hostname: x11-forwarding-test diff --git a/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/create.yml b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/create.yml new file mode 100644 index 000000000..6f8e2d721 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/create.yml @@ -0,0 +1,36 @@ +--- +- name: Create test container + hosts: + - localhost + pre_tasks: + - name: Import docker validation tasks + ansible.builtin.import_role: + name: executables + tasks_from: validate_docker.yaml + + tasks: + - name: Start UBI9 container with systemd + community.docker.docker_container: + name: x11-forwarding-test + image: registry.access.redhat.com/ubi9/ubi@sha256:9d99826a5299a54fa92e9b47d74e6cd72efb04cb57eb8fe748ed93e08ebb6184 + command: /sbin/init + privileged: true + state: started + cgroupns_mode: host + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + + - name: Install openssh-server in container + community.docker.docker_container_exec: + container: x11-forwarding-test + command: dnf install -y openssh-server + + - name: Start sshd in container + community.docker.docker_container_exec: + container: x11-forwarding-test + command: systemctl start sshd + + - name: Add container to inventory + ansible.builtin.add_host: + name: x11-forwarding-test + ansible_connection: community.docker.docker diff --git a/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/destroy.yml b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/destroy.yml new file mode 100644 index 000000000..bfa98ab7e --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/destroy.yml @@ -0,0 +1,10 @@ +--- +- name: Destroy test container + hosts: + - localhost + tasks: + - name: Remove container + community.docker.docker_container: + name: x11-forwarding-test + state: absent + force_kill: true diff --git a/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/molecule.yml b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/molecule.yml new file mode 100644 index 000000000..7f7900979 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +ansible: + env: + ANSIBLE_ROLES_PATH: ../../.. + executor: + backend: ansible-playbook + args: + ansible_playbook: + - --inventory=${MOLECULE_PROJECT_DIRECTORY}/../../../inventory + - --tags=inject_faults,untagged + playbooks: + create: create.yml + converge: converge.yml + destroy: destroy.yml + verify: verify.yml + +scenario: + name: inject_enabled_x11_forwarding_rhel9_sshd + test_sequence: + - syntax + - create + - converge + - verify + - destroy diff --git a/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/verify.yml b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/verify.yml new file mode 100644 index 000000000..0287a914a --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_enabled_x11_forwarding_rhel9_sshd/verify.yml @@ -0,0 +1,17 @@ +--- +- name: Verify fault injection + hosts: + - localhost + tasks: + - name: Read X11Forwarding value from sshd_config + community.docker.docker_container_exec: + container: x11-forwarding-test + command: grep -E "^X11Forwarding" /etc/ssh/sshd_config + register: faults_sshd_config + + - name: Validate X11Forwarding is enabled + ansible.builtin.assert: + that: + - "'X11Forwarding yes' in faults_sshd_config.stdout" + fail_msg: X11Forwarding is not set to yes. Fault injection failed. + success_msg: X11Forwarding is set to yes. diff --git a/scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/converge.yml b/scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/converge.yml rename to scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/create.yml b/scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/create.yml rename to scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/destroy.yml b/scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/molecule.yml b/scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/verify.yml b/scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/verify.yml rename to scenarios/project/roles/faults/molecule/inject_failing_name_resolution_kubernetes_workload_dns_policy/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/converge.yml b/scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/converge.yml rename to scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/create.yml b/scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/create.yml rename to scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/destroy.yml b/scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/molecule.yml b/scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/verify.yml b/scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/verify.yml rename to scenarios/project/roles/faults/molecule/inject_hanging_kubernetes_workload_init_container/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/converge.yml b/scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/converge.yml rename to scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/create.yml b/scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/create.yml rename to scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/destroy.yml b/scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/molecule.yml b/scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/verify.yml b/scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/verify.yml rename to scenarios/project/roles/faults/molecule/inject_ingress_port_blocking_network_policy/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/converge.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/converge.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/create.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/create.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/destroy.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/molecule.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/verify.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/verify.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_resource_quota/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/converge.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/converge.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/create.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/create.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/destroy.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/molecule.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/verify.yml b/scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/verify.yml rename to scenarios/project/roles/faults/molecule/inject_insufficient_kubernetes_workload_container_resources/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/converge.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/converge.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/create.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/create.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/destroy.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/molecule.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/verify.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/verify.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_service_selector/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/converge.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/converge.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/create.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/create.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/destroy.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/molecule.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/verify.yml b/scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/verify.yml rename to scenarios/project/roles/faults/molecule/inject_invalid_kubernetes_workload_container_command/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/cleanup.yml b/scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/cleanup.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/cleanup.yml rename to scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/cleanup.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/converge.yml b/scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/converge.yml rename to scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/create.yml b/scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/create.yml rename to scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/destroy.yml b/scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/molecule.yml b/scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/verify.yml b/scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/verify.yml rename to scenarios/project/roles/faults/molecule/inject_kubernetes_api_server_request_surge/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/converge.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/converge.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/create.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/create.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/destroy.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/molecule.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/verify.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/verify.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_horizontal_pod_autoscaler/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/converge.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/converge.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/create.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/create.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/destroy.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/molecule.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/verify.yml b/scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/verify.yml rename to scenarios/project/roles/faults/molecule/inject_misconfigured_kubernetes_workload_container_readiness_probe/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/converge.yml b/scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/converge.yml rename to scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/create.yml b/scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/create.yml rename to scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/destroy.yml b/scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/molecule.yml b/scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/verify.yml b/scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/verify.yml rename to scenarios/project/roles/faults/molecule/inject_modified_kubernetes_workload_container_environment_variable/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/converge.yml b/scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/converge.yml rename to scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/create.yml b/scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/create.yml rename to scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/destroy.yml b/scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/molecule.yml b/scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/verify.yml b/scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/verify.yml rename to scenarios/project/roles/faults/molecule/inject_modified_target_port_kubernetes_service/verify.yml diff --git a/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/converge.yml b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/converge.yml new file mode 100644 index 000000000..bea938482 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/converge.yml @@ -0,0 +1,18 @@ +--- +- name: Run fault injection test + hosts: + - localhost + tasks: + - name: Import faults role + ansible.builtin.import_role: + name: faults + vars: + faults_cluster: + kubeconfig: "{{ cluster.kubeconfig }}" + faults_injection_tasks: + - id: non-compliant-kubernetes-pod-deployment + args: + kubernetesObject: + metadata: + name: non-compliant-workload + namespace: non-compliant-k8s-pod-deployment-test diff --git a/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/create.yml b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/create.yml new file mode 100644 index 000000000..919b214b4 --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/create.yml @@ -0,0 +1,31 @@ +--- +- name: Create test environment + hosts: + - localhost + tasks: + - name: Import cluster role to set platform and provider variables + ansible.builtin.import_role: + name: cluster + vars: + cluster_files: + kubeconfig: "{{ cluster.kubeconfig }}" + + - name: Install Kyverno + ansible.builtin.import_role: + name: tools + tasks_from: install_kyverno.yaml + vars: + tools_cluster: + kubeconfig: "{{ cluster.kubeconfig }}" + platform: "{{ cluster_platform }}" + provider: "{{ cluster_provider }}" + + - name: Create namespace + kubernetes.core.k8s: + kubeconfig: "{{ cluster.kubeconfig }}" + resource_definition: + apiVersion: v1 + kind: Namespace + metadata: + name: non-compliant-k8s-pod-deployment-test + state: present diff --git a/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/destroy.yml b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/destroy.yml new file mode 100644 index 000000000..8c9fc6f8f --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/destroy.yml @@ -0,0 +1,56 @@ +--- +- name: Destroy test environment + hosts: + - localhost + tasks: + - name: Import cluster role to set platform and provider variables + ansible.builtin.import_role: + name: cluster + vars: + cluster_files: + kubeconfig: "{{ cluster.kubeconfig }}" + + - name: Delete namespace + kubernetes.core.k8s: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: v1 + kind: Namespace + name: non-compliant-k8s-pod-deployment-test + state: absent + wait: true + + - name: Delete ClusterPolicy service-account-requirements + kubernetes.core.k8s: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: kyverno.io/v1 + kind: ClusterPolicy + name: service-account-requirements + state: absent + + - name: Delete ClusterPolicy container-security-controls + kubernetes.core.k8s: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: kyverno.io/v1 + kind: ClusterPolicy + name: container-security-controls + state: absent + + - name: Uninstall Kyverno + ansible.builtin.import_role: + name: tools + tasks_from: uninstall_kyverno.yaml + vars: + tools_cluster: + kubeconfig: "{{ cluster.kubeconfig }}" + platform: "{{ cluster_platform }}" + provider: "{{ cluster_provider }}" + + - name: Remove Kyverno CRDs + ansible.builtin.import_role: + name: tools + tasks_from: remove_custom_resource_definitions.yaml + vars: + tools_cluster: + kubeconfig: "{{ cluster.kubeconfig }}" + platform: "{{ cluster_platform }}" + provider: "{{ cluster_provider }}" diff --git a/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/molecule.yml b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/molecule.yml new file mode 100644 index 000000000..e974b05fb --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/molecule.yml @@ -0,0 +1,27 @@ +--- +dependency: + name: galaxy + +ansible: + env: + ANSIBLE_ROLES_PATH: ../../.. + executor: + backend: ansible-playbook + args: + ansible_playbook: + - --inventory=${MOLECULE_PROJECT_DIRECTORY}/../../../inventory + - --tags=inject_faults,untagged + playbooks: + create: create.yml + converge: converge.yml + destroy: destroy.yml + verify: verify.yml + +scenario: + name: inject_non_compliant_kubernetes_pod_deployment + test_sequence: + - syntax + - create + - converge + - verify + - destroy diff --git a/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/verify.yml b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/verify.yml new file mode 100644 index 000000000..b885e901f --- /dev/null +++ b/scenarios/project/roles/faults/molecule/inject_non_compliant_kubernetes_pod_deployment/verify.yml @@ -0,0 +1,57 @@ +--- +- name: Verify fault injection + hosts: + - localhost + tasks: + - name: Retrieve ClusterPolicy service-account-requirements + kubernetes.core.k8s_info: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: kyverno.io/v1 + kind: ClusterPolicy + name: service-account-requirements + register: faults_policy_sar + + - name: Validate service-account-requirements exists + ansible.builtin.assert: + that: + - faults_policy_sar.resources | ansible.builtin.length == 1 + fail_msg: ClusterPolicy service-account-requirements was not created. Fault injection failed. + success_msg: ClusterPolicy service-account-requirements exists. + + - name: Retrieve ClusterPolicy container-security-controls + kubernetes.core.k8s_info: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: kyverno.io/v1 + kind: ClusterPolicy + name: container-security-controls + register: faults_policy_csc + + - name: Validate container-security-controls exists + ansible.builtin.assert: + that: + - faults_policy_csc.resources | ansible.builtin.length == 1 + fail_msg: ClusterPolicy container-security-controls was not created. Fault injection failed. + success_msg: ClusterPolicy container-security-controls exists. + + - name: Retrieve deployment + kubernetes.core.k8s_info: + kubeconfig: "{{ cluster.kubeconfig }}" + api_version: apps/v1 + kind: Deployment + name: non-compliant-workload + namespace: non-compliant-k8s-pod-deployment-test + register: faults_deployment + + - name: Validate deployment exists + ansible.builtin.assert: + that: + - faults_deployment.resources | ansible.builtin.length == 1 + fail_msg: Deployment was not created. Fault injection failed. + success_msg: Deployment was created. + + - name: Validate deployment has allowPrivilegeEscalation true + ansible.builtin.assert: + that: + - faults_deployment.resources[0].spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation == true + fail_msg: Deployment does not have allowPrivilegeEscalation true. Fault injection failed. + success_msg: Deployment has allowPrivilegeEscalation true. diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/converge.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/converge.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/create.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/create.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/destroy.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/molecule.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/verify.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/verify.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_container_image/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/converge.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/converge.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/create.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/create.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/destroy.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/molecule.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/verify.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/verify.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_node/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/converge.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/converge.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/create.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/create.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/destroy.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/molecule.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/verify.yml b/scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/verify.yml rename to scenarios/project/roles/faults/molecule/inject_nonexistent_kubernetes_workload_persistent_volume_claim/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/converge.yml b/scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/converge.yml rename to scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/create.yml b/scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/create.yml rename to scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/destroy.yml b/scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/molecule.yml b/scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/verify.yml b/scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/verify.yml rename to scenarios/project/roles/faults/molecule/inject_opentelemetry_demo_feature_flag/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/cleanup.yml b/scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/cleanup.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/cleanup.yml rename to scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/cleanup.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/converge.yml b/scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/converge.yml rename to scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/create.yml b/scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/create.yml rename to scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/destroy.yml b/scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/molecule.yml b/scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/verify.yml b/scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/verify.yml rename to scenarios/project/roles/faults/molecule/inject_priority_kubernetes_workload_priority_preemption/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/converge.yml b/scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/converge.yml rename to scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/create.yml b/scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/create.yml rename to scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/destroy.yml b/scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/molecule.yml b/scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/verify.yml b/scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/verify.yml rename to scenarios/project/roles/faults/molecule/inject_scaled_to_zero_kubernetes_workload/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/converge.yml b/scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/converge.yml rename to scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/create.yml b/scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/create.yml rename to scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/destroy.yml b/scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/molecule.yml b/scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/verify.yml b/scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/verify.yml rename to scenarios/project/roles/faults/molecule/inject_strict_mutual_tls_istio_service_mesh_enforcement/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/converge.yml b/scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/converge.yml rename to scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/create.yml b/scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/create.yml rename to scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/destroy.yml b/scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/molecule.yml b/scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/verify.yml b/scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/verify.yml rename to scenarios/project/roles/faults/molecule/inject_traffic_denying_istio_gateway_authorization_policy/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/converge.yml b/scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/converge.yml rename to scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/create.yml b/scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/create.yml rename to scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/destroy.yml b/scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/molecule.yml b/scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/verify.yml b/scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/verify.yml rename to scenarios/project/roles/faults/molecule/inject_unassigned_kubernetes_workload_container_resource_limits/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/converge.yml b/scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/converge.yml rename to scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/create.yml b/scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/create.yml rename to scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/destroy.yml b/scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/molecule.yml b/scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/verify.yml b/scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/verify.yml rename to scenarios/project/roles/faults/molecule/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/converge.yml b/scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/converge.yml rename to scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/create.yml b/scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/create.yml rename to scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/destroy.yml b/scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/molecule.yml b/scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/verify.yml b/scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/verify.yml rename to scenarios/project/roles/faults/molecule/inject_unsupported_architecture_kubernetes_workload_container_image/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/converge.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/converge.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/create.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/create.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/destroy.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/molecule.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/verify.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_changed_password/verify.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_changed_password/verify.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/converge.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/converge.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/converge.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/converge.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/create.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/create.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/create.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/create.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/destroy.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/destroy.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/destroy.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/molecule.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/molecule.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/molecule.yml diff --git a/scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/verify.yml b/scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/verify.yml similarity index 100% rename from scenarios/sre/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/verify.yml rename to scenarios/project/roles/faults/molecule/inject_valkey_workload_out_of_memory/verify.yml diff --git a/scenarios/sre/project/roles/faults/tasks/generate_files.yaml b/scenarios/project/roles/faults/tasks/generate_files.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/generate_files.yaml rename to scenarios/project/roles/faults/tasks/generate_files.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject.yaml b/scenarios/project/roles/faults/tasks/inject.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject.yaml rename to scenarios/project/roles/faults/tasks/inject.yaml diff --git a/scenarios/project/roles/faults/tasks/inject_active_host_network_kubernetes_deployment.yaml b/scenarios/project/roles/faults/tasks/inject_active_host_network_kubernetes_deployment.yaml new file mode 100644 index 000000000..d89d78d05 --- /dev/null +++ b/scenarios/project/roles/faults/tasks/inject_active_host_network_kubernetes_deployment.yaml @@ -0,0 +1,36 @@ +--- +- name: Include fault argument validation tasks + ansible.builtin.include_tasks: + file: validate_fault_arguments.yaml + +- name: Create deployment with active host network + kubernetes.core.k8s: + kubeconfig: "{{ faults_cluster.kubeconfig }}" + resource_definition: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: "{{ fault_args.kubernetesObject.metadata.name }}" + namespace: "{{ fault_args.kubernetesObject.metadata.namespace }}" + spec: + replicas: 1 + selector: + matchLabels: + app: "{{ fault_args.kubernetesObject.metadata.name }}" + template: + metadata: + labels: + app: "{{ fault_args.kubernetesObject.metadata.name }}" + spec: + hostNetwork: true + hostPID: false + hostIPC: false + containers: + - name: worker + image: registry.access.redhat.com/ubi10-minimal:10.2-1785332632@sha256:ceaad73890ea88685eeb1b40a502b7983f2cfac6f1aa10915d1176d51eb90124 + command: + - /bin/sh + args: + - -c + - "sleep infinity" + state: present diff --git a/scenarios/sre/project/roles/faults/tasks/inject_cordoned_kubernetes_worker_node.yaml b/scenarios/project/roles/faults/tasks/inject_cordoned_kubernetes_worker_node.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_cordoned_kubernetes_worker_node.yaml rename to scenarios/project/roles/faults/tasks/inject_cordoned_kubernetes_worker_node.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_corrupted_kubernetes_secret_credentials.yaml b/scenarios/project/roles/faults/tasks/inject_corrupted_kubernetes_secret_credentials.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_corrupted_kubernetes_secret_credentials.yaml rename to scenarios/project/roles/faults/tasks/inject_corrupted_kubernetes_secret_credentials.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml b/scenarios/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml rename to scenarios/project/roles/faults/tasks/inject_crashing_kubernetes_workload_init_container.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_deleted_kubernetes_service.yaml b/scenarios/project/roles/faults/tasks/inject_deleted_kubernetes_service.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_deleted_kubernetes_service.yaml rename to scenarios/project/roles/faults/tasks/inject_deleted_kubernetes_service.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml b/scenarios/project/roles/faults/tasks/inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml rename to scenarios/project/roles/faults/tasks/inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml diff --git a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_inject.yml b/scenarios/project/roles/faults/tasks/inject_enabled_x11_forwarding_rhel9_sshd.yaml similarity index 52% rename from scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_inject.yml rename to scenarios/project/roles/faults/tasks/inject_enabled_x11_forwarding_rhel9_sshd.yaml index 4a3c97760..3e4043947 100644 --- a/scenarios/ciso/3.gen-cis-b-rhel9-ansible-opa/tasks/fault_inject.yml +++ b/scenarios/project/roles/faults/tasks/inject_enabled_x11_forwarding_rhel9_sshd.yaml @@ -1,11 +1,20 @@ +--- +- name: Include fault argument validation tasks + ansible.builtin.include_tasks: + file: validate_fault_arguments.yaml + - name: Enable X11 forwarding in SSH configuration ansible.builtin.lineinfile: path: /etc/ssh/sshd_config regexp: '^X11Forwarding' line: 'X11Forwarding yes' state: present + become: true + delegate_to: "{{ fault_args.virtualMachine.hostname }}" - name: Restart SSH service to apply changes ansible.builtin.service: name: sshd state: restarted + become: true + delegate_to: "{{ fault_args.virtualMachine.hostname }}" diff --git a/scenarios/sre/project/roles/faults/tasks/inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml b/scenarios/project/roles/faults/tasks/inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml rename to scenarios/project/roles/faults/tasks/inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_hanging_kubernetes_workload_init_container.yaml b/scenarios/project/roles/faults/tasks/inject_hanging_kubernetes_workload_init_container.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_hanging_kubernetes_workload_init_container.yaml rename to scenarios/project/roles/faults/tasks/inject_hanging_kubernetes_workload_init_container.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_ingress_port_blocking_network_policy.yaml b/scenarios/project/roles/faults/tasks/inject_ingress_port_blocking_network_policy.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_ingress_port_blocking_network_policy.yaml rename to scenarios/project/roles/faults/tasks/inject_ingress_port_blocking_network_policy.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_insufficient_kubernetes_resource_quota.yaml b/scenarios/project/roles/faults/tasks/inject_insufficient_kubernetes_resource_quota.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_insufficient_kubernetes_resource_quota.yaml rename to scenarios/project/roles/faults/tasks/inject_insufficient_kubernetes_resource_quota.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_insufficient_kubernetes_workload_container_resources.yaml b/scenarios/project/roles/faults/tasks/inject_insufficient_kubernetes_workload_container_resources.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_insufficient_kubernetes_workload_container_resources.yaml rename to scenarios/project/roles/faults/tasks/inject_insufficient_kubernetes_workload_container_resources.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_invalid_kubernetes_service_selector.yaml b/scenarios/project/roles/faults/tasks/inject_invalid_kubernetes_service_selector.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_invalid_kubernetes_service_selector.yaml rename to scenarios/project/roles/faults/tasks/inject_invalid_kubernetes_service_selector.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_invalid_kubernetes_workload_container_command.yaml b/scenarios/project/roles/faults/tasks/inject_invalid_kubernetes_workload_container_command.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_invalid_kubernetes_workload_container_command.yaml rename to scenarios/project/roles/faults/tasks/inject_invalid_kubernetes_workload_container_command.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_kubernetes_api_server_request_surge.yaml b/scenarios/project/roles/faults/tasks/inject_kubernetes_api_server_request_surge.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_kubernetes_api_server_request_surge.yaml rename to scenarios/project/roles/faults/tasks/inject_kubernetes_api_server_request_surge.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_misconfigured_kubernetes_horizontal_pod_autoscaler.yaml b/scenarios/project/roles/faults/tasks/inject_misconfigured_kubernetes_horizontal_pod_autoscaler.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_misconfigured_kubernetes_horizontal_pod_autoscaler.yaml rename to scenarios/project/roles/faults/tasks/inject_misconfigured_kubernetes_horizontal_pod_autoscaler.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_misconfigured_kubernetes_workload_container_readiness_probe.yaml b/scenarios/project/roles/faults/tasks/inject_misconfigured_kubernetes_workload_container_readiness_probe.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_misconfigured_kubernetes_workload_container_readiness_probe.yaml rename to scenarios/project/roles/faults/tasks/inject_misconfigured_kubernetes_workload_container_readiness_probe.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_modified_kubernetes_workload_container_environment_variable.yaml b/scenarios/project/roles/faults/tasks/inject_modified_kubernetes_workload_container_environment_variable.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_modified_kubernetes_workload_container_environment_variable.yaml rename to scenarios/project/roles/faults/tasks/inject_modified_kubernetes_workload_container_environment_variable.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_modified_target_port_kubernetes_service.yaml b/scenarios/project/roles/faults/tasks/inject_modified_target_port_kubernetes_service.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_modified_target_port_kubernetes_service.yaml rename to scenarios/project/roles/faults/tasks/inject_modified_target_port_kubernetes_service.yaml diff --git a/scenarios/project/roles/faults/tasks/inject_non_compliant_kubernetes_pod_deployment.yaml b/scenarios/project/roles/faults/tasks/inject_non_compliant_kubernetes_pod_deployment.yaml new file mode 100644 index 000000000..2082b3eb9 --- /dev/null +++ b/scenarios/project/roles/faults/tasks/inject_non_compliant_kubernetes_pod_deployment.yaml @@ -0,0 +1,82 @@ +--- +- name: Include fault argument validation tasks + ansible.builtin.include_tasks: + file: validate_fault_arguments.yaml + +- name: Apply baseline ClusterPolicy service-account-requirements + kubernetes.core.k8s: + kubeconfig: "{{ faults_cluster.kubeconfig }}" + resource_definition: + apiVersion: kyverno.io/v1 + kind: ClusterPolicy + metadata: + name: service-account-requirements + spec: + rules: + - name: require-non-default-service-account + match: + resources: + kinds: + - Pod + validate: + message: "A non-default service account must be specified." + pattern: + spec: + serviceAccountName: "!default" + state: present + +- name: Apply baseline ClusterPolicy container-security-controls + kubernetes.core.k8s: + kubeconfig: "{{ faults_cluster.kubeconfig }}" + resource_definition: + apiVersion: kyverno.io/v1 + kind: ClusterPolicy + metadata: + name: container-security-controls + spec: + rules: + - name: disallow-privilege-escalation + match: + resources: + kinds: + - Pod + validate: + message: "Privilege escalation is not allowed." + pattern: + spec: + containers: + - (name): "*" + securityContext: + allowPrivilegeEscalation: false + state: present + +- name: Deploy non-compliant Deployment + kubernetes.core.k8s: + kubeconfig: "{{ faults_cluster.kubeconfig }}" + resource_definition: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: "{{ fault_args.kubernetesObject.metadata.name }}" + namespace: "{{ fault_args.kubernetesObject.metadata.namespace }}" + spec: + replicas: 1 + selector: + matchLabels: + app: "{{ fault_args.kubernetesObject.metadata.name }}" + template: + metadata: + labels: + app: "{{ fault_args.kubernetesObject.metadata.name }}" + spec: + containers: + - name: worker + image: registry.access.redhat.com/ubi10-minimal:10.2-1785332632@sha256:ceaad73890ea88685eeb1b40a502b7983f2cfac6f1aa10915d1176d51eb90124 + command: + - /bin/sh + args: + - -c + - "sleep infinity" + securityContext: + allowPrivilegeEscalation: true + state: present diff --git a/scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml b/scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml rename to scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_container_image.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_node.yaml b/scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_node.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_node.yaml rename to scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_node.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_persistent_volume_claim.yaml b/scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_persistent_volume_claim.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_persistent_volume_claim.yaml rename to scenarios/project/roles/faults/tasks/inject_nonexistent_kubernetes_workload_persistent_volume_claim.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_opentelemetry_demo_feature_flag.yaml b/scenarios/project/roles/faults/tasks/inject_opentelemetry_demo_feature_flag.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_opentelemetry_demo_feature_flag.yaml rename to scenarios/project/roles/faults/tasks/inject_opentelemetry_demo_feature_flag.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_priority_kubernetes_workload_priority_preemption.yaml b/scenarios/project/roles/faults/tasks/inject_priority_kubernetes_workload_priority_preemption.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_priority_kubernetes_workload_priority_preemption.yaml rename to scenarios/project/roles/faults/tasks/inject_priority_kubernetes_workload_priority_preemption.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_scaled_to_zero_kubernetes_workload.yaml b/scenarios/project/roles/faults/tasks/inject_scaled_to_zero_kubernetes_workload.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_scaled_to_zero_kubernetes_workload.yaml rename to scenarios/project/roles/faults/tasks/inject_scaled_to_zero_kubernetes_workload.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_scheduled_chaos_mesh_experiment.yaml b/scenarios/project/roles/faults/tasks/inject_scheduled_chaos_mesh_experiment.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_scheduled_chaos_mesh_experiment.yaml rename to scenarios/project/roles/faults/tasks/inject_scheduled_chaos_mesh_experiment.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_strict_mutual_tls_istio_service_mesh_enforcement.yaml b/scenarios/project/roles/faults/tasks/inject_strict_mutual_tls_istio_service_mesh_enforcement.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_strict_mutual_tls_istio_service_mesh_enforcement.yaml rename to scenarios/project/roles/faults/tasks/inject_strict_mutual_tls_istio_service_mesh_enforcement.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_traffic_denying_istio_gateway_authorization_policy.yaml b/scenarios/project/roles/faults/tasks/inject_traffic_denying_istio_gateway_authorization_policy.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_traffic_denying_istio_gateway_authorization_policy.yaml rename to scenarios/project/roles/faults/tasks/inject_traffic_denying_istio_gateway_authorization_policy.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_unassigned_kubernetes_workload_container_resource_limits.yaml b/scenarios/project/roles/faults/tasks/inject_unassigned_kubernetes_workload_container_resource_limits.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_unassigned_kubernetes_workload_container_resource_limits.yaml rename to scenarios/project/roles/faults/tasks/inject_unassigned_kubernetes_workload_container_resource_limits.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule.yaml b/scenarios/project/roles/faults/tasks/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule.yaml rename to scenarios/project/roles/faults/tasks/inject_unschedulable_kubernetes_workload_pod_anti_affinity_rule.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_unsupported_architecture_kubernetes_workload_container_image.yaml b/scenarios/project/roles/faults/tasks/inject_unsupported_architecture_kubernetes_workload_container_image.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_unsupported_architecture_kubernetes_workload_container_image.yaml rename to scenarios/project/roles/faults/tasks/inject_unsupported_architecture_kubernetes_workload_container_image.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_changed_password.yaml b/scenarios/project/roles/faults/tasks/inject_valkey_workload_changed_password.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_changed_password.yaml rename to scenarios/project/roles/faults/tasks/inject_valkey_workload_changed_password.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml b/scenarios/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml rename to scenarios/project/roles/faults/tasks/inject_valkey_workload_out_of_memory.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/main.yaml b/scenarios/project/roles/faults/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/main.yaml rename to scenarios/project/roles/faults/tasks/main.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/remove.yaml b/scenarios/project/roles/faults/tasks/remove.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/remove.yaml rename to scenarios/project/roles/faults/tasks/remove.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/remove_chaos_mesh_schedules.yaml b/scenarios/project/roles/faults/tasks/remove_chaos_mesh_schedules.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/remove_chaos_mesh_schedules.yaml rename to scenarios/project/roles/faults/tasks/remove_chaos_mesh_schedules.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/remove_cluster_scoped_objects.yaml b/scenarios/project/roles/faults/tasks/remove_cluster_scoped_objects.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/remove_cluster_scoped_objects.yaml rename to scenarios/project/roles/faults/tasks/remove_cluster_scoped_objects.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/remove_unschedulable_node_status.yaml b/scenarios/project/roles/faults/tasks/remove_unschedulable_node_status.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/remove_unschedulable_node_status.yaml rename to scenarios/project/roles/faults/tasks/remove_unschedulable_node_status.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/validate_fault_arguments.yaml b/scenarios/project/roles/faults/tasks/validate_fault_arguments.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/validate_fault_arguments.yaml rename to scenarios/project/roles/faults/tasks/validate_fault_arguments.yaml diff --git a/scenarios/sre/project/roles/faults/tasks/validate_worker_nodes.yaml b/scenarios/project/roles/faults/tasks/validate_worker_nodes.yaml similarity index 100% rename from scenarios/sre/project/roles/faults/tasks/validate_worker_nodes.yaml rename to scenarios/project/roles/faults/tasks/validate_worker_nodes.yaml diff --git a/scenarios/sre/project/roles/faults/templates/meta/argument_specs.j2 b/scenarios/project/roles/faults/templates/meta/argument_specs.j2 similarity index 100% rename from scenarios/sre/project/roles/faults/templates/meta/argument_specs.j2 rename to scenarios/project/roles/faults/templates/meta/argument_specs.j2 diff --git a/scenarios/sre/project/roles/faults/templates/tasks/inject_unimplemented.j2 b/scenarios/project/roles/faults/templates/tasks/inject_unimplemented.j2 similarity index 100% rename from scenarios/sre/project/roles/faults/templates/tasks/inject_unimplemented.j2 rename to scenarios/project/roles/faults/templates/tasks/inject_unimplemented.j2 diff --git a/scenarios/sre/project/roles/faults/templates/vars/task_files.j2 b/scenarios/project/roles/faults/templates/vars/task_files.j2 similarity index 100% rename from scenarios/sre/project/roles/faults/templates/vars/task_files.j2 rename to scenarios/project/roles/faults/templates/vars/task_files.j2 diff --git a/scenarios/sre/project/roles/faults/vars/main/task_files.yaml b/scenarios/project/roles/faults/vars/main/task_files.yaml similarity index 92% rename from scenarios/sre/project/roles/faults/vars/main/task_files.yaml rename to scenarios/project/roles/faults/vars/main/task_files.yaml index 69afa8ced..8bf6493aa 100644 --- a/scenarios/sre/project/roles/faults/vars/main/task_files.yaml +++ b/scenarios/project/roles/faults/vars/main/task_files.yaml @@ -1,5 +1,7 @@ --- faults_task_files: + active-host-network-kubernetes-deployment: + injection: inject_active_host_network_kubernetes_deployment.yaml cordoned-kubernetes-worker-node: injection: inject_cordoned_kubernetes_worker_node.yaml corrupted-kubernetes-secret-credentials: @@ -10,6 +12,8 @@ faults_task_files: injection: inject_deleted_kubernetes_service.yaml disabled-istio-ambient-mode-kubernetes-namespace: injection: inject_disabled_istio_ambient_mode_kubernetes_namespace.yaml + enabled-x11-forwarding-rhel9-sshd: + injection: inject_enabled_x11_forwarding_rhel9_sshd.yaml failing-name-resolution-kubernetes-workload-dns-policy: injection: inject_failing_name_resolution_kubernetes_workload_dns_policy.yaml hanging-kubernetes-workload-init-container: @@ -34,6 +38,8 @@ faults_task_files: injection: inject_modified_kubernetes_workload_container_environment_variable.yaml modified-target-port-kubernetes-service: injection: inject_modified_target_port_kubernetes_service.yaml + non-compliant-kubernetes-pod-deployment: + injection: inject_non_compliant_kubernetes_pod_deployment.yaml nonexistent-kubernetes-workload-container-image: injection: inject_nonexistent_kubernetes_workload_container_image.yaml nonexistent-kubernetes-workload-node: diff --git a/scenarios/sre/project/roles/generator/files/library/index/applications.json b/scenarios/project/roles/generator/files/library/index/applications.json similarity index 100% rename from scenarios/sre/project/roles/generator/files/library/index/applications.json rename to scenarios/project/roles/generator/files/library/index/applications.json diff --git a/scenarios/sre/project/roles/generator/files/library/index/faults.json b/scenarios/project/roles/generator/files/library/index/faults.json similarity index 90% rename from scenarios/sre/project/roles/generator/files/library/index/faults.json rename to scenarios/project/roles/generator/files/library/index/faults.json index cbefe6211..e8d01055e 100644 --- a/scenarios/sre/project/roles/generator/files/library/index/faults.json +++ b/scenarios/project/roles/generator/files/library/index/faults.json @@ -1,4 +1,85 @@ [ + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "application": [] + }, + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "This fault deploys a Kubernetes workload with hostNetwork set to true, granting the container access to the host network namespace.", + "expectation": "Kyverno PolicyReport will record a policy failure against the Deployment for violating the disallow-host-namespaces rule.", + "id": "active-host-network-kubernetes-deployment", + "index": 32, + "name": "Active Host Network Kubernetes Deployment", + "platform": "Kubernetes", + "resources": [ + "https://kubernetes.io/docs/concepts/security/pod-security-standards/" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "command": "kubectl -n {{ args.kubernetesObject.metadata.namespace }} delete {{ args.kubernetesObject.kind | lower }} {{ args.kubernetesObject.metadata.name }}", + "text": "Delete the non-compliant Deployment that uses hostNetwork." + }, + { + "text": "Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads." + } + ] + } + ] + }, + "tags": [ + "Compliance", + "Deployment" + ] + }, { "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", "alerts": { @@ -102,6 +183,99 @@ "Performance" ] }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "goldenSignal": [ + "HighRequestErrorRate" + ] + }, + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Secret" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "This fault corrupts a Kubernetes Secret by replacing its data with invalid credentials, simulating real-world incidents where secret rotation failures, registry authentication issues, or Vault access problems cause service outages.", + "expectation": "Workloads that depend on the corrupted Secret will fail to authenticate with external services.", + "id": "corrupted-kubernetes-secret-credentials", + "index": 31, + "name": "Corrupted Kubernetes Secret Credentials", + "platform": "Kubernetes", + "resources": [ + "https://kubernetes.io/docs/concepts/configuration/secret/", + "https://kubernetes.io/docs/tasks/configmap-secret/managing-secret-using-kubectl/", + "https://kubernetes.io/docs/reference/kubernetes-api/config-and-storage-resources/secret-v1/", + "https://kubernetes.io/docs/tasks/debug/debug-application/" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "command": "kubectl -n {{ args.kubernetesObject.metadata.namespace }} get secret {{ args.kubernetesObject.metadata.name }} -o yaml", + "text": "Inspect the corrupted secret to identify the invalid data." + }, + { + "text": "Restore the secret with correct credentials from the credential management system." + } + ] + }, + { + "steps": [ + { + "text": "Rotate the credentials in the external system and update the Kubernetes Secret to match." + } + ] + } + ] + }, + "tags": [ + "Authentication", + "Deployment" + ] + }, { "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", "alerts": { @@ -369,6 +543,56 @@ "Networking" ] }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "application": [] + }, + "arguments": { + "jsonSchema": { + "properties": { + "virtualMachine": { + "properties": { + "hostname": { + "type": "string" + } + }, + "required": [ + "hostname" + ], + "type": "object" + } + }, + "required": [ + "virtualMachine" + ], + "type": "object" + } + }, + "description": "This fault enables X11 forwarding in /etc/ssh/sshd_config on a RHEL9 host, violating the requirement for it to be disabled.", + "expectation": "OPA evaluation of the collected SSH configuration data will return false, indicating the host is non-compliant with the applicable benchmark rule.", + "id": "enabled-x11-forwarding-rhel9-sshd", + "index": 33, + "name": "Enabled X11 Forwarding RHEL9 SSHD", + "platform": "RHEL9", + "resources": [ + "https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/securing_networks/assembly_using-secure-communications-between-two-systems-with-openssh_securing-networks" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "text": "Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service." + } + ] + } + ] + }, + "tags": [ + "Compliance" + ] + }, { "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", "alerts": { @@ -1543,6 +1767,87 @@ "Networking" ] }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", + "alerts": { + "application": [] + }, + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "This fault deploys a Pod that violates active security policies, such as pulling from an untrusted image registry or permitting privilege escalation.", + "expectation": "Policy evaluation will flag the Pod as non-compliant, producing a policy failure result for the target resource.", + "id": "non-compliant-kubernetes-pod-deployment", + "index": 34, + "name": "Non Compliant Kubernetes Pod Deployment", + "platform": "Kubernetes", + "resources": [ + "https://kubernetes.io/docs/concepts/security/pod-security-standards/" + ], + "solutions": { + "templates": [ + { + "steps": [ + { + "command": "kubectl -n {{ args.kubernetesObject.metadata.namespace }} delete {{ args.kubernetesObject.kind | lower }} {{ args.kubernetesObject.metadata.name }}", + "text": "Delete the non-compliant Pod." + }, + { + "text": "Author and apply a policy that enforces the required security controls for the workload." + } + ] + } + ] + }, + "tags": [ + "Compliance", + "Deployment" + ] + }, { "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/fault.json", "alerts": { diff --git a/scenarios/sre/project/roles/generator/files/library/index/scenarios.json b/scenarios/project/roles/generator/files/library/index/scenarios.json similarity index 94% rename from scenarios/sre/project/roles/generator/files/library/index/scenarios.json rename to scenarios/project/roles/generator/files/library/index/scenarios.json index 69794349b..4a47094aa 100644 --- a/scenarios/sre/project/roles/generator/files/library/index/scenarios.json +++ b/scenarios/project/roles/generator/files/library/index/scenarios.json @@ -5014,6 +5014,362 @@ "Performance" ] }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [ + "HighRequestErrorRate" + ], + "category": "sre", + "complexity": "medium", + "description": "This scenario simulates a credential failure by corrupting the Secret used by the OpenTelemetry Demo's `email` service.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "v1", + "kind": "Secret", + "metadata": { + "name": "email-service-secret", + "namespace": "otel-demo" + } + } + }, + "id": "corrupted-kubernetes-secret-credentials" + } + ], + "waitFor": { + "postInjection": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "email", + "namespace": "otel-demo" + } + } + }, + "id": "delete-workload-pods" + } + ] + } + } + ], + "environment": { + "applications": [ + { + "id": "opentelemetry-demo" + } + ] + }, + "id": 63, + "index": 63, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n otel-demo get secret email-service-secret -o yaml", + "text": "Inspect the corrupted secret to identify the invalid data." + }, + { + "text": "Restore the secret with correct credentials from the credential management system." + } + ] + }, + { + "steps": [ + { + "text": "Rotate the credentials in the external system and update the Kubernetes Secret to match." + } + ] + } + ] + ], + "tags": [ + "Authentication", + "Deployment" + ] + }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "medium", + "description": "This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using Kyverno and generate a policy to prevent it.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "active-host-network-kubernetes-deployment" + } + ], + "waitFor": { + "postInjection": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "verify-kyverno-policy-report-creation" + } + ] + } + } + ], + "environment": { + "applications": [] + }, + "id": 64, + "index": 64, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n benchmarks delete deployment backend", + "text": "Delete the non-compliant Deployment that uses hostNetwork." + }, + { + "text": "Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads." + } + ] + } + ] + ], + "states": [ + { + "backend": "kyverno-policy-report", + "expectedResult": "fail", + "resource": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "name": "backend", + "namespace": "benchmarks" + } + } + ], + "tags": [ + "Compliance", + "Deployment" + ] + }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "medium", + "description": "This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using kubectl and OPA and generate a policy to prevent it.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "active-host-network-kubernetes-deployment" + } + ] + } + ], + "environment": { + "applications": [] + }, + "id": 65, + "index": 65, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n benchmarks delete deployment backend", + "text": "Delete the non-compliant Deployment that uses hostNetwork." + }, + { + "text": "Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads." + } + ] + } + ] + ], + "states": [ + { + "backend": "opa-eval", + "expectedResult": "false", + "fetcherType": "bash", + "resource": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "name": "backend", + "namespace": "benchmarks" + } + } + ], + "tags": [ + "Compliance", + "Deployment" + ] + }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "medium", + "description": "This scenario simulates a RHEL9 host with X11 forwarding enabled in the SSH configuration, violating CIS RHEL9 Benchmark 5.2.6. The agent must detect the violation using Ansible and OPA and generate a policy to prevent it.", + "disruptions": [ + { + "injections": [ + { + "args": { + "virtualMachine": { + "hostname": "rhel9-benchmark" + } + }, + "id": "enabled-x11-forwarding-rhel9-sshd" + } + ] + } + ], + "environment": { + "applications": [] + }, + "id": 66, + "index": 66, + "platforms": [ + "RHEL9" + ], + "solutions": [ + [ + { + "steps": [ + { + "text": "Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service." + } + ] + } + ] + ], + "states": [ + { + "backend": "opa-eval", + "expectedResult": "false", + "fetcherType": "ansible-playbook", + "resource": { + "kind": "Host", + "name": "rhel9-benchmark" + } + } + ], + "tags": [ + "Compliance" + ] + }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", + "alerts": [], + "category": "ciso", + "complexity": "high", + "description": "This scenario simulates a Kubernetes cluster with existing Kyverno policies that have gaps in their security controls. The agent must extend the policies to remediate the violations without modifying the existing policy rules.", + "disruptions": [ + { + "injections": [ + { + "args": { + "kubernetesObject": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "metadata": { + "name": "backend", + "namespace": "benchmarks" + } + } + }, + "id": "non-compliant-kubernetes-pod-deployment" + } + ] + } + ], + "environment": { + "applications": [] + }, + "id": 67, + "index": 67, + "platforms": [ + "Kubernetes" + ], + "solutions": [ + [ + { + "steps": [ + { + "command": "kubectl -n benchmarks delete deployment backend", + "text": "Delete the non-compliant Pod." + }, + { + "text": "Author and apply a policy that enforces the required security controls for the workload." + } + ] + } + ] + ], + "states": [ + { + "backend": "kyverno-policy-report", + "expectedResult": "fail", + "policyName": "container-security-controls", + "resource": { + "apiVersion": "apps/v1", + "kind": "Deployment", + "name": "backend", + "namespace": "benchmarks" + } + }, + { + "backend": "policy-unchanged", + "expectedResult": "unchanged", + "policyName": "service-account-requirements" + } + ], + "tags": [ + "Compliance", + "Deployment" + ] + }, { "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/scenario.json", "alerts": [], diff --git a/scenarios/sre/project/roles/generator/files/library/index/waiters.json b/scenarios/project/roles/generator/files/library/index/waiters.json similarity index 77% rename from scenarios/sre/project/roles/generator/files/library/index/waiters.json rename to scenarios/project/roles/generator/files/library/index/waiters.json index 0a571dcef..b5940180a 100644 --- a/scenarios/sre/project/roles/generator/files/library/index/waiters.json +++ b/scenarios/project/roles/generator/files/library/index/waiters.json @@ -193,5 +193,60 @@ "index": 4, "name": "Scale Kubernetes Workload", "platform": "Kubernetes" + }, + { + "$schema": "https://raw.githubusercontent.com/itbench-hub/ITBench/refs/heads/main/schemas/library/index/waiter.json", + "arguments": { + "jsonSchema": { + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" + } + }, + "description": "Verifies that Kyverno has created a PolicyReport scoped to the target Kubernetes workload.", + "id": "verify-kyverno-policy-report-creation", + "index": 5, + "name": "Verify Kyverno Policy Report Creation", + "platform": "Kubernetes" } ] diff --git a/scenarios/sre/project/roles/generator/tasks/generate_fault_index.yaml b/scenarios/project/roles/generator/tasks/generate_fault_index.yaml similarity index 100% rename from scenarios/sre/project/roles/generator/tasks/generate_fault_index.yaml rename to scenarios/project/roles/generator/tasks/generate_fault_index.yaml diff --git a/scenarios/sre/project/roles/generator/tasks/generate_scenario_index.yaml b/scenarios/project/roles/generator/tasks/generate_scenario_index.yaml similarity index 100% rename from scenarios/sre/project/roles/generator/tasks/generate_scenario_index.yaml rename to scenarios/project/roles/generator/tasks/generate_scenario_index.yaml diff --git a/scenarios/sre/project/roles/generator/tasks/main.yaml b/scenarios/project/roles/generator/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/generator/tasks/main.yaml rename to scenarios/project/roles/generator/tasks/main.yaml diff --git a/scenarios/sre/project/roles/generator/vars/main/library_index.yaml b/scenarios/project/roles/generator/vars/main/library_index.yaml similarity index 100% rename from scenarios/sre/project/roles/generator/vars/main/library_index.yaml rename to scenarios/project/roles/generator/vars/main/library_index.yaml diff --git a/scenarios/sre/project/roles/leaderboard/meta/argument_specs.yaml b/scenarios/project/roles/leaderboard/meta/argument_specs.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/meta/argument_specs.yaml rename to scenarios/project/roles/leaderboard/meta/argument_specs.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/create_status.yaml b/scenarios/project/roles/leaderboard/tasks/create_status.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/create_status.yaml rename to scenarios/project/roles/leaderboard/tasks/create_status.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/main.yaml b/scenarios/project/roles/leaderboard/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/main.yaml rename to scenarios/project/roles/leaderboard/tasks/main.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_inject_faults.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_inject_faults.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_inject_faults.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_inject_faults.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_install_applications.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_install_applications.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_install_applications.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_install_applications.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_install_recorders.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_install_recorders.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_install_recorders.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_install_recorders.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_install_tools.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_install_tools.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_install_tools.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_install_tools.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_remove_faults.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_remove_faults.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_remove_faults.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_remove_faults.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_uninstall_applications.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_uninstall_applications.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_uninstall_applications.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_uninstall_applications.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_uninstall_recorders.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_uninstall_recorders.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_uninstall_recorders.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_uninstall_recorders.yaml diff --git a/scenarios/sre/project/roles/leaderboard/tasks/update_status_uninstall_tools.yaml b/scenarios/project/roles/leaderboard/tasks/update_status_uninstall_tools.yaml similarity index 100% rename from scenarios/sre/project/roles/leaderboard/tasks/update_status_uninstall_tools.yaml rename to scenarios/project/roles/leaderboard/tasks/update_status_uninstall_tools.yaml diff --git a/scenarios/sre/project/roles/recorders/files/scripts/clickhouse/gather.py b/scenarios/project/roles/recorders/files/scripts/clickhouse/gather.py similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/clickhouse/gather.py rename to scenarios/project/roles/recorders/files/scripts/clickhouse/gather.py diff --git a/scenarios/sre/project/roles/recorders/files/scripts/clickhouse/requirements.txt b/scenarios/project/roles/recorders/files/scripts/clickhouse/requirements.txt similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/clickhouse/requirements.txt rename to scenarios/project/roles/recorders/files/scripts/clickhouse/requirements.txt diff --git a/scenarios/sre/project/roles/recorders/files/scripts/jaeger/gather.py b/scenarios/project/roles/recorders/files/scripts/jaeger/gather.py similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/jaeger/gather.py rename to scenarios/project/roles/recorders/files/scripts/jaeger/gather.py diff --git a/scenarios/sre/project/roles/recorders/files/scripts/jaeger/requirements.txt b/scenarios/project/roles/recorders/files/scripts/jaeger/requirements.txt similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/jaeger/requirements.txt rename to scenarios/project/roles/recorders/files/scripts/jaeger/requirements.txt diff --git a/scenarios/sre/project/roles/recorders/files/scripts/kubernetes_topology_monitor/gather.py b/scenarios/project/roles/recorders/files/scripts/kubernetes_topology_monitor/gather.py similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/kubernetes_topology_monitor/gather.py rename to scenarios/project/roles/recorders/files/scripts/kubernetes_topology_monitor/gather.py diff --git a/scenarios/sre/project/roles/recorders/files/scripts/kubernetes_topology_monitor/requirements.txt b/scenarios/project/roles/recorders/files/scripts/kubernetes_topology_monitor/requirements.txt similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/kubernetes_topology_monitor/requirements.txt rename to scenarios/project/roles/recorders/files/scripts/kubernetes_topology_monitor/requirements.txt diff --git a/scenarios/sre/project/roles/recorders/files/scripts/prometheus/gather.py b/scenarios/project/roles/recorders/files/scripts/prometheus/gather.py similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/prometheus/gather.py rename to scenarios/project/roles/recorders/files/scripts/prometheus/gather.py diff --git a/scenarios/sre/project/roles/recorders/files/scripts/prometheus/requirements.txt b/scenarios/project/roles/recorders/files/scripts/prometheus/requirements.txt similarity index 100% rename from scenarios/sre/project/roles/recorders/files/scripts/prometheus/requirements.txt rename to scenarios/project/roles/recorders/files/scripts/prometheus/requirements.txt diff --git a/scenarios/sre/project/roles/recorders/meta/argument_specs.yaml b/scenarios/project/roles/recorders/meta/argument_specs.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/meta/argument_specs.yaml rename to scenarios/project/roles/recorders/meta/argument_specs.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/copy_python_recorder_files.yaml b/scenarios/project/roles/recorders/tasks/copy_python_recorder_files.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/copy_python_recorder_files.yaml rename to scenarios/project/roles/recorders/tasks/copy_python_recorder_files.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/deploy_python_recorder.yaml b/scenarios/project/roles/recorders/tasks/deploy_python_recorder.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/deploy_python_recorder.yaml rename to scenarios/project/roles/recorders/tasks/deploy_python_recorder.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/install.yaml b/scenarios/project/roles/recorders/tasks/install.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/install.yaml rename to scenarios/project/roles/recorders/tasks/install.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/install_clickhouse_recorder.yaml b/scenarios/project/roles/recorders/tasks/install_clickhouse_recorder.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/install_clickhouse_recorder.yaml rename to scenarios/project/roles/recorders/tasks/install_clickhouse_recorder.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/install_jaeger_recorder.yaml b/scenarios/project/roles/recorders/tasks/install_jaeger_recorder.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/install_jaeger_recorder.yaml rename to scenarios/project/roles/recorders/tasks/install_jaeger_recorder.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/install_kubernetes_topology_monitor_recorder.yaml b/scenarios/project/roles/recorders/tasks/install_kubernetes_topology_monitor_recorder.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/install_kubernetes_topology_monitor_recorder.yaml rename to scenarios/project/roles/recorders/tasks/install_kubernetes_topology_monitor_recorder.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/install_prometheus_recorder.yaml b/scenarios/project/roles/recorders/tasks/install_prometheus_recorder.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/install_prometheus_recorder.yaml rename to scenarios/project/roles/recorders/tasks/install_prometheus_recorder.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/main.yaml b/scenarios/project/roles/recorders/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/main.yaml rename to scenarios/project/roles/recorders/tasks/main.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/uninstall.yaml b/scenarios/project/roles/recorders/tasks/uninstall.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/uninstall.yaml rename to scenarios/project/roles/recorders/tasks/uninstall.yaml diff --git a/scenarios/sre/project/roles/recorders/tasks/validate_storage.yaml b/scenarios/project/roles/recorders/tasks/validate_storage.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/tasks/validate_storage.yaml rename to scenarios/project/roles/recorders/tasks/validate_storage.yaml diff --git a/scenarios/sre/project/roles/recorders/vars/main/releases.yaml b/scenarios/project/roles/recorders/vars/main/releases.yaml similarity index 100% rename from scenarios/sre/project/roles/recorders/vars/main/releases.yaml rename to scenarios/project/roles/recorders/vars/main/releases.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_1/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_1/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_1/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_1/groundtruth.yaml index f9e39e12b..44ca4ba89 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_1/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_1/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_1/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_1/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_1/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_1/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_1/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_1/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_1/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_1/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_10/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_10/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_10/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_10/groundtruth.yaml index 74201f1b1..2f965b5fc 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_10/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_10/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_10/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_10/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_10/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_10/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_10/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_10/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_10/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_10/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_102/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_102/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_102/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_102/groundtruth.yaml index 3d2e8f695..73144c855 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_102/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_102/groundtruth.yaml @@ -18,6 +18,10 @@ spec: metadata: name: strict-resource-quota namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit resourcequota memory diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_102/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_102/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_102/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_102/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_102/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_102/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_102/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_102/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_105/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_105/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_105/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_105/groundtruth.yaml index 4cdf733cc..1d277bae4 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_105/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_105/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: product-catalog namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/product-catalog diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_105/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_105/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_105/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_105/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_105/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_105/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_105/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_105/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_11/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_11/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_11/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_11/groundtruth.yaml index 8f9093ef9..062f4ba2f 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_11/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_11/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_11/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_11/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_11/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_11/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_11/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_11/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_11/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_11/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_114/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_114/groundtruth.yaml similarity index 89% rename from scenarios/sre/project/roles/scenarios/files/scenario_114/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_114/groundtruth.yaml index 1be533d3d..13ce6a989 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_114/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_114/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: product-catalog namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - text: Create the manifest with the expected values. diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_114/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_114/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_114/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_114/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_114/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_114/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_114/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_114/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_12/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_12/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_12/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_12/groundtruth.yaml index 8d4f6ab50..fb39cdf2f 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_12/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_12/groundtruth.yaml @@ -16,6 +16,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_12/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_12/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_12/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_12/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_12/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_12/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_12/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_12/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_13/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_13/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_13/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_13/groundtruth.yaml index 7cee47ae4..3b0b24992 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_13/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_13/groundtruth.yaml @@ -16,6 +16,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_13/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_13/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_13/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_13/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_13/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_13/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_13/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_13/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_14/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_14/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_14/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_14/groundtruth.yaml index 64ff2407a..82412d434 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_14/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_14/groundtruth.yaml @@ -16,6 +16,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_14/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_14/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_14/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_14/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_14/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_14/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_14/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_14/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_15/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_15/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_15/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_15/groundtruth.yaml index 6fdbfd40d..9f76524bb 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_15/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_15/groundtruth.yaml @@ -16,6 +16,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_15/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_15/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_15/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_15/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_15/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_15/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_15/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_15/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_16/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_16/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_16/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_16/groundtruth.yaml index 1e191795c..d2bd80663 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_16/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_16/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: shipping namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/shipping diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_16/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_16/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_16/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_16/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_16/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_16/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_16/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_16/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_17/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_17/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_17/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_17/groundtruth.yaml index 5fbaefdc7..9a2619faa 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_17/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_17/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: product-catalog-network-delay namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule product-catalog-network-delay experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_17/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_17/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_17/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_17/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_17/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_17/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_17/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_17/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_18/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_18/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_18/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_18/groundtruth.yaml index a7c9ae528..26ca13f57 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_18/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_18/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: otel-demo-product-catalog-network-delay namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule otel-demo-product-catalog-network-delay experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_18/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_18/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_18/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_18/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_18/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_18/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_18/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_18/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_19/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_19/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_19/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_19/groundtruth.yaml index 30b4a2a99..d2fb38ad3 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_19/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_19/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: fraud-detection-kafka-network-partition namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule fraud-detection-kafka-network-partition experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_19/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_19/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_19/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_19/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_19/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_19/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_19/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_19/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_2/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_2/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_2/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_2/groundtruth.yaml index a89c99769..4b7c3cc84 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_2/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_2/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_2/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_2/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_2/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_2/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_2/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_2/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_2/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_2/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_20/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_20/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_20/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_20/groundtruth.yaml index 36d5ed90c..5b7d7b3d9 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_20/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_20/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: product-catalog namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/product-catalog diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_20/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_20/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_20/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_20/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_20/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_20/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_20/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_20/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_21/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_21/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_21/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_21/groundtruth.yaml index be274a329..325520e5c 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_21/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_21/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: valkey-memory-stress namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule valkey-memory-stress experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_21/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_21/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_21/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_21/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_21/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_21/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_21/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_21/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_22/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_22/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_22/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_22/groundtruth.yaml index dc7e6d504..487bb006d 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_22/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_22/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: ad-memory-stress namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule ad-memory-stress experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_22/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_22/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_22/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_22/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_22/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_22/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_22/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_22/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_23/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_23/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_23/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_23/groundtruth.yaml index 340a92e3c..119e25ae6 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_23/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_23/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: checkout namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/checkout diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_23/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_23/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_23/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_23/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_23/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_23/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_23/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_23/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_24/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_24/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_24/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_24/groundtruth.yaml index 38dcc44f7..90d7aa849 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_24/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_24/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: checkout namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/checkout diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_24/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_24/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_24/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_24/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_24/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_24/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_24/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_24/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_25/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_25/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_25/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_25/groundtruth.yaml index b31fd9947..02aef121c 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_25/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_25/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: recommendation-cpu-stress namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule recommendation-cpu-stress experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_25/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_25/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_25/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_25/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_25/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_25/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_25/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_25/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_26/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_26/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_26/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_26/groundtruth.yaml index 34cb9928d..9854dd198 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_26/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_26/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: email-http-chaos-post-body-tamper namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule email-http-chaos-post-body-tamper experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_26/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_26/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_26/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_26/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_26/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_26/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_26/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_26/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_27/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_27/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_27/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_27/groundtruth.yaml index 8c80369a8..62ff07002 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_27/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_27/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: quote-http-chaos-abort namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule quote-http-chaos-abort experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_27/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_27/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_27/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_27/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_27/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_27/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_27/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_27/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_29/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_29/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_29/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_29/groundtruth.yaml index 8aa832687..c0d991bab 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_29/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_29/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: ad-jvm-return namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule ad-jvm-return experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_29/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_29/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_29/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_29/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_29/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_29/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_29/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_29/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_3/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_3/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_3/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_3/groundtruth.yaml index 749de9ec1..4be58d3c1 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_3/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_3/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_3/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_3/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_3/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_3/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_3/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_3/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_3/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_3/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_30/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_30/groundtruth.yaml similarity index 89% rename from scenarios/sre/project/roles/scenarios/files/scenario_30/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_30/groundtruth.yaml index 047d057d2..c04ff51bf 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_30/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_30/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: ad namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit service ad diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_30/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_30/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_30/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_30/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_30/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_30/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_30/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_30/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_31/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_31/groundtruth.yaml similarity index 95% rename from scenarios/sre/project/roles/scenarios/files/scenario_31/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_31/groundtruth.yaml index f4d2a14b8..d37c0beac 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_31/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_31/groundtruth.yaml @@ -20,6 +20,10 @@ spec: metadata: name: frontend-ingress namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo get networkpolicy diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_31/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_31/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_31/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_31/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_31/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_31/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_31/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_31/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_33/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_33/groundtruth.yaml similarity index 95% rename from scenarios/sre/project/roles/scenarios/files/scenario_33/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_33/groundtruth.yaml index 3173f3824..fe0409a95 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_33/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_33/groundtruth.yaml @@ -18,6 +18,10 @@ spec: metadata: name: cart namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/ad diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_33/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_33/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_33/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_33/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_33/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_33/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_33/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_33/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_34/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_34/groundtruth.yaml similarity index 90% rename from scenarios/sre/project/roles/scenarios/files/scenario_34/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_34/groundtruth.yaml index 4a893935c..07035cd54 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_34/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_34/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: valkey-cart namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit secret valkey-credentials diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_34/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_34/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_34/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_34/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_34/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_34/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_34/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_34/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_35/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_35/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_35/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_35/groundtruth.yaml index e0d164a9a..78bd47a84 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_35/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_35/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: ad-jvm-chaos namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule ad-jvm-chaos experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_35/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_35/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_35/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_35/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_35/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_35/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_35/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_35/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_36/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_36/groundtruth.yaml similarity index 89% rename from scenarios/sre/project/roles/scenarios/files/scenario_36/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_36/groundtruth.yaml index 65b520cd3..393f4d8b7 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_36/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_36/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: details namespace: book-info + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n book-info edit service details diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_36/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_36/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_36/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_36/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_36/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_36/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_36/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_36/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_37/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_37/groundtruth.yaml similarity index 70% rename from scenarios/sre/project/roles/scenarios/files/scenario_37/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_37/groundtruth.yaml index 4b24a9098..f5834257c 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_37/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_37/groundtruth.yaml @@ -6,4 +6,8 @@ metadata: spec: alerts: [] entities: [] + kubernetes: + resources: [] + opa: + checks: [] solutions: [] diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_37/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_37/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_37/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_37/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_37/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_37/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_37/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_37/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_38/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_38/groundtruth.yaml similarity index 96% rename from scenarios/sre/project/roles/scenarios/files/scenario_38/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_38/groundtruth.yaml index a87f9787c..b4bb2a762 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_38/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_38/groundtruth.yaml @@ -38,6 +38,10 @@ spec: metadata: name: image-provider namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit horizontalpodautoscaler fraud-detection diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_38/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_38/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_38/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_38/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_38/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_38/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_38/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_38/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_39/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_39/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_39/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_39/groundtruth.yaml index 07b020e2a..5ed667b36 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_39/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_39/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: payment namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/payment diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_39/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_39/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_39/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_39/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_39/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_39/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_39/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_39/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_4/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_4/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_4/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_4/groundtruth.yaml index b6ac1a7a3..be582a2cb 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_4/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_4/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_4/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_4/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_4/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_4/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_4/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_4/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_4/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_4/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_40/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_40/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_40/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_40/groundtruth.yaml index 3b77656a0..b89e673e1 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_40/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_40/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: valkey-cart namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/valkey-cart diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_40/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_40/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_40/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_40/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_40/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_40/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_40/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_40/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_41/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_41/groundtruth.yaml similarity index 96% rename from scenarios/sre/project/roles/scenarios/files/scenario_41/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_41/groundtruth.yaml index c28b05478..910cde211 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_41/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_41/groundtruth.yaml @@ -16,6 +16,10 @@ spec: metadata: name: cart-stress-chaos-memory namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule cart-stress-chaos-memory experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_41/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_41/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_41/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_41/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_41/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_41/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_41/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_41/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_42/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_42/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_42/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_42/groundtruth.yaml index 80d0ee365..f8545ed26 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_42/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_42/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: kafka namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/kafka diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_42/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_42/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_42/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_42/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_42/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_42/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_42/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_42/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_43/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_43/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_43/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_43/groundtruth.yaml index c73d8267f..1d759ea62 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_43/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_43/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: frontend namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit authorizationpolicy frontend-deny diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_43/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_43/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_43/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_43/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_43/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_43/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_43/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_43/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_44/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_44/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_44/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_44/groundtruth.yaml index dce65acef..5b301dea4 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_44/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_44/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: payment namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/payment diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_44/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_44/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_44/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_44/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_44/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_44/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_44/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_44/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_45/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_45/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_45/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_45/groundtruth.yaml index 7d8ce083b..490ddf00e 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_45/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_45/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: email namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/email diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_45/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_45/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_45/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_45/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_45/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_45/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_45/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_45/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_46/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_46/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_46/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_46/groundtruth.yaml index 80f14b203..623019673 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_46/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_46/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: postgresql namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/postgresql diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_46/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_46/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_46/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_46/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_46/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_46/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_46/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_46/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_47/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_47/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_47/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_47/groundtruth.yaml index 8dacc42e6..2ed6477c4 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_47/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_47/groundtruth.yaml @@ -18,6 +18,10 @@ spec: metadata: name: bookinfo-gateway-deny namespace: book-info + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n book-info edit authorizationpolicy bookinfo-gateway-deny diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_47/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_47/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_47/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_47/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_47/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_47/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_47/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_47/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_48/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_48/groundtruth.yaml similarity index 88% rename from scenarios/sre/project/roles/scenarios/files/scenario_48/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_48/groundtruth.yaml index 3d5680ef8..23e2e0e55 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_48/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_48/groundtruth.yaml @@ -12,6 +12,10 @@ spec: kind: Namespace metadata: name: book-info + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n book-info edit namespace book-info-deny diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_48/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_48/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_48/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_48/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_48/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_48/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_48/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_48/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_49/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_49/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_49/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_49/groundtruth.yaml index 8a39bb511..5284df72d 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_49/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_49/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: frontend namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/frontend diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_49/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_49/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_49/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_49/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_49/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_49/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_49/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_49/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_5/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_5/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_5/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_5/groundtruth.yaml index 8dcc10249..6874a2c34 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_5/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_5/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_5/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_5/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_5/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_5/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_5/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_5/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_5/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_5/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_50/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_50/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_50/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_50/groundtruth.yaml index 9956865ec..a6add03c4 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_50/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_50/groundtruth.yaml @@ -18,6 +18,10 @@ spec: metadata: name: strict-mtls-mode namespace: book-info + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n book-info edit deployment productpage-v1 diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_50/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_50/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_50/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_50/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_50/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_50/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_50/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_50/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_51/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_51/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_51/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_51/groundtruth.yaml index 537112afe..a3c0c9114 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_51/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_51/groundtruth.yaml @@ -12,6 +12,10 @@ spec: kind: Namespace metadata: name: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit deployment workload-scanner diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_51/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_51/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_51/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_51/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_52/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_52/groundtruth.yaml similarity index 95% rename from scenarios/sre/project/roles/scenarios/files/scenario_52/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_52/groundtruth.yaml index d47db89fa..ce2beb812 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_52/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_52/groundtruth.yaml @@ -23,6 +23,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit resourcequota memory diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_52/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_52/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_52/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_52/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_52/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_52/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_52/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_52/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_53/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_53/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_53/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_53/groundtruth.yaml index 9cc95d37a..c7cb50b18 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_53/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_53/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: reviews-v3 namespace: book-info + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n book-info rollout undo deployment/reviews-v3 diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_53/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_53/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_53/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_53/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_53/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_53/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_53/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_53/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_54/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_54/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_54/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_54/groundtruth.yaml index 261fd01eb..5c406c2a7 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_54/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_54/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: api-server-memory-stress namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule api-server-memory-stress experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_54/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_54/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_54/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_54/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_55/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_55/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_55/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_55/groundtruth.yaml index 50af4ba4c..1f934fac8 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_55/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_55/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: api-server-memory-stress namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule api-server-memory-stress experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_55/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_55/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_55/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_55/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_56/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_56/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_56/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_56/groundtruth.yaml index 92eec6c99..ac88c2f46 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_56/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_56/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: product-catalog namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/product-catalog diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_56/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_56/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_56/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_56/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_57/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_57/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_57/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_57/groundtruth.yaml index 9cf9e089b..72406cca3 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_57/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_57/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: checkout namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/checkout diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_57/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_57/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_57/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_57/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_58/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_58/groundtruth.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/files/scenario_58/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_58/groundtruth.yaml index 104505849..30ba18a50 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_58/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_58/groundtruth.yaml @@ -15,6 +15,10 @@ spec: metadata: name: accounting namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/accounting diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_58/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_58/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_58/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_58/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_58/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_58/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_58/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_58/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_59/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_59/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_59/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_59/groundtruth.yaml index 58d1d5d46..d9ac279e9 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_59/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_59/groundtruth.yaml @@ -18,6 +18,10 @@ spec: metadata: name: recommendation-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/recommendation diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_59/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_59/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_59/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_59/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_59/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_59/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_59/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_59/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_6/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_6/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_6/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_6/groundtruth.yaml index 41aff90ce..aff845304 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_6/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_6/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_6/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_6/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_6/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_6/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_6/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_6/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_6/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_6/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_60/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_60/groundtruth.yaml similarity index 96% rename from scenarios/sre/project/roles/scenarios/files/scenario_60/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_60/groundtruth.yaml index d866d0fb5..5292fd674 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_60/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_60/groundtruth.yaml @@ -25,6 +25,10 @@ spec: metadata: name: checkout namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo rollout undo deployment/recommendation diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_60/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_60/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_60/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_60/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_61/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_61/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_61/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_61/groundtruth.yaml index 27d5d8b35..6663abca2 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_61/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_61/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: checkout-payment-network-loss namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule checkout-payment-network-loss experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_61/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_61/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_61/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_61/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_61/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_61/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_61/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_61/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_62/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_62/groundtruth.yaml similarity index 95% rename from scenarios/sre/project/roles/scenarios/files/scenario_62/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_62/groundtruth.yaml index f97a984e3..66c8461c4 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_62/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_62/groundtruth.yaml @@ -16,6 +16,10 @@ spec: metadata: name: valkey-cart-network-delay namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule valkey-cart-stress-chaos experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_62/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_62/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_62/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_62/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_62/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_62/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_62/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_62/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_63/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_63/groundtruth.yaml similarity index 92% rename from scenarios/sre/project/roles/scenarios/files/scenario_63/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_63/groundtruth.yaml index c96b887a5..402e1a506 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_63/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_63/groundtruth.yaml @@ -13,6 +13,10 @@ spec: metadata: name: email-service-secret namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo get secret email-service-secret -o yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_63/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_63/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_63/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_63/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_63/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_63/scenario.yaml similarity index 61% rename from scenarios/sre/project/roles/scenarios/files/scenario_63/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_63/scenario.yaml index 3a71f2a01..5e691d23c 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_63/scenario.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_63/scenario.yaml @@ -17,6 +17,16 @@ spec: name: email-service-secret namespace: otel-demo id: corrupted-kubernetes-secret-credentials + waitFor: + postInjection: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: email + namespace: otel-demo + id: delete-workload-pods tools: sre: enabled: true diff --git a/scenarios/project/roles/scenarios/files/scenario_64/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_64/groundtruth.yaml new file mode 100644 index 000000000..e82ecff8e --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_64/groundtruth.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: itbench.io/v2 +kind: GroundTruth +metadata: + name: scenario-64 +spec: + alerts: [] + entities: + - apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + kubernetes: + resources: [] + opa: + checks: [] + solutions: + - - steps: + - command: kubectl -n benchmarks delete deployment backend + text: Delete the non-compliant Deployment that uses hostNetwork. + - text: Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads. diff --git a/scenarios/project/roles/scenarios/files/scenario_64/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_64/scenario.yaml new file mode 100644 index 000000000..42d886cf0 --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_64/scenario.yaml @@ -0,0 +1,30 @@ +--- +apiVersion: itbench.io/v2 +kind: Scenario +metadata: + name: scenario-64 +spec: + applications: + faults: + - injections: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: active-host-network-kubernetes-deployment + waitFor: + postInjection: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: verify-kyverno-policy-report-creation + tools: + ciso: + enabled: true diff --git a/scenarios/project/roles/scenarios/files/scenario_65/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_65/groundtruth.yaml new file mode 100644 index 000000000..57a05cf9a --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_65/groundtruth.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: itbench.io/v2 +kind: GroundTruth +metadata: + name: scenario-65 +spec: + alerts: [] + entities: + - apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + kubernetes: + resources: [] + opa: + checks: [] + solutions: + - - steps: + - command: kubectl -n benchmarks delete deployment backend + text: Delete the non-compliant Deployment that uses hostNetwork. + - text: Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads. diff --git a/scenarios/project/roles/scenarios/files/scenario_65/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_65/scenario.yaml new file mode 100644 index 000000000..ad5d3013c --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_65/scenario.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: itbench.io/v2 +kind: Scenario +metadata: + name: scenario-65 +spec: + applications: + faults: + - injections: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: active-host-network-kubernetes-deployment + tools: + ciso: + enabled: true diff --git a/scenarios/project/roles/scenarios/files/scenario_66/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_66/groundtruth.yaml new file mode 100644 index 000000000..604bb8aff --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_66/groundtruth.yaml @@ -0,0 +1,15 @@ +--- +apiVersion: itbench.io/v2 +kind: GroundTruth +metadata: + name: scenario-66 +spec: + alerts: [] + entities: + kubernetes: + resources: [] + opa: + checks: [] + solutions: + - - steps: + - text: Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service. diff --git a/scenarios/project/roles/scenarios/files/scenario_66/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_66/scenario.yaml new file mode 100644 index 000000000..d5cfd218c --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_66/scenario.yaml @@ -0,0 +1,16 @@ +--- +apiVersion: itbench.io/v2 +kind: Scenario +metadata: + name: scenario-66 +spec: + applications: + faults: + - injections: + - args: + virtualMachine: + hostname: rhel9-benchmark + id: enabled-x11-forwarding-rhel9-sshd + tools: + ciso: + enabled: true diff --git a/scenarios/project/roles/scenarios/files/scenario_67/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_67/groundtruth.yaml new file mode 100644 index 000000000..eab2e4e1b --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_67/groundtruth.yaml @@ -0,0 +1,22 @@ +--- +apiVersion: itbench.io/v2 +kind: GroundTruth +metadata: + name: scenario-67 +spec: + alerts: [] + entities: + - apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + kubernetes: + resources: [] + opa: + checks: [] + solutions: + - - steps: + - command: kubectl -n benchmarks delete deployment backend + text: Delete the non-compliant Pod. + - text: Author and apply a policy that enforces the required security controls for the workload. diff --git a/scenarios/project/roles/scenarios/files/scenario_67/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_67/scenario.yaml new file mode 100644 index 000000000..941034074 --- /dev/null +++ b/scenarios/project/roles/scenarios/files/scenario_67/scenario.yaml @@ -0,0 +1,20 @@ +--- +apiVersion: itbench.io/v2 +kind: Scenario +metadata: + name: scenario-67 +spec: + applications: + faults: + - injections: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: non-compliant-kubernetes-pod-deployment + tools: + ciso: + enabled: true diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_7/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_7/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_7/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_7/groundtruth.yaml index e13290555..37ef55cbf 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_7/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_7/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_7/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_7/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_7/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_7/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_7/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_7/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_7/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_7/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_8/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_8/groundtruth.yaml similarity index 91% rename from scenarios/sre/project/roles/scenarios/files/scenario_8/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_8/groundtruth.yaml index d09e2b870..ed49e0a72 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_8/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_8/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: flagd-config namespace: otel-demo + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n otel-demo edit configmap flagd-config diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_8/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_8/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_8/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_8/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_8/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_8/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_8/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_8/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_80/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_80/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_80/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_80/groundtruth.yaml index 4d3ff6073..585046fab 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_80/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_80/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: fraud-detection-kafka-network-partition namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule fraud-detection-kafka-network-partition experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_80/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_80/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_80/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_80/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_80/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_80/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_80/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_80/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_81/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_81/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_81/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_81/groundtruth.yaml index c23d37904..39cd691ea 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_81/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_81/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: shipping-quote-network-partition namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule shipping-quote-network-partition experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_81/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_81/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_81/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_81/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_81/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_81/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_81/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_81/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_83/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_83/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_83/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_83/groundtruth.yaml index c949a604c..544d773e2 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_83/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_83/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: fraud-detection-kafka-network-partition namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule fraud-detection-kafka-network-partition experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_83/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_83/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_83/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_83/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_83/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_83/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_83/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_83/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_91/groundtruth.yaml b/scenarios/project/roles/scenarios/files/scenario_91/groundtruth.yaml similarity index 94% rename from scenarios/sre/project/roles/scenarios/files/scenario_91/groundtruth.yaml rename to scenarios/project/roles/scenarios/files/scenario_91/groundtruth.yaml index 20079d663..b440543c3 100644 --- a/scenarios/sre/project/roles/scenarios/files/scenario_91/groundtruth.yaml +++ b/scenarios/project/roles/scenarios/files/scenario_91/groundtruth.yaml @@ -11,6 +11,10 @@ spec: metadata: name: fraud-detection-kafka-network-partition namespace: chaos-mesh + kubernetes: + resources: [] + opa: + checks: [] solutions: - - steps: - command: kubectl -n chaos-mesh annotate schedule fraud-detection-kafka-network-partition experiment.chaos-mesh.org/pause='true' diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_91/groundtruth_v1.yaml b/scenarios/project/roles/scenarios/files/scenario_91/groundtruth_v1.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_91/groundtruth_v1.yaml rename to scenarios/project/roles/scenarios/files/scenario_91/groundtruth_v1.yaml diff --git a/scenarios/sre/project/roles/scenarios/files/scenario_91/scenario.yaml b/scenarios/project/roles/scenarios/files/scenario_91/scenario.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/files/scenario_91/scenario.yaml rename to scenarios/project/roles/scenarios/files/scenario_91/scenario.yaml diff --git a/scenarios/sre/project/roles/scenarios/meta/argument_specs.yaml b/scenarios/project/roles/scenarios/meta/argument_specs.yaml similarity index 93% rename from scenarios/sre/project/roles/scenarios/meta/argument_specs.yaml rename to scenarios/project/roles/scenarios/meta/argument_specs.yaml index 7d97341e3..325756a2c 100644 --- a/scenarios/sre/project/roles/scenarios/meta/argument_specs.yaml +++ b/scenarios/project/roles/scenarios/meta/argument_specs.yaml @@ -65,6 +65,11 @@ argument_specs: - 60 - 61 - 62 + - 63 + - 64 + - 65 + - 66 + - 67 - 80 - 81 - 83 diff --git a/scenarios/sre/project/roles/scenarios/tasks/generate_files.yaml b/scenarios/project/roles/scenarios/tasks/generate_files.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/tasks/generate_files.yaml rename to scenarios/project/roles/scenarios/tasks/generate_files.yaml diff --git a/scenarios/sre/project/roles/scenarios/tasks/main.yaml b/scenarios/project/roles/scenarios/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/scenarios/tasks/main.yaml rename to scenarios/project/roles/scenarios/tasks/main.yaml diff --git a/scenarios/sre/project/roles/scenarios/templates/manifests/groundtruth.j2 b/scenarios/project/roles/scenarios/templates/manifests/groundtruth.j2 similarity index 85% rename from scenarios/sre/project/roles/scenarios/templates/manifests/groundtruth.j2 rename to scenarios/project/roles/scenarios/templates/manifests/groundtruth.j2 index 62d285bc5..4e625efcf 100644 --- a/scenarios/sre/project/roles/scenarios/templates/manifests/groundtruth.j2 +++ b/scenarios/project/roles/scenarios/templates/manifests/groundtruth.j2 @@ -13,6 +13,20 @@ spec: labels: {} {% endfor %} {% endif %} +{% if scenario.kubernetes_resources is ansible.builtin.defined and scenario.kubernetes_resources | length > 0 %} + kubernetes: + resources: {{ scenario.kubernetes_resources }} +{% else %} + kubernetes: + resources: [] +{% endif %} +{% if scenario.opa_checks is ansible.builtin.defined and scenario.opa_checks | length > 0 %} + opa: + checks: {{ scenario.opa_checks }} +{% else %} + opa: + checks: [] +{% endif %} {% if scenario.disruptions | ansible.builtin.length == 0 %} entities: [] {% else %} diff --git a/scenarios/sre/project/roles/scenarios/templates/manifests/scenario.j2 b/scenarios/project/roles/scenarios/templates/manifests/scenario.j2 similarity index 87% rename from scenarios/sre/project/roles/scenarios/templates/manifests/scenario.j2 rename to scenarios/project/roles/scenarios/templates/manifests/scenario.j2 index c7e68da2c..079bc5281 100644 --- a/scenarios/sre/project/roles/scenarios/templates/manifests/scenario.j2 +++ b/scenarios/project/roles/scenarios/templates/manifests/scenario.j2 @@ -22,7 +22,10 @@ spec: {% endfor %} faults: {{ scenario.disruptions }} tools: -{% if scenario.category == "finops" %} +{% if scenario.category == "ciso" %} + ciso: + enabled: true +{% elif scenario.category == "finops" %} finops: enabled: true {% elif scenario.category == "sre" %} diff --git a/scenarios/sre/project/roles/scenarios/templates/meta/argument_specs.j2 b/scenarios/project/roles/scenarios/templates/meta/argument_specs.j2 similarity index 100% rename from scenarios/sre/project/roles/scenarios/templates/meta/argument_specs.j2 rename to scenarios/project/roles/scenarios/templates/meta/argument_specs.j2 diff --git a/scenarios/sre/project/roles/tools/defaults/main/sources.yaml b/scenarios/project/roles/tools/defaults/main/sources.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/defaults/main/sources.yaml rename to scenarios/project/roles/tools/defaults/main/sources.yaml diff --git a/scenarios/sre/project/roles/tools/meta/argument_specs.yaml b/scenarios/project/roles/tools/meta/argument_specs.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/meta/argument_specs.yaml rename to scenarios/project/roles/tools/meta/argument_specs.yaml diff --git a/scenarios/sre/project/roles/tools/molecule/external_endpoints/converge.yml b/scenarios/project/roles/tools/molecule/external_endpoints/converge.yml similarity index 100% rename from scenarios/sre/project/roles/tools/molecule/external_endpoints/converge.yml rename to scenarios/project/roles/tools/molecule/external_endpoints/converge.yml diff --git a/scenarios/sre/project/roles/tools/molecule/external_endpoints/create.yml b/scenarios/project/roles/tools/molecule/external_endpoints/create.yml similarity index 100% rename from scenarios/sre/project/roles/tools/molecule/external_endpoints/create.yml rename to scenarios/project/roles/tools/molecule/external_endpoints/create.yml diff --git a/scenarios/sre/project/roles/tools/molecule/external_endpoints/destroy.yml b/scenarios/project/roles/tools/molecule/external_endpoints/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/tools/molecule/external_endpoints/destroy.yml rename to scenarios/project/roles/tools/molecule/external_endpoints/destroy.yml diff --git a/scenarios/sre/project/roles/tools/molecule/external_endpoints/molecule.yml b/scenarios/project/roles/tools/molecule/external_endpoints/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/tools/molecule/external_endpoints/molecule.yml rename to scenarios/project/roles/tools/molecule/external_endpoints/molecule.yml diff --git a/scenarios/sre/project/roles/tools/molecule/external_endpoints/verify.yml b/scenarios/project/roles/tools/molecule/external_endpoints/verify.yml similarity index 100% rename from scenarios/sre/project/roles/tools/molecule/external_endpoints/verify.yml rename to scenarios/project/roles/tools/molecule/external_endpoints/verify.yml diff --git a/scenarios/sre/project/roles/tools/tasks/configure_prometheus_remote_write.yaml b/scenarios/project/roles/tools/tasks/configure_prometheus_remote_write.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/configure_prometheus_remote_write.yaml rename to scenarios/project/roles/tools/tasks/configure_prometheus_remote_write.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install.yaml b/scenarios/project/roles/tools/tasks/install.yaml similarity index 94% rename from scenarios/sre/project/roles/tools/tasks/install.yaml rename to scenarios/project/roles/tools/tasks/install.yaml index f0a5a23a3..09e348c24 100644 --- a/scenarios/sre/project/roles/tools/tasks/install.yaml +++ b/scenarios/project/roles/tools/tasks/install.yaml @@ -9,6 +9,14 @@ when: - tools_cluster.provider == 'kind' +- name: Install CISO Tools + when: + - tools_configuration.ciso.enabled | ansible.builtin.default(false) + block: + - name: Import Kyverno installation tasks + ansible.builtin.import_tasks: + file: install_kyverno.yaml + - name: Install SRE and FinOps Tools when: - ((tools_configuration.finops.enabled | ansible.builtin.default(false)) or (tools_configuration.sre.enabled | ansible.builtin.default(false))) diff --git a/scenarios/sre/project/roles/tools/tasks/install_cert_manager.yaml b/scenarios/project/roles/tools/tasks/install_cert_manager.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_cert_manager.yaml rename to scenarios/project/roles/tools/tasks/install_cert_manager.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_chaos_mesh.yaml b/scenarios/project/roles/tools/tasks/install_chaos_mesh.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_chaos_mesh.yaml rename to scenarios/project/roles/tools/tasks/install_chaos_mesh.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_clickhouse.yaml b/scenarios/project/roles/tools/tasks/install_clickhouse.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_clickhouse.yaml rename to scenarios/project/roles/tools/tasks/install_clickhouse.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_clickhouse_instances.yaml b/scenarios/project/roles/tools/tasks/install_clickhouse_instances.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_clickhouse_instances.yaml rename to scenarios/project/roles/tools/tasks/install_clickhouse_instances.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_clickhouse_operator.yaml b/scenarios/project/roles/tools/tasks/install_clickhouse_operator.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_clickhouse_operator.yaml rename to scenarios/project/roles/tools/tasks/install_clickhouse_operator.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_istio.yaml b/scenarios/project/roles/tools/tasks/install_istio.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_istio.yaml rename to scenarios/project/roles/tools/tasks/install_istio.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_kubernetes_gateway.yaml b/scenarios/project/roles/tools/tasks/install_kubernetes_gateway.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_kubernetes_gateway.yaml rename to scenarios/project/roles/tools/tasks/install_kubernetes_gateway.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_kubernetes_gateway_api.yaml b/scenarios/project/roles/tools/tasks/install_kubernetes_gateway_api.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_kubernetes_gateway_api.yaml rename to scenarios/project/roles/tools/tasks/install_kubernetes_gateway_api.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_kubernetes_gateway_instances.yaml b/scenarios/project/roles/tools/tasks/install_kubernetes_gateway_instances.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_kubernetes_gateway_instances.yaml rename to scenarios/project/roles/tools/tasks/install_kubernetes_gateway_instances.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_kubernetes_metrics_server.yaml b/scenarios/project/roles/tools/tasks/install_kubernetes_metrics_server.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_kubernetes_metrics_server.yaml rename to scenarios/project/roles/tools/tasks/install_kubernetes_metrics_server.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_kubernetes_topology_monitor.yaml b/scenarios/project/roles/tools/tasks/install_kubernetes_topology_monitor.yaml similarity index 90% rename from scenarios/sre/project/roles/tools/tasks/install_kubernetes_topology_monitor.yaml rename to scenarios/project/roles/tools/tasks/install_kubernetes_topology_monitor.yaml index 726e7fcd5..9ff8feeb3 100644 --- a/scenarios/sre/project/roles/tools/tasks/install_kubernetes_topology_monitor.yaml +++ b/scenarios/project/roles/tools/tasks/install_kubernetes_topology_monitor.yaml @@ -27,7 +27,7 @@ - name: Install Kubernetes Topology Monitor kubernetes.core.helm: - chart_ref: "{{ tools_temporary_directory.path }}/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor" + chart_ref: "{{ tools_temporary_directory.path }}/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor" kubeconfig: "{{ tools_cluster.kubeconfig }}" release_name: "{{ tools_releases.kubernetes_topology_monitor.name }}" release_namespace: "{{ tools_releases.kubernetes_topology_monitor.namespace }}" diff --git a/scenarios/project/roles/tools/tasks/install_kyverno.yaml b/scenarios/project/roles/tools/tasks/install_kyverno.yaml new file mode 100644 index 000000000..a3fa8549f --- /dev/null +++ b/scenarios/project/roles/tools/tasks/install_kyverno.yaml @@ -0,0 +1,86 @@ +--- +- name: Create Namespace for Kyverno + kubernetes.core.k8s: + kubeconfig: "{{ tools_cluster.kubeconfig }}" + resource_definition: + apiVersion: v1 + kind: Namespace + metadata: + labels: + "prometheus.itbench.io/monitor": "true" + name: "{{ tools_releases.kyverno.namespace }}" + state: present + +- name: Install Kyverno + kubernetes.core.helm: + chart_ref: "oci://ghcr.io/kyverno/charts/kyverno" + chart_version: "3.8.2" + kubeconfig: "{{ tools_cluster.kubeconfig }}" + release_name: "{{ tools_releases.kyverno.name }}" + release_namespace: "{{ tools_releases.kyverno.namespace }}" + timeout: 10m0s + values: + admissionController: + rbac: + clusterRole: + extraResources: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - delete + backgroundController: + rbac: + clusterRole: + extraResources: + - apiGroups: + - "" + resources: + - secrets + verbs: + - get + - list + - watch + - create + - update + - delete + config: + webhooks: + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: NotIn + values: + - kube-public + - kyverno + resourceFilters: + - "[*/*,kyverno,*]" + - "[Event,*,*]" + - "[*/*,kube-public,*]" + - "[*/*,kube-node-lease,*]" + - "[Node,*,*]" + - "[Node/?*,*,*]" + - "[APIService,*,*]" + - "[APIService/?*,*,*]" + - "[TokenReview,*,*]" + - "[SubjectAccessReview,*,*]" + - "[SelfSubjectAccessReview,*,*]" + - "[Binding,*,*]" + - "[Pod/binding,*,*]" + - "[ReplicaSet,*,*]" + - "[ReplicaSet/?*,*,*]" + excludeKyvernoNamespace: true + webhooks: + namespaceSelector: + matchExpressions: + - key: kubernetes.io/metadata.name + operator: NotIn + values: + - kube-public + wait: true diff --git a/scenarios/sre/project/roles/tools/tasks/install_opencost.yaml b/scenarios/project/roles/tools/tasks/install_opencost.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_opencost.yaml rename to scenarios/project/roles/tools/tasks/install_opencost.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_opensearch.yaml b/scenarios/project/roles/tools/tasks/install_opensearch.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_opensearch.yaml rename to scenarios/project/roles/tools/tasks/install_opensearch.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_openshift_routes.yaml b/scenarios/project/roles/tools/tasks/install_openshift_routes.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_openshift_routes.yaml rename to scenarios/project/roles/tools/tasks/install_openshift_routes.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_opentelemetry.yaml b/scenarios/project/roles/tools/tasks/install_opentelemetry.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_opentelemetry.yaml rename to scenarios/project/roles/tools/tasks/install_opentelemetry.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_opentelemetry_collectors.yaml b/scenarios/project/roles/tools/tasks/install_opentelemetry_collectors.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_opentelemetry_collectors.yaml rename to scenarios/project/roles/tools/tasks/install_opentelemetry_collectors.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_opentelemetry_operator.yaml b/scenarios/project/roles/tools/tasks/install_opentelemetry_operator.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_opentelemetry_operator.yaml rename to scenarios/project/roles/tools/tasks/install_opentelemetry_operator.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/install_prometheus.yaml b/scenarios/project/roles/tools/tasks/install_prometheus.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/install_prometheus.yaml rename to scenarios/project/roles/tools/tasks/install_prometheus.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/main.yaml b/scenarios/project/roles/tools/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/main.yaml rename to scenarios/project/roles/tools/tasks/main.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/remove_custom_resource_definitions.yaml b/scenarios/project/roles/tools/tasks/remove_custom_resource_definitions.yaml similarity index 89% rename from scenarios/sre/project/roles/tools/tasks/remove_custom_resource_definitions.yaml rename to scenarios/project/roles/tools/tasks/remove_custom_resource_definitions.yaml index 23b929c10..74c9ddd48 100644 --- a/scenarios/sre/project/roles/tools/tasks/remove_custom_resource_definitions.yaml +++ b/scenarios/project/roles/tools/tasks/remove_custom_resource_definitions.yaml @@ -51,6 +51,21 @@ when: - definitions | ansible.builtin.length > 0 +- name: Delete Kyverno related CustomResourceDefinitions + kubernetes.core.k8s: + kubeconfig: "{{ tools_cluster.kubeconfig }}" + resource_definition: "{{ definitions }}" + state: absent + wait: true + vars: + definitions: |- + {{ + tools_custom_resource_definitions.resources | + ansible.builtin.selectattr("spec.group", "search", "(kyverno\.io|wgpolicyk8s\.io)$") + }} + when: + - definitions | ansible.builtin.length > 0 + - name: Remove CustomResourceDefinitions not managed by OpenShift when: - tools_cluster.platform == "kubernetes" diff --git a/scenarios/sre/project/roles/tools/tasks/set_credentials_clickhouse.yaml b/scenarios/project/roles/tools/tasks/set_credentials_clickhouse.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_credentials_clickhouse.yaml rename to scenarios/project/roles/tools/tasks/set_credentials_clickhouse.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_credentials_prometheus.yaml b/scenarios/project/roles/tools/tasks/set_credentials_prometheus.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_credentials_prometheus.yaml rename to scenarios/project/roles/tools/tasks/set_credentials_prometheus.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_external_endpoints.yaml b/scenarios/project/roles/tools/tasks/set_external_endpoints.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_external_endpoints.yaml rename to scenarios/project/roles/tools/tasks/set_external_endpoints.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_external_endpoints_clickhouse.yaml b/scenarios/project/roles/tools/tasks/set_external_endpoints_clickhouse.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_external_endpoints_clickhouse.yaml rename to scenarios/project/roles/tools/tasks/set_external_endpoints_clickhouse.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_external_endpoints_jaeger.yaml b/scenarios/project/roles/tools/tasks/set_external_endpoints_jaeger.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_external_endpoints_jaeger.yaml rename to scenarios/project/roles/tools/tasks/set_external_endpoints_jaeger.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_external_endpoints_kubernetes_topology_monitor.yaml b/scenarios/project/roles/tools/tasks/set_external_endpoints_kubernetes_topology_monitor.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_external_endpoints_kubernetes_topology_monitor.yaml rename to scenarios/project/roles/tools/tasks/set_external_endpoints_kubernetes_topology_monitor.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_external_endpoints_opencost.yaml b/scenarios/project/roles/tools/tasks/set_external_endpoints_opencost.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_external_endpoints_opencost.yaml rename to scenarios/project/roles/tools/tasks/set_external_endpoints_opencost.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_external_endpoints_prometheus.yaml b/scenarios/project/roles/tools/tasks/set_external_endpoints_prometheus.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_external_endpoints_prometheus.yaml rename to scenarios/project/roles/tools/tasks/set_external_endpoints_prometheus.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_internal_endpoints.yaml b/scenarios/project/roles/tools/tasks/set_internal_endpoints.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_internal_endpoints.yaml rename to scenarios/project/roles/tools/tasks/set_internal_endpoints.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_clickhouse.yaml b/scenarios/project/roles/tools/tasks/set_internal_endpoints_clickhouse.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_clickhouse.yaml rename to scenarios/project/roles/tools/tasks/set_internal_endpoints_clickhouse.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_jaeger.yaml b/scenarios/project/roles/tools/tasks/set_internal_endpoints_jaeger.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_jaeger.yaml rename to scenarios/project/roles/tools/tasks/set_internal_endpoints_jaeger.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_kubernetes_topology_monitor.yaml b/scenarios/project/roles/tools/tasks/set_internal_endpoints_kubernetes_topology_monitor.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_kubernetes_topology_monitor.yaml rename to scenarios/project/roles/tools/tasks/set_internal_endpoints_kubernetes_topology_monitor.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_prometheus.yaml b/scenarios/project/roles/tools/tasks/set_internal_endpoints_prometheus.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/set_internal_endpoints_prometheus.yaml rename to scenarios/project/roles/tools/tasks/set_internal_endpoints_prometheus.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall.yaml b/scenarios/project/roles/tools/tasks/uninstall.yaml similarity index 89% rename from scenarios/sre/project/roles/tools/tasks/uninstall.yaml rename to scenarios/project/roles/tools/tasks/uninstall.yaml index 1962f8d6c..0205f9380 100644 --- a/scenarios/sre/project/roles/tools/tasks/uninstall.yaml +++ b/scenarios/project/roles/tools/tasks/uninstall.yaml @@ -45,6 +45,12 @@ ansible.builtin.import_tasks: file: uninstall_kubernetes_gateway.yaml +- name: Import Kyverno uninstallation tasks + ansible.builtin.import_tasks: + file: uninstall_kyverno.yaml + when: + - tools_configuration.ciso.enabled | ansible.builtin.default(false) + - name: Import Custom Resource Definition removal tasks ansible.builtin.import_tasks: file: remove_custom_resource_definitions.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_cert_manager.yaml b/scenarios/project/roles/tools/tasks/uninstall_cert_manager.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_cert_manager.yaml rename to scenarios/project/roles/tools/tasks/uninstall_cert_manager.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_chaos_mesh.yaml b/scenarios/project/roles/tools/tasks/uninstall_chaos_mesh.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_chaos_mesh.yaml rename to scenarios/project/roles/tools/tasks/uninstall_chaos_mesh.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_clickhouse.yaml b/scenarios/project/roles/tools/tasks/uninstall_clickhouse.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_clickhouse.yaml rename to scenarios/project/roles/tools/tasks/uninstall_clickhouse.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_clickhouse_instances.yaml b/scenarios/project/roles/tools/tasks/uninstall_clickhouse_instances.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_clickhouse_instances.yaml rename to scenarios/project/roles/tools/tasks/uninstall_clickhouse_instances.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_clickhouse_operator.yaml b/scenarios/project/roles/tools/tasks/uninstall_clickhouse_operator.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_clickhouse_operator.yaml rename to scenarios/project/roles/tools/tasks/uninstall_clickhouse_operator.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_istio.yaml b/scenarios/project/roles/tools/tasks/uninstall_istio.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_istio.yaml rename to scenarios/project/roles/tools/tasks/uninstall_istio.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_gateway.yaml b/scenarios/project/roles/tools/tasks/uninstall_kubernetes_gateway.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_gateway.yaml rename to scenarios/project/roles/tools/tasks/uninstall_kubernetes_gateway.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_gateway_instances.yaml b/scenarios/project/roles/tools/tasks/uninstall_kubernetes_gateway_instances.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_gateway_instances.yaml rename to scenarios/project/roles/tools/tasks/uninstall_kubernetes_gateway_instances.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_metrics_server.yaml b/scenarios/project/roles/tools/tasks/uninstall_kubernetes_metrics_server.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_metrics_server.yaml rename to scenarios/project/roles/tools/tasks/uninstall_kubernetes_metrics_server.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_topology_monitor.yaml b/scenarios/project/roles/tools/tasks/uninstall_kubernetes_topology_monitor.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_kubernetes_topology_monitor.yaml rename to scenarios/project/roles/tools/tasks/uninstall_kubernetes_topology_monitor.yaml diff --git a/scenarios/project/roles/tools/tasks/uninstall_kyverno.yaml b/scenarios/project/roles/tools/tasks/uninstall_kyverno.yaml new file mode 100644 index 000000000..863e0353c --- /dev/null +++ b/scenarios/project/roles/tools/tasks/uninstall_kyverno.yaml @@ -0,0 +1,19 @@ +--- +- name: Uninstall Kyverno + kubernetes.core.helm: + kubeconfig: "{{ tools_cluster.kubeconfig }}" + release_name: "{{ tools_releases.kyverno.name }}" + release_namespace: "{{ tools_releases.kyverno.namespace }}" + release_state: absent + wait: true + +- name: Delete Kyverno namespace + kubernetes.core.k8s: + kubeconfig: "{{ tools_cluster.kubeconfig }}" + resource_definition: + api_version: v1 + kind: Namespace + metadata: + name: "{{ tools_releases.kyverno.namespace }}" + state: absent + wait: true diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_opencost.yaml b/scenarios/project/roles/tools/tasks/uninstall_opencost.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_opencost.yaml rename to scenarios/project/roles/tools/tasks/uninstall_opencost.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_opensearch.yaml b/scenarios/project/roles/tools/tasks/uninstall_opensearch.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_opensearch.yaml rename to scenarios/project/roles/tools/tasks/uninstall_opensearch.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_opentelemetry.yaml b/scenarios/project/roles/tools/tasks/uninstall_opentelemetry.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_opentelemetry.yaml rename to scenarios/project/roles/tools/tasks/uninstall_opentelemetry.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_opentelemetry_collectors.yaml b/scenarios/project/roles/tools/tasks/uninstall_opentelemetry_collectors.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_opentelemetry_collectors.yaml rename to scenarios/project/roles/tools/tasks/uninstall_opentelemetry_collectors.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_opentelemetry_operator.yaml b/scenarios/project/roles/tools/tasks/uninstall_opentelemetry_operator.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_opentelemetry_operator.yaml rename to scenarios/project/roles/tools/tasks/uninstall_opentelemetry_operator.yaml diff --git a/scenarios/sre/project/roles/tools/tasks/uninstall_prometheus.yaml b/scenarios/project/roles/tools/tasks/uninstall_prometheus.yaml similarity index 100% rename from scenarios/sre/project/roles/tools/tasks/uninstall_prometheus.yaml rename to scenarios/project/roles/tools/tasks/uninstall_prometheus.yaml diff --git a/scenarios/sre/project/roles/tools/templates/helm/chaos_mesh/values.j2 b/scenarios/project/roles/tools/templates/helm/chaos_mesh/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/chaos_mesh/values.j2 rename to scenarios/project/roles/tools/templates/helm/chaos_mesh/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/helm/istio_base/values.j2 b/scenarios/project/roles/tools/templates/helm/istio_base/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/istio_base/values.j2 rename to scenarios/project/roles/tools/templates/helm/istio_base/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/helm/istio_cni/values.j2 b/scenarios/project/roles/tools/templates/helm/istio_cni/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/istio_cni/values.j2 rename to scenarios/project/roles/tools/templates/helm/istio_cni/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/helm/istio_istiod/values.j2 b/scenarios/project/roles/tools/templates/helm/istio_istiod/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/istio_istiod/values.j2 rename to scenarios/project/roles/tools/templates/helm/istio_istiod/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/helm/istio_ztunnel/values.j2 b/scenarios/project/roles/tools/templates/helm/istio_ztunnel/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/istio_ztunnel/values.j2 rename to scenarios/project/roles/tools/templates/helm/istio_ztunnel/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/helm/opencost/values.j2 b/scenarios/project/roles/tools/templates/helm/opencost/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/opencost/values.j2 rename to scenarios/project/roles/tools/templates/helm/opencost/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/helm/opensearch/values.j2 b/scenarios/project/roles/tools/templates/helm/opensearch/values.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/helm/opensearch/values.j2 rename to scenarios/project/roles/tools/templates/helm/opensearch/values.j2 diff --git a/scenarios/sre/project/roles/tools/templates/kubernetes/opencost/namespace.j2 b/scenarios/project/roles/tools/templates/kubernetes/opencost/namespace.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/kubernetes/opencost/namespace.j2 rename to scenarios/project/roles/tools/templates/kubernetes/opencost/namespace.j2 diff --git a/scenarios/sre/project/roles/tools/templates/kubernetes/opencost/prometheusrules.j2 b/scenarios/project/roles/tools/templates/kubernetes/opencost/prometheusrules.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/kubernetes/opencost/prometheusrules.j2 rename to scenarios/project/roles/tools/templates/kubernetes/opencost/prometheusrules.j2 diff --git a/scenarios/sre/project/roles/tools/templates/kubernetes/opensearch/namespace.j2 b/scenarios/project/roles/tools/templates/kubernetes/opensearch/namespace.j2 similarity index 100% rename from scenarios/sre/project/roles/tools/templates/kubernetes/opensearch/namespace.j2 rename to scenarios/project/roles/tools/templates/kubernetes/opensearch/namespace.j2 diff --git a/scenarios/sre/project/roles/tools/vars/main/releases.yaml b/scenarios/project/roles/tools/vars/main/releases.yaml similarity index 97% rename from scenarios/sre/project/roles/tools/vars/main/releases.yaml rename to scenarios/project/roles/tools/vars/main/releases.yaml index ff58d09c7..0b8f6c640 100644 --- a/scenarios/sre/project/roles/tools/vars/main/releases.yaml +++ b/scenarios/project/roles/tools/vars/main/releases.yaml @@ -1,5 +1,8 @@ --- tools_releases: + kyverno: + name: kyverno + namespace: kyverno cert_manager: name: cert-manager namespace: cert-manager diff --git a/scenarios/project/roles/virtual_machine/molecule/grant_access/converge.yml b/scenarios/project/roles/virtual_machine/molecule/grant_access/converge.yml new file mode 100644 index 000000000..353fca84f --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/grant_access/converge.yml @@ -0,0 +1,24 @@ +--- +- name: Run virtual_machine grant access tasks + hosts: + - localhost + tasks: + - name: Add container to inventory + ansible.builtin.add_host: + name: virtual-machine-test + ansible_connection: community.docker.docker + + - name: Import virtual_machine role + ansible.builtin.import_role: + name: virtual_machine + vars: + virtual_machine: + host: virtual-machine-test + python_interpreter: /usr/bin/python3 + username: root + ssh_key: "" + virtual_machine_user: ansible-test + virtual_machine_password: test-password # pragma: allowlist secret + virtual_machine_storage: + local: + directory: "{{ working_directory }}" diff --git a/scenarios/project/roles/virtual_machine/molecule/grant_access/create.yml b/scenarios/project/roles/virtual_machine/molecule/grant_access/create.yml new file mode 100644 index 000000000..c8f96e4f6 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/grant_access/create.yml @@ -0,0 +1,32 @@ +--- +- name: Create test container and working directory + hosts: + - localhost + pre_tasks: + - name: Import docker validation tasks + ansible.builtin.import_role: + name: executables + tasks_from: validate_docker.yaml + + tasks: + - name: Create working directory + ansible.builtin.file: + mode: "0755" + path: "{{ working_directory }}" + state: directory + + - name: Start UBI9 container with systemd + community.docker.docker_container: + name: virtual-machine-test + image: registry.access.redhat.com/ubi9/ubi@sha256:9d99826a5299a54fa92e9b47d74e6cd72efb04cb57eb8fe748ed93e08ebb6184 + command: /sbin/init + privileged: true + state: started + cgroupns_mode: host + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + + - name: Add container to inventory + ansible.builtin.add_host: + name: virtual-machine-test + ansible_connection: community.docker.docker diff --git a/scenarios/project/roles/virtual_machine/molecule/grant_access/destroy.yml b/scenarios/project/roles/virtual_machine/molecule/grant_access/destroy.yml new file mode 100644 index 000000000..6d112f7a8 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/grant_access/destroy.yml @@ -0,0 +1,15 @@ +--- +- name: Destroy test container and working directory + hosts: + - localhost + tasks: + - name: Remove container + community.docker.docker_container: + name: virtual-machine-test + state: absent + force_kill: true + + - name: Delete working directory + ansible.builtin.file: + path: "{{ working_directory }}" + state: absent diff --git a/scenarios/project/roles/virtual_machine/molecule/grant_access/molecule.yml b/scenarios/project/roles/virtual_machine/molecule/grant_access/molecule.yml new file mode 100644 index 000000000..b86d90a47 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/grant_access/molecule.yml @@ -0,0 +1,28 @@ +--- +dependency: + name: galaxy + +ansible: + env: + ANSIBLE_ROLES_PATH: ../../.. + executor: + backend: ansible-playbook + args: + ansible_playbook: + - --inventory=${MOLECULE_PROJECT_DIRECTORY}/../../../inventory + - --tags=grant_access,untagged + - --extra-vars=working_directory=${MOLECULE_PROJECT_DIRECTORY}/test_data + playbooks: + create: create.yml + converge: converge.yml + destroy: destroy.yml + verify: verify.yml + +scenario: + name: grant_access + test_sequence: + - syntax + - create + - converge + - verify + - destroy diff --git a/scenarios/project/roles/virtual_machine/molecule/grant_access/verify.yml b/scenarios/project/roles/virtual_machine/molecule/grant_access/verify.yml new file mode 100644 index 000000000..4654ae5d0 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/grant_access/verify.yml @@ -0,0 +1,70 @@ +--- +- name: Verify grant access succeeded + hosts: + - localhost + tasks: + - name: Validate private key was fetched to local storage + ansible.builtin.assert: + that: + - "[working_directory, 'id_rsa'] | ansible.builtin.path_join is ansible.builtin.file" + fail_msg: Private key was not fetched to local storage. + success_msg: Private key exists in local storage. + + - name: Validate private key has correct permissions + ansible.builtin.stat: + path: "{{ [working_directory, 'id_rsa'] | ansible.builtin.path_join }}" + register: _key_stat + + - name: Assert private key permissions are 0600 + ansible.builtin.assert: + that: + - _key_stat.stat.mode == "0600" + fail_msg: Private key does not have mode 0600. + success_msg: Private key has correct permissions. + + - name: Validate inventory file was written to local storage + ansible.builtin.assert: + that: + - "[working_directory, 'inventory.yaml'] | ansible.builtin.path_join is ansible.builtin.file" + fail_msg: Inventory file was not written to local storage. + success_msg: Inventory file exists in local storage. + + - name: Read inventory file + ansible.builtin.slurp: + src: "{{ [working_directory, 'inventory.yaml'] | ansible.builtin.path_join }}" + register: _inventory_file + + - name: Validate inventory file contains expected host entry + ansible.builtin.assert: + that: + - "'ansible-test' in (_inventory_file.content | ansible.builtin.b64decode)" + - "'virtual-machine-test' in (_inventory_file.content | ansible.builtin.b64decode)" + fail_msg: Inventory file does not contain expected host entry. + success_msg: Inventory file contains expected host entry. + + - name: Verify ansible-test user exists in container + community.docker.docker_container_exec: + container: virtual-machine-test + command: id ansible-test + register: _user_check + + - name: Assert user exists + ansible.builtin.assert: + that: + - _user_check.rc == 0 + fail_msg: ansible-test user was not created in the container. + success_msg: ansible-test user exists in the container. + + - name: Verify sudoers file was created in container + community.docker.docker_container_exec: + container: virtual-machine-test + command: cat /etc/sudoers.d/ansible-test + register: _sudoers_check + + - name: Assert sudoers entry exists + ansible.builtin.assert: + that: + - _sudoers_check.rc == 0 + - "'ansible-test' in _sudoers_check.stdout" + fail_msg: sudoers file was not created for ansible-test user. + success_msg: sudoers file exists for ansible-test user. diff --git a/scenarios/project/roles/virtual_machine/molecule/revoke_access/converge.yml b/scenarios/project/roles/virtual_machine/molecule/revoke_access/converge.yml new file mode 100644 index 000000000..4cfcfa90e --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/revoke_access/converge.yml @@ -0,0 +1,22 @@ +--- +- name: Run virtual_machine revoke access tasks + hosts: + - localhost + tasks: + - name: Add container to inventory + ansible.builtin.add_host: + name: virtual-machine-test + ansible_connection: community.docker.docker + + - name: Import virtual_machine role + ansible.builtin.import_role: + name: virtual_machine + vars: + virtual_machine: + host: virtual-machine-test + python_interpreter: /usr/bin/python3 + virtual_machine_user: ansible-test + virtual_machine_password: test-password + virtual_machine_storage: + local: + directory: "{{ working_directory }}" diff --git a/scenarios/project/roles/virtual_machine/molecule/revoke_access/create.yml b/scenarios/project/roles/virtual_machine/molecule/revoke_access/create.yml new file mode 100644 index 000000000..7d32e6612 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/revoke_access/create.yml @@ -0,0 +1,47 @@ +--- +- name: Create test container and pre-provision user + hosts: + - localhost + pre_tasks: + - name: Import docker validation tasks + ansible.builtin.import_role: + name: executables + tasks_from: validate_docker.yaml + + tasks: + - name: Create working directory + ansible.builtin.file: + mode: "0755" + path: "{{ working_directory }}" + state: directory + + - name: Start UBI9 container with systemd + community.docker.docker_container: + name: virtual-machine-test + image: registry.access.redhat.com/ubi9/ubi@sha256:9d99826a5299a54fa92e9b47d74e6cd72efb04cb57eb8fe748ed93e08ebb6184 + command: /sbin/init + privileged: true + state: started + cgroupns_mode: host + volumes: + - /sys/fs/cgroup:/sys/fs/cgroup:rw + + - name: Add container to inventory + ansible.builtin.add_host: + name: virtual-machine-test + ansible_connection: community.docker.docker + + - name: Import virtual_machine role to grant access + ansible.builtin.import_role: + name: virtual_machine + tags: + - grant_access + vars: + virtual_machine: + host: virtual-machine-test + python_interpreter: /usr/bin/python3 + virtual_machine_user: ansible-test + virtual_machine_password: test-password + virtual_machine_storage: + local: + directory: "{{ working_directory }}" diff --git a/scenarios/project/roles/virtual_machine/molecule/revoke_access/destroy.yml b/scenarios/project/roles/virtual_machine/molecule/revoke_access/destroy.yml new file mode 100644 index 000000000..6d112f7a8 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/revoke_access/destroy.yml @@ -0,0 +1,15 @@ +--- +- name: Destroy test container and working directory + hosts: + - localhost + tasks: + - name: Remove container + community.docker.docker_container: + name: virtual-machine-test + state: absent + force_kill: true + + - name: Delete working directory + ansible.builtin.file: + path: "{{ working_directory }}" + state: absent diff --git a/scenarios/project/roles/virtual_machine/molecule/revoke_access/molecule.yml b/scenarios/project/roles/virtual_machine/molecule/revoke_access/molecule.yml new file mode 100644 index 000000000..d4529a580 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/revoke_access/molecule.yml @@ -0,0 +1,28 @@ +--- +dependency: + name: galaxy + +ansible: + env: + ANSIBLE_ROLES_PATH: ../../.. + executor: + backend: ansible-playbook + args: + ansible_playbook: + - --inventory=${MOLECULE_PROJECT_DIRECTORY}/../../../inventory + - --tags=revoke_access,untagged + - --extra-vars=working_directory=${MOLECULE_PROJECT_DIRECTORY}/test_data + playbooks: + create: create.yml + converge: converge.yml + destroy: destroy.yml + verify: verify.yml + +scenario: + name: revoke_access + test_sequence: + - syntax + - create + - converge + - verify + - destroy diff --git a/scenarios/project/roles/virtual_machine/molecule/revoke_access/verify.yml b/scenarios/project/roles/virtual_machine/molecule/revoke_access/verify.yml new file mode 100644 index 000000000..ab494f7c8 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/molecule/revoke_access/verify.yml @@ -0,0 +1,32 @@ +--- +- name: Verify revoke access succeeded + hosts: + - localhost + tasks: + - name: Verify ansible-test user was removed from container + community.docker.docker_container_exec: + container: virtual-machine-test + command: id ansible-test + register: _user_check + failed_when: false + + - name: Assert user no longer exists + ansible.builtin.assert: + that: + - _user_check.rc != 0 + fail_msg: ansible-test user still exists. Revoke access failed. + success_msg: ansible-test user was successfully removed. + + - name: Verify sudoers file was removed from container + community.docker.docker_container_exec: + container: virtual-machine-test + command: test -f /etc/sudoers.d/ansible-test + register: _sudoers_check + failed_when: false + + - name: Assert sudoers file no longer exists + ansible.builtin.assert: + that: + - _sudoers_check.rc != 0 + fail_msg: sudoers file still exists. Revoke access failed. + success_msg: sudoers file was successfully removed. diff --git a/scenarios/project/roles/virtual_machine/tasks/grant.yaml b/scenarios/project/roles/virtual_machine/tasks/grant.yaml new file mode 100644 index 000000000..182d9ea4b --- /dev/null +++ b/scenarios/project/roles/virtual_machine/tasks/grant.yaml @@ -0,0 +1,91 @@ +--- +- name: Configure ansible user on virtual machine + become: true + delegate_to: "{{ virtual_machine.host }}" + vars: + _ssh_dir: "{{ ['/home', virtual_machine_user, '.ssh'] | ansible.builtin.path_join }}" + block: + - name: Create ansible user + ansible.builtin.user: + name: "{{ virtual_machine_user }}" + state: present + + - name: Set password for ansible user + ansible.builtin.command: + argv: + - /bin/sh + - -c + - "echo {{ virtual_machine_user }}:$(openssl passwd -6 {{ virtual_machine_password | quote }}) | chpasswd -e" + changed_when: true + no_log: true + + - name: Create .ssh directory + ansible.builtin.file: + group: "{{ virtual_machine_user }}" + mode: "0700" + owner: "{{ virtual_machine_user }}" + path: "{{ _ssh_dir }}" + state: directory + + - name: Generate SSH keypair + ansible.builtin.command: + argv: + - ssh-keygen + - -t + - rsa + - -b + - "2048" + - -f + - "{{ _key_file }}" + - -N + - "" + creates: "{{ _key_file }}" + become: true + become_user: "{{ virtual_machine_user }}" + vars: + _key_file: "{{ [_ssh_dir, 'id_rsa'] | ansible.builtin.path_join }}" + + - name: Set up authorized_keys from public key + ansible.builtin.copy: + dest: "{{ [_ssh_dir, 'authorized_keys'] | ansible.builtin.path_join }}" + group: "{{ virtual_machine_user }}" + mode: "0600" + owner: "{{ virtual_machine_user }}" + remote_src: true + src: "{{ [_ssh_dir, 'id_rsa.pub'] | ansible.builtin.path_join }}" + + - name: Grant sudo privileges to ansible user + ansible.builtin.copy: + content: | + {{ virtual_machine_user }} ALL=(ALL) NOPASSWD: /usr/bin/ansible-playbook + # pragma: whitelist secret + {{ virtual_machine_user }} ALL=(ALL) NOPASSWD: /bin/sh + dest: "{{ ['/etc', 'sudoers.d', virtual_machine_user] | ansible.builtin.path_join }}" + mode: "0440" + validate: /usr/sbin/visudo -cf %s + + - name: Fetch private key from remote host + ansible.builtin.fetch: + dest: "{{ [virtual_machine_storage.local.directory, 'id_rsa'] | ansible.builtin.path_join }}" + flat: true + src: "{{ [_ssh_dir, 'id_rsa'] | ansible.builtin.path_join }}" + +- name: Write local storage artifacts + block: + - name: Set permissions on fetched private key + ansible.builtin.file: + mode: "0600" + path: "{{ [virtual_machine_storage.local.directory, 'id_rsa'] | ansible.builtin.path_join }}" + + - name: Write Ansible inventory file to local storage + ansible.builtin.copy: + content: | + all: + hosts: + rhel9_servers: + ansible_host: "{{ virtual_machine.host }}" + ansible_user: "{{ virtual_machine_user }}" + ansible_ssh_private_key_file: "{{ [virtual_machine_storage.local.directory, 'id_rsa'] | ansible.builtin.path_join }}" + ansible_python_interpreter: "{{ virtual_machine.python_interpreter | ansible.builtin.default('/usr/bin/python3') }}" + dest: "{{ [virtual_machine_storage.local.directory, 'inventory.yaml'] | ansible.builtin.path_join }}" + mode: "0644" diff --git a/scenarios/project/roles/virtual_machine/tasks/main.yaml b/scenarios/project/roles/virtual_machine/tasks/main.yaml new file mode 100644 index 000000000..04033567d --- /dev/null +++ b/scenarios/project/roles/virtual_machine/tasks/main.yaml @@ -0,0 +1,12 @@ +--- +- name: Import grant tasks + ansible.builtin.import_tasks: + file: grant.yaml + tags: + - grant_access + +- name: Import revoke tasks + ansible.builtin.import_tasks: + file: revoke.yaml + tags: + - revoke_access diff --git a/scenarios/project/roles/virtual_machine/tasks/revoke.yaml b/scenarios/project/roles/virtual_machine/tasks/revoke.yaml new file mode 100644 index 000000000..1bad11137 --- /dev/null +++ b/scenarios/project/roles/virtual_machine/tasks/revoke.yaml @@ -0,0 +1,15 @@ +--- +- name: Modify virtual machine settings + become: true + delegate_to: "{{ virtual_machine.host }}" + block: + - name: Remove ansible user + ansible.builtin.user: + name: "{{ virtual_machine_user }}" + remove: true + state: absent + + - name: Remove sudoers file + ansible.builtin.file: + path: "{{ ['/etc', 'sudoers.d', virtual_machine_user] | ansible.builtin.path_join }}" + state: absent diff --git a/scenarios/sre/project/roles/waiters/defaults/main/tasks.yaml b/scenarios/project/roles/waiters/defaults/main/tasks.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/defaults/main/tasks.yaml rename to scenarios/project/roles/waiters/defaults/main/tasks.yaml diff --git a/scenarios/sre/project/roles/waiters/meta/argument_specs.yaml b/scenarios/project/roles/waiters/meta/argument_specs.yaml similarity index 92% rename from scenarios/sre/project/roles/waiters/meta/argument_specs.yaml rename to scenarios/project/roles/waiters/meta/argument_specs.yaml index a566629fc..99a022e3c 100644 --- a/scenarios/sre/project/roles/waiters/meta/argument_specs.yaml +++ b/scenarios/project/roles/waiters/meta/argument_specs.yaml @@ -24,6 +24,7 @@ argument_specs: - pause-execution - restart-kubernetes-workload - scale-kubernetes-workload + - verify-kyverno-policy-report-creation required: true type: str required: true diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/converge.yml b/scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/converge.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/converge.yml rename to scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/converge.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/create.yml b/scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/create.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/create.yml rename to scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/create.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/destroy.yml b/scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/destroy.yml rename to scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/destroy.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/molecule.yml b/scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/molecule.yml rename to scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/molecule.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/verify.yml b/scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/verify.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_delete_workload_pods/verify.yml rename to scenarios/project/roles/waiters/molecule/wait_delete_workload_pods/verify.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/converge.yml b/scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/converge.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/converge.yml rename to scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/converge.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/create.yml b/scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/create.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/create.yml rename to scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/create.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/destroy.yml b/scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/destroy.yml rename to scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/destroy.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/molecule.yml b/scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/molecule.yml rename to scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/molecule.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/verify.yml b/scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/verify.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_restart_kubernetes_workload/verify.yml rename to scenarios/project/roles/waiters/molecule/wait_restart_kubernetes_workload/verify.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/converge.yml b/scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/converge.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/converge.yml rename to scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/converge.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/create.yml b/scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/create.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/create.yml rename to scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/create.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/destroy.yml b/scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/destroy.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/destroy.yml rename to scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/destroy.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/molecule.yml b/scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/molecule.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/molecule.yml rename to scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/molecule.yml diff --git a/scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/verify.yml b/scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/verify.yml similarity index 100% rename from scenarios/sre/project/roles/waiters/molecule/wait_scale_kubernetes_workload/verify.yml rename to scenarios/project/roles/waiters/molecule/wait_scale_kubernetes_workload/verify.yml diff --git a/scenarios/sre/project/roles/waiters/tasks/generate_files.yaml b/scenarios/project/roles/waiters/tasks/generate_files.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/generate_files.yaml rename to scenarios/project/roles/waiters/tasks/generate_files.yaml diff --git a/scenarios/sre/project/roles/waiters/tasks/main.yaml b/scenarios/project/roles/waiters/tasks/main.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/main.yaml rename to scenarios/project/roles/waiters/tasks/main.yaml diff --git a/scenarios/sre/project/roles/waiters/tasks/validate_waiter_arguments.yaml b/scenarios/project/roles/waiters/tasks/validate_waiter_arguments.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/validate_waiter_arguments.yaml rename to scenarios/project/roles/waiters/tasks/validate_waiter_arguments.yaml diff --git a/scenarios/sre/project/roles/waiters/tasks/wait_delete_workload_pods.yaml b/scenarios/project/roles/waiters/tasks/wait_delete_workload_pods.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/wait_delete_workload_pods.yaml rename to scenarios/project/roles/waiters/tasks/wait_delete_workload_pods.yaml diff --git a/scenarios/sre/project/roles/waiters/tasks/wait_pause_execution.yaml b/scenarios/project/roles/waiters/tasks/wait_pause_execution.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/wait_pause_execution.yaml rename to scenarios/project/roles/waiters/tasks/wait_pause_execution.yaml diff --git a/scenarios/sre/project/roles/waiters/tasks/wait_restart_kubernetes_workload.yaml b/scenarios/project/roles/waiters/tasks/wait_restart_kubernetes_workload.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/wait_restart_kubernetes_workload.yaml rename to scenarios/project/roles/waiters/tasks/wait_restart_kubernetes_workload.yaml diff --git a/scenarios/sre/project/roles/waiters/tasks/wait_scale_kubernetes_workload.yaml b/scenarios/project/roles/waiters/tasks/wait_scale_kubernetes_workload.yaml similarity index 100% rename from scenarios/sre/project/roles/waiters/tasks/wait_scale_kubernetes_workload.yaml rename to scenarios/project/roles/waiters/tasks/wait_scale_kubernetes_workload.yaml diff --git a/scenarios/project/roles/waiters/tasks/wait_verify_kyverno_policy_report_creation.yaml b/scenarios/project/roles/waiters/tasks/wait_verify_kyverno_policy_report_creation.yaml new file mode 100644 index 000000000..de3160143 --- /dev/null +++ b/scenarios/project/roles/waiters/tasks/wait_verify_kyverno_policy_report_creation.yaml @@ -0,0 +1,17 @@ +--- +- name: Include waiter argument validation tasks + ansible.builtin.include_tasks: + file: validate_waiter_arguments.yaml + +- name: Wait for Kyverno PolicyReport scoped to target workload + kubernetes.core.k8s_info: + api_version: wgpolicyk8s.io/v1alpha2 + kind: PolicyReport + kubeconfig: "{{ waiters_cluster.kubeconfig }}" + name: "{{ waiters_kubernetes_object.metadata.name }}" + namespace: "{{ waiters_kubernetes_object.metadata.namespace }}" + register: waiters_policy_report_result + until: + - waiters_policy_report_result.resources | ansible.builtin.length == 1 + retries: 20 + delay: 15 diff --git a/scenarios/sre/project/roles/waiters/templates/meta/argument_specs.j2 b/scenarios/project/roles/waiters/templates/meta/argument_specs.j2 similarity index 100% rename from scenarios/sre/project/roles/waiters/templates/meta/argument_specs.j2 rename to scenarios/project/roles/waiters/templates/meta/argument_specs.j2 diff --git a/scenarios/sre/project/roles/waiters/templates/tasks/unimplemeneted_wait.j2 b/scenarios/project/roles/waiters/templates/tasks/unimplemeneted_wait.j2 similarity index 100% rename from scenarios/sre/project/roles/waiters/templates/tasks/unimplemeneted_wait.j2 rename to scenarios/project/roles/waiters/templates/tasks/unimplemeneted_wait.j2 diff --git a/scenarios/sre/project/roles/waiters/templates/vars/task_files.j2 b/scenarios/project/roles/waiters/templates/vars/task_files.j2 similarity index 100% rename from scenarios/sre/project/roles/waiters/templates/vars/task_files.j2 rename to scenarios/project/roles/waiters/templates/vars/task_files.j2 diff --git a/scenarios/sre/project/roles/waiters/vars/main/task_files.yaml b/scenarios/project/roles/waiters/vars/main/task_files.yaml similarity index 75% rename from scenarios/sre/project/roles/waiters/vars/main/task_files.yaml rename to scenarios/project/roles/waiters/vars/main/task_files.yaml index dcff62911..f0b627d27 100644 --- a/scenarios/sre/project/roles/waiters/vars/main/task_files.yaml +++ b/scenarios/project/roles/waiters/vars/main/task_files.yaml @@ -8,3 +8,5 @@ waiters_task_files: wait: wait_restart_kubernetes_workload.yaml scale-kubernetes-workload: wait: wait_scale_kubernetes_workload.yaml + verify-kyverno-policy-report-creation: + wait: wait_verify_kyverno_policy_report_creation.yaml diff --git a/scenarios/sre/project/templates/group_variables/storage.j2 b/scenarios/project/templates/group_variables/storage.j2 similarity index 100% rename from scenarios/sre/project/templates/group_variables/storage.j2 rename to scenarios/project/templates/group_variables/storage.j2 diff --git a/scenarios/scripts/evaluate_scenario.py b/scenarios/scripts/evaluate_scenario.py new file mode 100644 index 000000000..9012f71d0 --- /dev/null +++ b/scenarios/scripts/evaluate_scenario.py @@ -0,0 +1,627 @@ +#!/usr/bin/env python3 +""" +Unified scenario evaluation script. + +Evaluates three types of checks: + 1. Prometheus alerts with label matching + 2. Kubernetes resources with expected state (subset match) + 3. OPA policy evaluation (agent-submitted or integrity checks) + +Output: JSON with results grouped by check type. +""" + +import argparse +import json +import logging +import subprocess +import sys +import tarfile +import tempfile +from dataclasses import dataclass, asdict +from pathlib import Path +from typing import Any, Dict, List, Optional + +import requests +import yaml +from kubernetes import client, config + +logger = logging.getLogger(__name__) +logging.basicConfig( + level=logging.INFO, + format="[%(levelname)s] %(message)s" +) + + +@dataclass +class CheckResult: + """Result of a single check.""" + pass_: bool + message: str + + def to_dict(self): + return {"pass": self.pass_, "message": self.message} + + +class AlertsEvaluator: + """Evaluates Prometheus alerts by name and labels.""" + + def __init__(self, prometheus_url: str): + self.prometheus_url = prometheus_url.rstrip("/") + + def evaluate(self, alerts: List[Dict[str, Any]]) -> tuple[List[Dict], bool]: + """ + Evaluate alerts from groundtruth against Prometheus. + + Returns: (results_list, overall_pass) + """ + results = [] + all_pass = True + + if not alerts: + return results, True + + try: + response = requests.get( + f"{self.prometheus_url}/api/v1/alerts", + timeout=10 + ) + response.raise_for_status() + prometheus_data = response.json() + firing_alerts = [ + a for a in prometheus_data.get("data", {}).get("alerts", []) + if a.get("state") == "firing" + ] + except Exception as e: + logger.error(f"Failed to query Prometheus: {e}") + for alert in alerts: + results.append({ + "name": alert.get("name"), + **asdict(CheckResult(False, f"Prometheus query failed: {e}")).to_dict() + }) + return results, False + + for expected_alert in alerts: + alert_name = expected_alert.get("name") + expected_labels = expected_alert.get("labels", {}) + + # Find alert with matching name and labels + matched = False + for firing_alert in firing_alerts: + if firing_alert.get("labels", {}).get("alertname") == alert_name: + # Check if all expected labels are present (subset match) + live_labels = firing_alert.get("labels", {}) + if all( + live_labels.get(k) == v + for k, v in expected_labels.items() + ): + matched = True + break + + result = CheckResult( + matched, + f"Alert firing with expected labels" + if matched + else f"Alert not found or labels don't match" + ) + results.append({ + "name": alert_name, + **result.to_dict() + }) + all_pass = all_pass and result.pass_ + + return results, all_pass + + def to_json(self, results: List[Dict]) -> str: + """Serialize results to JSON.""" + return json.dumps(results, indent=2) + + +class KubernetesEvaluator: + """Evaluates Kubernetes resources with expected state matching.""" + + def __init__(self, kubeconfig: str): + try: + config.load_kube_config(kubeconfig) + except Exception as e: + logger.error(f"Failed to load kubeconfig: {e}") + raise + + self.v1 = client.CoreV1Api() + self.apps_v1 = client.AppsV1Api() + self.custom_api = client.CustomObjectsApi() + + def _subset_match(self, expected: Any, live: Any, path: str = "") -> tuple[bool, str]: + """ + Deep subset comparison: every key in expected must exist in live with same value. + Live can have additional keys. + + Returns: (match: bool, reason: str) + """ + if isinstance(expected, dict): + if not isinstance(live, dict): + return False, f"{path}: expected dict, got {type(live).__name__}" + + for key, expected_val in expected.items(): + if key not in live: + return False, f"{path}.{key}: missing in live" + match, reason = self._subset_match(expected_val, live[key], f"{path}.{key}") + if not match: + return False, reason + return True, "" + + elif isinstance(expected, list): + if not isinstance(live, list): + return False, f"{path}: expected list, got {type(live).__name__}" + + # For lists, we do simple equality (not subset) + if expected != live: + return False, f"{path}: list values differ" + return True, "" + + else: + # Scalar comparison + if expected != live: + return False, f"{path}: expected {expected!r}, got {live!r}" + return True, "" + + def _fetch_resource(self, resource: Dict[str, Any]) -> Optional[Dict]: + """Fetch live resource from cluster.""" + api_version = resource.get("apiVersion", "v1") + kind = resource.get("kind") + namespace = resource.get("metadata", {}).get("namespace") + name = resource.get("metadata", {}).get("name") + + try: + if api_version == "v1": + if kind == "Pod": + return self.v1.read_namespaced_pod(name, namespace).to_dict() + elif kind == "Service": + return self.v1.read_namespaced_service(name, namespace).to_dict() + elif kind == "ConfigMap": + return self.v1.read_namespaced_config_map(name, namespace).to_dict() + else: + return None + + elif api_version == "apps/v1": + if kind == "Deployment": + return self.apps_v1.read_namespaced_deployment(name, namespace).to_dict() + elif kind == "StatefulSet": + return self.apps_v1.read_namespaced_stateful_set(name, namespace).to_dict() + elif kind == "DaemonSet": + return self.apps_v1.read_namespaced_daemon_set(name, namespace).to_dict() + else: + return None + + elif "policy" in api_version.lower() or "kyverno" in api_version.lower(): + # Custom resource: PolicyReport, ClusterPolicyReport, ClusterPolicy + group, version = api_version.rsplit("/", 1) if "/" in api_version else ("", api_version) + namespace_param = namespace if kind != "ClusterPolicyReport" else None + + if namespace_param: + return self.custom_api.get_namespaced_custom_object( + group, version, namespace_param, kind.lower() + "s", name + ) + else: + return self.custom_api.get_cluster_custom_object( + group, version, kind.lower() + "s", name + ) + + except client.exceptions.ApiException as e: + logger.debug(f"Failed to fetch {kind}/{name}: {e.status} {e.reason}") + return None + + return None + + def evaluate(self, resources: List[Dict[str, Any]]) -> tuple[List[Dict], bool]: + """ + Evaluate resources against cluster. + + Returns: (results_list, overall_pass) + """ + results = [] + all_pass = True + + if not resources: + return results, True + + for expected_resource in resources: + kind = expected_resource.get("kind") + name = expected_resource.get("metadata", {}).get("name") + namespace = expected_resource.get("metadata", {}).get("namespace", "default") + + # Special handling for PolicyReport + if kind in ["PolicyReport", "ClusterPolicyReport"]: + result = self._evaluate_policy_report(expected_resource) + else: + # Standard resource matching + live_resource = self._fetch_resource(expected_resource) + if not live_resource: + result = CheckResult( + False, + f"{kind}/{name} ({namespace}): not found or failed to fetch" + ) + else: + match, reason = self._subset_match(expected_resource, live_resource) + result = CheckResult( + match, + f"{kind}/{name} ({namespace}): expected state matches" + if match + else f"{kind}/{name} ({namespace}): {reason}" + ) + + results.append({ + "resource": f"{kind}/{name}" + (f" ({namespace})" if namespace and kind != "ClusterPolicyReport" else ""), + **result.to_dict() + }) + all_pass = all_pass and result.pass_ + + return results, all_pass + + def _evaluate_policy_report(self, expected_report: Dict) -> CheckResult: + """Evaluate PolicyReport by checking if expected results exist.""" + namespace = expected_report.get("metadata", {}).get("namespace") + expected_results = expected_report.get("results", []) + + if not expected_results: + return CheckResult(True, "PolicyReport: no specific results to check") + + try: + # Fetch all PolicyReports in namespace + reports = self.custom_api.list_namespaced_custom_object( + "wgpolicyk8s.io", "v1alpha2", namespace, "policyreports" + ) + all_results = [] + for report in reports.get("items", []): + all_results.extend(report.get("results", [])) + + # Check if all expected results exist + for expected_result in expected_results: + found = False + for actual_result in all_results: + if (actual_result.get("policy") == expected_result.get("policy") and + actual_result.get("result") == expected_result.get("result")): + found = True + break + + if not found: + expected_str = f"policy={expected_result.get('policy')}, result={expected_result.get('result')}" + return CheckResult(False, f"PolicyReport: result not found: {expected_str}") + + return CheckResult(True, "PolicyReport: all expected results found") + + except Exception as e: + return CheckResult(False, f"PolicyReport: failed to fetch: {e}") + + +class OPAEvaluator: + """Evaluates OPA policies (agent-submitted or integrity checks).""" + + def __init__(self, kubeconfig: str, agent_output_path: Optional[str] = None, vm_inventory: Optional[str] = None): + try: + config.load_kube_config(kubeconfig) + except Exception as e: + logger.error(f"Failed to load kubeconfig: {e}") + raise + + self.custom_api = client.CustomObjectsApi() + self.agent_output_path = agent_output_path + self.vm_inventory = vm_inventory + + def _extract_opa_result(self, json_output: str) -> Optional[Any]: + """Extract result value from OPA JSON output.""" + try: + data = json.loads(json_output) + result = data.get("result", [{}])[0] + expressions = result.get("expressions", [{}]) + return expressions[0].get("value") + except Exception as e: + logger.error(f"Failed to extract OPA result: {e}") + return None + + def _run_opa_eval(self, data_file: str, input_file: str, output_format: str = "json") -> Optional[str]: + """Run OPA eval and return output.""" + try: + result = subprocess.run( + ["opa", "eval", "--data", data_file, "--input", input_file, + "data.check.result", "--format", output_format], + capture_output=True, + text=True, + timeout=30, + check=False + ) + if result.returncode != 0: + logger.error(f"OPA eval failed: {result.stderr}") + return None + return result.stdout.strip() + except Exception as e: + logger.error(f"OPA eval error: {e}") + return None + + def evaluate(self, checks: List[Dict[str, Any]]) -> tuple[List[Dict], bool]: + """ + Evaluate OPA checks. + + Returns: (results_list, overall_pass) + """ + results = [] + all_pass = True + + if not checks: + return results, True + + for check in checks: + check_name = check.get("name") + expected_output = check.get("expectedOutput") + + if "expectedRules" in check: + # Integrity path + result = self._evaluate_integrity_check(check) + else: + # Agent-submitted path + result = self._evaluate_agent_check(check) + + results.append({ + "check": check_name, + **result.to_dict() + }) + all_pass = all_pass and result.pass_ + + return results, all_pass + + def _evaluate_agent_check(self, check: Dict[str, Any]) -> CheckResult: + """Evaluate agent-submitted OPA check.""" + expected_files = check.get("expectedFiles", []) + expected_output = check.get("expectedOutput") + + if not self.agent_output_path: + return CheckResult(False, "Agent output archive not provided") + + agent_file = Path(self.agent_output_path) + if not agent_file.exists(): + return CheckResult(False, f"Agent archive not found: {self.agent_output_path}") + + # Extract archive + with tempfile.TemporaryDirectory() as tmpdir: + try: + with tarfile.open(agent_file, "r") as tar: + tar.extractall(tmpdir) + except Exception as e: + return CheckResult(False, f"Failed to extract archive: {e}") + + tmpdir_path = Path(tmpdir) + + # Pre-flight: check expected files + for expected_file in expected_files: + file_path = tmpdir_path / expected_file + if not file_path.exists(): + return CheckResult( + False, + f"Expected file missing: {expected_file}" + ) + + # Find and run fetcher + fetcher_files = list(tmpdir_path.glob("fetcher.*")) + if not fetcher_files: + return CheckResult(False, "Fetcher file not found in agent archive") + + fetcher_path = fetcher_files[0] + fetcher_ext = fetcher_path.suffix + + try: + if fetcher_ext == ".sh": + subprocess.run( + ["bash", str(fetcher_path)], + cwd=tmpdir, + check=True, + capture_output=True, + timeout=30 + ) + elif fetcher_ext == ".yml": + if not self.vm_inventory: + return CheckResult(False, "VM inventory not provided for ansible fetcher") + subprocess.run( + ["ansible-playbook", str(fetcher_path), "-i", self.vm_inventory], + cwd=tmpdir, + check=True, + capture_output=True, + timeout=60 + ) + else: + return CheckResult(False, f"Unknown fetcher type: {fetcher_ext}") + except subprocess.CalledProcessError as e: + return CheckResult(False, f"Fetcher execution failed: {e.stderr}") + + # Run OPA eval + policy_file = tmpdir_path / "policy.rego" + data_file = tmpdir_path / "collected_data.json" + + if not policy_file.exists() or not data_file.exists(): + return CheckResult(False, "policy.rego or collected_data.json not found after fetcher") + + opa_output = self._run_opa_eval(str(policy_file), str(data_file)) + if opa_output is None: + return CheckResult(False, "OPA eval failed") + + opa_value = self._extract_opa_result(opa_output) + if opa_value != expected_output: + return CheckResult( + False, + f"OPA output mismatch: expected {expected_output}, got {opa_value}" + ) + + return CheckResult(True, f"OPA eval returned {expected_output}") + + def _evaluate_integrity_check(self, check: Dict[str, Any]) -> CheckResult: + """Evaluate policy integrity check via expectedRules.""" + policy_name = check.get("policyName") + expected_rules = check.get("expectedRules", []) + expected_output = check.get("expectedOutput", True) + + try: + # Fetch live ClusterPolicy + policy = self.custom_api.get_cluster_custom_object( + "kyverno.io", "v1", "clusterpolicies", policy_name + ) + except client.exceptions.ApiException as e: + return CheckResult(False, f"ClusterPolicy not found: {policy_name}") + + live_rules = policy.get("spec", {}).get("rules", []) + + with tempfile.TemporaryDirectory() as tmpdir: + tmpdir_path = Path(tmpdir) + + # Write expected_rules.rego + expected_rego = f"""package check + +import rego.v1 + +expected_rules := {json.dumps(expected_rules)} + +result if {{ + input.spec.rules == expected_rules +}} +""" + rego_file = tmpdir_path / "expected_rules.rego" + rego_file.write_text(expected_rego) + + # Write policy_input.json + input_data = {"spec": {"rules": live_rules}} + input_file = tmpdir_path / "policy_input.json" + input_file.write_text(json.dumps(input_data)) + + # Run OPA eval + opa_output = self._run_opa_eval(str(rego_file), str(input_file)) + if opa_output is None: + return CheckResult(False, "OPA integrity check failed") + + opa_value = self._extract_opa_result(opa_output) + if opa_value != expected_output: + return CheckResult( + False, + f"Policy rules mismatch: expected {expected_output}, got {opa_value}" + ) + + return CheckResult(True, f"{policy_name} rules unchanged") + + +def load_groundtruth(groundtruth_path: str) -> Dict[str, Any]: + """Load and parse groundtruth YAML.""" + try: + with open(groundtruth_path, "r") as f: + data = yaml.safe_load(f) + return data.get("spec", {}) + except Exception as e: + logger.error(f"Failed to load groundtruth: {e}") + raise + + +def main(): + parser = argparse.ArgumentParser( + description="Unified scenario evaluation script" + ) + parser.add_argument( + "--groundtruth", + required=True, + help="Path to groundtruth.yaml file" + ) + parser.add_argument( + "--kubeconfig", + default=None, + help="Path to kubeconfig (default: ~/.kube/config)" + ) + parser.add_argument( + "--prometheus-url", + default="http://prometheus:9090", + help="Prometheus URL (default: http://prometheus:9090)" + ) + parser.add_argument( + "--agent-output", + default=None, + help="Path to agent output archive" + ) + parser.add_argument( + "--vm-inventory", + default=None, + help="Path to VM inventory for ansible fetcher" + ) + parser.add_argument( + "--output", + default=None, + help="Output file (default: stdout)" + ) + + args = parser.parse_args() + + try: + groundtruth = load_groundtruth(args.groundtruth) + except Exception as e: + print(json.dumps({"error": str(e)}, indent=2), file=sys.stderr) + sys.exit(1) + + # Normalize kubeconfig + if args.kubeconfig is None: + args.kubeconfig = str(Path.home() / ".kube" / "config") + + results = { + "alerts": [], + "kubernetes": [], + "opa": [] + } + all_pass = True + + # Evaluate alerts + if groundtruth.get("alerts"): + try: + alerts_eval = AlertsEvaluator(args.prometheus_url) + alert_results, alerts_pass = alerts_eval.evaluate(groundtruth["alerts"]) + results["alerts"] = alert_results + all_pass = all_pass and alerts_pass + except Exception as e: + logger.error(f"Alerts evaluation failed: {e}") + results["alerts"] = [{"error": str(e)}] + all_pass = False + + # Evaluate Kubernetes resources + if groundtruth.get("kubernetes", {}).get("resources"): + try: + k8s_eval = KubernetesEvaluator(args.kubeconfig) + k8s_results, k8s_pass = k8s_eval.evaluate(groundtruth["kubernetes"]["resources"]) + results["kubernetes"] = k8s_results + all_pass = all_pass and k8s_pass + except Exception as e: + logger.error(f"Kubernetes evaluation failed: {e}") + results["kubernetes"] = [{"error": str(e)}] + all_pass = False + + # Evaluate OPA checks + if groundtruth.get("opa", {}).get("checks"): + try: + opa_eval = OPAEvaluator(args.kubeconfig, args.agent_output, args.vm_inventory) + opa_results, opa_pass = opa_eval.evaluate(groundtruth["opa"]["checks"]) + results["opa"] = opa_results + all_pass = all_pass and opa_pass + except Exception as e: + logger.error(f"OPA evaluation failed: {e}") + results["opa"] = [{"error": str(e)}] + all_pass = False + + # Output results + output_data = { + "alerts": results["alerts"], + "kubernetes": results["kubernetes"], + "opa": results["opa"] + } + + output_json = json.dumps(output_data, indent=2) + + if args.output: + Path(args.output).write_text(output_json) + print(output_json) + else: + print(output_json) + + sys.exit(0 if all_pass else 1) + + +if __name__ == "__main__": + main() diff --git a/scenarios/sre/scripts/generate_library_index_schemas.py b/scenarios/scripts/generate_library_index_schemas.py similarity index 100% rename from scenarios/sre/scripts/generate_library_index_schemas.py rename to scenarios/scripts/generate_library_index_schemas.py diff --git a/scenarios/sre/scripts/generate_library_indexes.py b/scenarios/scripts/generate_library_indexes.py similarity index 100% rename from scenarios/sre/scripts/generate_library_indexes.py rename to scenarios/scripts/generate_library_indexes.py diff --git a/scenarios/sre/scripts/generate_library_readmes.py b/scenarios/scripts/generate_library_readmes.py similarity index 93% rename from scenarios/sre/scripts/generate_library_readmes.py rename to scenarios/scripts/generate_library_readmes.py index 53ad6ac22..1e878bad2 100644 --- a/scenarios/sre/scripts/generate_library_readmes.py +++ b/scenarios/scripts/generate_library_readmes.py @@ -55,7 +55,7 @@ def create_applications_documentation( documentation_directory / f"{index_id}.md", template.render({ "application": index, - "source_file_path": f"../../../scenarios/sre/library/indexes/applications/{index_id}.json", + "source_file_path": f"../../../scenarios/library/indexes/applications/{index_id}.json", "schema_file_path": f"../../../schemas/json/applications/{index_id}.json" }) ) @@ -76,9 +76,9 @@ def create_faults_documentation( documentation_directory / f"{index_id}.md", template.render({ "fault": index, - "source_file_path": f"../../../scenarios/sre/library/indexes/faults/{index_id}.json", + "source_file_path": f"../../../scenarios/library/indexes/faults/{index_id}.json", "schema_file_path": f"../../../schemas/json/faults/{index_id}.json", - "implementation_file_path": f"../../../scenarios/sre/project/roles/faults/tasks/inject_{index_id.replace('-', '_')}.yaml" + "implementation_file_path": f"../../../scenarios/project/roles/faults/tasks/inject_{index_id.replace('-', '_')}.yaml" }) ) @@ -98,7 +98,7 @@ def create_waiters_documentation( documentation_directory / f"{index_id}.md", template.render({ "waiter": index, - "source_file_path": f"../../../scenarios/sre/library/indexes/waiters/{index_id}.json", + "source_file_path": f"../../../scenarios/library/indexes/waiters/{index_id}.json", "schema_file_path": f"../../../schemas/json/waiters/{index_id}.json" }) ) @@ -161,7 +161,7 @@ def create_scenarios_documentation( documentation_directory / index["category"] / f"{index_id}.md", template.render({ "scenario": index, - "source_file_path": f"../../../../scenarios/sre/library/indexes/scenarios/{index_id}.json", + "source_file_path": f"../../../../scenarios/library/indexes/scenarios/{index_id}.json", "schema_file_path": f"../../../../schemas/json/scenarios/{index_id}.json", "applications": applications_lookup, "faults": faults_lookup diff --git a/scenarios/sre/scripts/inject_scenario_faults.py b/scenarios/scripts/inject_scenario_faults.py similarity index 100% rename from scenarios/sre/scripts/inject_scenario_faults.py rename to scenarios/scripts/inject_scenario_faults.py diff --git a/scenarios/scripts/unittests/test_evaluate_scenario.py b/scenarios/scripts/unittests/test_evaluate_scenario.py new file mode 100644 index 000000000..252602c3b --- /dev/null +++ b/scenarios/scripts/unittests/test_evaluate_scenario.py @@ -0,0 +1,346 @@ +#!/usr/bin/env python3 +""" +Unit tests for evaluate_scenario.py + +Uses mocking to test each evaluator class in isolation. +""" + +import json +import tempfile +import tarfile +from pathlib import Path +from unittest import mock +from unittest.mock import MagicMock, patch, mock_open + +import pytest + +# Import the evaluators +import sys +sys.path.insert(0, str(Path(__file__).parent.parent / "scripts")) +from evaluate_scenario import ( + AlertsEvaluator, + KubernetesEvaluator, + OPAEvaluator, + CheckResult, + load_groundtruth +) + + +class TestAlertsEvaluator: + """Test AlertsEvaluator class.""" + + @patch("evaluate_scenario.requests.get") + def test_evaluate_alert_found_with_matching_labels(self, mock_get): + """Test alert found with exact label match.""" + mock_response = MagicMock() + mock_response.json.return_value = { + "data": { + "alerts": [ + { + "state": "firing", + "labels": { + "alertname": "KubePodNotReady", + "severity": "critical" + } + } + ] + } + } + mock_get.return_value = mock_response + + evaluator = AlertsEvaluator("http://prometheus:9090") + results, all_pass = evaluator.evaluate([ + { + "name": "KubePodNotReady", + "labels": {"severity": "critical"} + } + ]) + + assert all_pass is True + assert len(results) == 1 + assert results[0]["name"] == "KubePodNotReady" + assert results[0]["pass"] is True + + @patch("evaluate_scenario.requests.get") + def test_evaluate_alert_not_found(self, mock_get): + """Test alert not found.""" + mock_response = MagicMock() + mock_response.json.return_value = { + "data": {"alerts": []} + } + mock_get.return_value = mock_response + + evaluator = AlertsEvaluator("http://prometheus:9090") + results, all_pass = evaluator.evaluate([ + { + "name": "NonExistent", + "labels": {} + } + ]) + + assert all_pass is False + assert len(results) == 1 + assert results[0]["pass"] is False + + @patch("evaluate_scenario.requests.get") + def test_evaluate_alert_with_subset_labels(self, mock_get): + """Test alert found with subset of labels.""" + mock_response = MagicMock() + mock_response.json.return_value = { + "data": { + "alerts": [ + { + "state": "firing", + "labels": { + "alertname": "KubePodNotReady", + "severity": "critical", + "team": "platform" + } + } + ] + } + } + mock_get.return_value = mock_response + + evaluator = AlertsEvaluator("http://prometheus:9090") + results, all_pass = evaluator.evaluate([ + { + "name": "KubePodNotReady", + "labels": {"severity": "critical"} + } + ]) + + assert all_pass is True + assert results[0]["pass"] is True + + @patch("evaluate_scenario.requests.get") + def test_evaluate_no_alerts(self, mock_get): + """Test when no alerts are expected.""" + evaluator = AlertsEvaluator("http://prometheus:9090") + results, all_pass = evaluator.evaluate([]) + + assert all_pass is True + assert len(results) == 0 + + +class TestKubernetesEvaluator: + """Test KubernetesEvaluator class.""" + + def test_subset_match_identical_dicts(self): + """Test subset match with identical dicts.""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"a": 1, "b": {"c": 2}} + live = {"a": 1, "b": {"c": 2}} + + match, reason = evaluator._subset_match(expected, live) + assert match is True + + def test_subset_match_expected_subset(self): + """Test subset match where expected is subset of live.""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"a": 1} + live = {"a": 1, "b": 2, "c": {"d": 3}} + + match, reason = evaluator._subset_match(expected, live) + assert match is True + + def test_subset_match_nested_subset(self): + """Test subset match with nested dict.""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"spec": {"template": {"spec": {"hostNetwork": False}}}} + live = { + "spec": { + "template": { + "spec": { + "hostNetwork": False, + "containers": [{"name": "app"}] + } + }, + "replicas": 3 + } + } + + match, reason = evaluator._subset_match(expected, live) + assert match is True + + def test_subset_match_value_mismatch(self): + """Test subset match with value mismatch.""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"hostNetwork": False} + live = {"hostNetwork": True} + + match, reason = evaluator._subset_match(expected, live) + assert match is False + assert "hostNetwork" in reason + + def test_subset_match_missing_key(self): + """Test subset match with missing key.""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"a": 1, "b": 2} + live = {"a": 1} + + match, reason = evaluator._subset_match(expected, live) + assert match is False + assert "missing" in reason + + def test_subset_match_list_equality(self): + """Test subset match with lists (exact equality required).""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"containers": [{"name": "app"}]} + live = {"containers": [{"name": "app"}]} + + match, reason = evaluator._subset_match(expected, live) + assert match is True + + def test_subset_match_list_mismatch(self): + """Test subset match with list mismatch.""" + evaluator = KubernetesEvaluator.__new__(KubernetesEvaluator) + expected = {"containers": [{"name": "app"}]} + live = {"containers": [{"name": "app"}, {"name": "sidecar"}]} + + match, reason = evaluator._subset_match(expected, live) + assert match is False + + +class TestOPAEvaluator: + """Test OPAEvaluator class.""" + + def test_extract_opa_result_simple_bool(self): + """Test extracting simple boolean from OPA output.""" + evaluator = OPAEvaluator.__new__(OPAEvaluator) + opa_output = json.dumps({ + "result": [ + { + "expressions": [ + {"value": True} + ] + } + ] + }) + + value = evaluator._extract_opa_result(opa_output) + assert value is True + + def test_extract_opa_result_false(self): + """Test extracting false from OPA output.""" + evaluator = OPAEvaluator.__new__(OPAEvaluator) + opa_output = json.dumps({ + "result": [ + { + "expressions": [ + {"value": False} + ] + } + ] + }) + + value = evaluator._extract_opa_result(opa_output) + assert value is False + + def test_extract_opa_result_complex_object(self): + """Test extracting complex object from OPA output.""" + evaluator = OPAEvaluator.__new__(OPAEvaluator) + expected_obj = {"passed": 3, "failed": 0} + opa_output = json.dumps({ + "result": [ + { + "expressions": [ + {"value": expected_obj} + ] + } + ] + }) + + value = evaluator._extract_opa_result(opa_output) + assert value == expected_obj + + def test_extract_opa_result_invalid_json(self): + """Test extracting from invalid JSON.""" + evaluator = OPAEvaluator.__new__(OPAEvaluator) + value = evaluator._extract_opa_result("invalid json") + assert value is None + + @patch("evaluate_scenario.subprocess.run") + def test_run_opa_eval_success(self, mock_run): + """Test successful OPA eval run.""" + mock_result = MagicMock() + mock_result.returncode = 0 + mock_result.stdout = '{"result": [{"expressions": [{"value": true}]}]}' + mock_run.return_value = mock_result + + evaluator = OPAEvaluator.__new__(OPAEvaluator) + output = evaluator._run_opa_eval("/path/to/data.rego", "/path/to/input.json") + + assert output == '{"result": [{"expressions": [{"value": true}]}]}' + mock_run.assert_called_once() + + @patch("evaluate_scenario.subprocess.run") + def test_run_opa_eval_failure(self, mock_run): + """Test OPA eval failure.""" + mock_result = MagicMock() + mock_result.returncode = 1 + mock_result.stderr = "OPA error" + mock_run.return_value = mock_result + + evaluator = OPAEvaluator.__new__(OPAEvaluator) + output = evaluator._run_opa_eval("/path/to/data.rego", "/path/to/input.json") + + assert output is None + + +class TestCheckResult: + """Test CheckResult dataclass.""" + + def test_to_dict_pass(self): + """Test CheckResult to_dict for passing check.""" + result = CheckResult(True, "All good") + d = result.to_dict() + + assert d["pass"] is True + assert d["message"] == "All good" + + def test_to_dict_fail(self): + """Test CheckResult to_dict for failing check.""" + result = CheckResult(False, "Something went wrong") + d = result.to_dict() + + assert d["pass"] is False + assert d["message"] == "Something went wrong" + + +class TestLoadGroundtruth: + """Test load_groundtruth function.""" + + def test_load_valid_groundtruth(self): + """Test loading valid groundtruth file.""" + groundtruth_data = """ +apiVersion: itbench.io/v2 +kind: GroundTruth +metadata: + name: scenario-64 +spec: + alerts: + - name: TestAlert + kubernetes: + resources: + - kind: Deployment +""" + with tempfile.NamedTemporaryFile(mode="w", suffix=".yaml", delete=False) as f: + f.write(groundtruth_data) + f.flush() + + try: + spec = load_groundtruth(f.name) + assert "alerts" in spec + assert spec["alerts"][0]["name"] == "TestAlert" + finally: + Path(f.name).unlink() + + def test_load_missing_file(self): + """Test loading non-existent file.""" + with pytest.raises(Exception): + load_groundtruth("/nonexistent/path/groundtruth.yaml") + + +if __name__ == "__main__": + pytest.main([__file__, "-v"]) diff --git a/scenarios/sre/scripts/unittests/test_generate_library_index_schemas.py b/scenarios/scripts/unittests/test_generate_library_index_schemas.py similarity index 100% rename from scenarios/sre/scripts/unittests/test_generate_library_index_schemas.py rename to scenarios/scripts/unittests/test_generate_library_index_schemas.py diff --git a/scenarios/sre/scripts/unittests/test_generate_library_indexes.py b/scenarios/scripts/unittests/test_generate_library_indexes.py similarity index 99% rename from scenarios/sre/scripts/unittests/test_generate_library_indexes.py rename to scenarios/scripts/unittests/test_generate_library_indexes.py index d65d1ec4d..c2e3f6bce 100644 --- a/scenarios/sre/scripts/unittests/test_generate_library_indexes.py +++ b/scenarios/scripts/unittests/test_generate_library_indexes.py @@ -181,7 +181,7 @@ def test_create_scenarios_indexes(self, mock_glob, mock_load_releases, mock_writ """Test creating scenario indexes with fault aggregation.""" templates_dir = Path("/test/templates/scenarios") index_dir = Path("/test/indexes/scenarios") - playbooks_dir = Path("/test/scenarios/sre") + playbooks_dir = Path("/test/scenarios") generator_dir = Path("/test/generator") mock_load_releases.return_value = { diff --git a/scenarios/sre/scripts/unittests/test_generate_library_readmes.py b/scenarios/scripts/unittests/test_generate_library_readmes.py similarity index 100% rename from scenarios/sre/scripts/unittests/test_generate_library_readmes.py rename to scenarios/scripts/unittests/test_generate_library_readmes.py diff --git a/scenarios/sre/scripts/unittests/test_inject_scenario_faults.py b/scenarios/scripts/unittests/test_inject_scenario_faults.py similarity index 100% rename from scenarios/sre/scripts/unittests/test_inject_scenario_faults.py rename to scenarios/scripts/unittests/test_inject_scenario_faults.py diff --git a/scenarios/sre/scripts/unittests/test_validate_library_indexes.py b/scenarios/scripts/unittests/test_validate_library_indexes.py similarity index 100% rename from scenarios/sre/scripts/unittests/test_validate_library_indexes.py rename to scenarios/scripts/unittests/test_validate_library_indexes.py diff --git a/scenarios/sre/scripts/validate_library_indexes.py b/scenarios/scripts/validate_library_indexes.py similarity index 100% rename from scenarios/sre/scripts/validate_library_indexes.py rename to scenarios/scripts/validate_library_indexes.py diff --git a/scenarios/scripts/watch_scenario_evaluation.py b/scenarios/scripts/watch_scenario_evaluation.py new file mode 100644 index 000000000..5fadbc5ca --- /dev/null +++ b/scenarios/scripts/watch_scenario_evaluation.py @@ -0,0 +1,292 @@ +#!/usr/bin/env python3 +""" +Continuous scenario evaluation watcher. + +Polls evaluate_scenario.py on a configurable interval until all checks pass +consecutively (pass_mark) or the window expires. +""" + +import argparse +import json +import logging +import subprocess +import sys +import time + +from pathlib import Path +from typing import Any, Dict, List, Optional + +import yaml + +# Configure logging +logging.basicConfig( + level=logging.INFO, + format="%(asctime)s [%(levelname)s] %(name)s - %(message)s" +) +logger = logging.getLogger(__name__) + + +def load_cluster_config(private_project_directory: Path) -> Dict[str, Any]: + """Load cluster configuration from inventory.""" + cluster_config_path = ( + private_project_directory + / "inventory" + / "group_vars" + / "environment" + / "cluster.yaml" + ) + if not cluster_config_path.exists(): + logger.warning(f"Cluster config not found: {cluster_config_path}") + return {} + + try: + with open(cluster_config_path) as f: + data = yaml.safe_load(f) + return data.get("cluster", {}) if data else {} + except Exception as e: + logger.error(f"Failed to load cluster config: {e}") + return {} + + +def load_evaluation_defaults() -> Dict[str, Any]: + """Load evaluation timing defaults.""" + return { + "window": 300, + "interval": 30, + "pass_mark": 2 + } + + +def load_evaluation_overrides(private_project_directory: Path) -> Dict[str, Any]: + """Load evaluation timing overrides from inventory.""" + overrides_path = ( + private_project_directory + / "inventory" + / "group_vars" + / "environment" + / "evaluation.yaml" + ) + if not overrides_path.exists(): + return {} + with open(overrides_path) as f: + data = yaml.safe_load(f) + return data.get("evaluation_overrides", {}) if data else {} + + +def resolve_timing(private_project_directory: Path) -> Dict[str, Any]: + """Merge defaults with overrides.""" + defaults = load_evaluation_defaults() + overrides = load_evaluation_overrides(private_project_directory) + return {**defaults, **overrides} + + +def run_evaluation_pass( + groundtruth_path: Path, + kubeconfig: str, + prometheus_url: str, + agent_output: Optional[str] = None, + vm_inventory: Optional[str] = None, +) -> Optional[Dict[str, Any]]: + """Run evaluation via evaluate_scenario.py subprocess.""" + logger.info("Running evaluation pass via evaluate_scenario.py") + + cmd = [ + "python", + str(Path(__file__).parent / "evaluate_scenario.py"), + "--groundtruth", str(groundtruth_path), + "--kubeconfig", kubeconfig, + "--prometheus-url", prometheus_url, + ] + + if agent_output: + cmd.extend(["--agent-output", agent_output]) + + if vm_inventory: + cmd.extend(["--vm-inventory", vm_inventory]) + + try: + result = subprocess.run( + cmd, + capture_output=True, + text=True, + timeout=60 + ) + + if result.returncode != 0: + logger.error(f"Evaluation failed: {result.stderr}") + return None + + # Parse JSON output + try: + output = json.loads(result.stdout) + return output + except json.JSONDecodeError: + logger.error(f"Failed to parse evaluation output: {result.stdout}") + return None + + except subprocess.TimeoutExpired: + logger.error("Evaluation subprocess timed out") + return None + except Exception as e: + logger.error(f"Evaluation subprocess error: {e}") + return None + + +def aggregate_results( + alerts: List[Dict], + kubernetes: List[Dict], + opa: List[Dict] +) -> List[Dict[str, Any]]: + """Aggregate results from all three evaluators into a single checks list.""" + checks = [] + + for alert in alerts: + checks.append({"type": "alert", **alert}) + + for resource in kubernetes: + checks.append({"type": "kubernetes", **resource}) + + for check in opa: + checks.append({"type": "opa", **check}) + + return checks + + +def write_final_result( + private_project_directory: Path, + scenario_id: int, + passed: bool, + evaluation_output: Dict[str, Any] +) -> None: + """Write final evaluation result to storage.""" + result_path = private_project_directory / "storage" / f"scenario_{scenario_id}" / "evaluation.json" + result_path.parent.mkdir(parents=True, exist_ok=True) + + # Aggregate checks from all evaluators + checks = aggregate_results( + evaluation_output.get("alerts", []), + evaluation_output.get("kubernetes", []), + evaluation_output.get("opa", []) + ) + + payload = {"pass": passed, "checks": checks} + with open(result_path, "w") as f: + json.dump(payload, f, indent=2) + logger.info(f"Final evaluation result written to {result_path}: pass={passed}") + + +def main() -> None: + parser = argparse.ArgumentParser( + description="Continuous evaluation watcher for ITBench scenarios" + ) + parser.add_argument("--private_project_directory", type=Path, required=True) + parser.add_argument("--scenario_id", type=int, required=True) + parser.add_argument("--agent_output", type=str, default=None) + parser.add_argument("--vm_inventory", type=str, default=None) + args = parser.parse_args() + + timing = resolve_timing(args.private_project_directory) + + window = timing.get("window", 300) + interval = timing.get("interval", 30) + pass_mark = timing.get("pass_mark", 2) + + # Load kubeconfig from inventory + cluster_config = load_cluster_config(args.private_project_directory) + kubeconfig = cluster_config.get("kubeconfig") + if not kubeconfig: + logger.error("kubeconfig not found in cluster.yaml") + sys.exit(1) + + # Prometheus URL: use default, will be set via tools role at runtime + prometheus_url = "http://prometheus:9090" + + # Resolve groundtruth path + groundtruth_path = ( + args.private_project_directory + / "project" + / "roles" + / "scenarios" + / "files" + / f"scenario_{args.scenario_id}" + / "groundtruth.yaml" + ) + + if not groundtruth_path.exists(): + logger.error(f"GroundTruth file not found: {groundtruth_path}") + return + + consecutive_passes = 0 + deadline = time.time() + window + poll_index = 0 + + logger.info( + f"Evaluation watcher started: scenario={args.scenario_id} " + f"window={window}s interval={interval}s pass_mark={pass_mark}" + ) + + last_evaluation: Optional[Dict[str, Any]] = None + + while time.time() < deadline: + poll_index += 1 + logger.info(f"Poll {poll_index}: evaluating scenario {args.scenario_id}") + + evaluation_result = run_evaluation_pass( + groundtruth_path, + kubeconfig, + prometheus_url, + agent_output=args.agent_output, + vm_inventory=args.vm_inventory + ) + + if evaluation_result: + last_evaluation = evaluation_result + + # Extract pass/fail status + all_checks = ( + evaluation_result.get("alerts", []) + + evaluation_result.get("kubernetes", []) + + evaluation_result.get("opa", []) + ) + + if not all_checks: + # No checks to evaluate + logger.info("No checks defined for this scenario") + write_final_result(args.private_project_directory, args.scenario_id, True, evaluation_result) + return + + all_passed = all(c.get("pass", False) for c in all_checks) + + if all_passed: + consecutive_passes += 1 + logger.info(f"All checks passing — consecutive passes: {consecutive_passes}/{pass_mark}") + if consecutive_passes >= pass_mark: + logger.info("Pass mark reached — declaring success") + write_final_result(args.private_project_directory, args.scenario_id, True, evaluation_result) + return + else: + consecutive_passes = 0 + failed = [c for c in all_checks if not c.get("pass", False)] + logger.info(f"Checks not yet passing: {len(failed)}/{len(all_checks)} — {[c.get('message') for c in failed]}") + else: + logger.warning(f"Poll {poll_index}: evaluation failed, will retry") + consecutive_passes = 0 + + remaining = deadline - time.time() + if remaining <= 0: + break + + sleep_time = min(interval, remaining) + logger.info(f"Next poll in {sleep_time:.0f}s ({remaining:.0f}s remaining in window)") + time.sleep(sleep_time) + + logger.info("Evaluation window expired — declaring failure") + if last_evaluation: + write_final_result(args.private_project_directory, args.scenario_id, False, last_evaluation) + else: + # No successful evaluation, write empty result + write_final_result(args.private_project_directory, args.scenario_id, False, {"alerts": [], "kubernetes": [], "opa": []}) + + +if __name__ == "__main__": + main() diff --git a/scenarios/sre/templates/documentation/library/applications/README.md.j2 b/scenarios/templates/documentation/library/applications/README.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/applications/README.md.j2 rename to scenarios/templates/documentation/library/applications/README.md.j2 diff --git a/scenarios/sre/templates/documentation/library/applications/application.md.j2 b/scenarios/templates/documentation/library/applications/application.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/applications/application.md.j2 rename to scenarios/templates/documentation/library/applications/application.md.j2 diff --git a/scenarios/sre/templates/documentation/library/faults/README.md.j2 b/scenarios/templates/documentation/library/faults/README.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/faults/README.md.j2 rename to scenarios/templates/documentation/library/faults/README.md.j2 diff --git a/scenarios/sre/templates/documentation/library/faults/fault.md.j2 b/scenarios/templates/documentation/library/faults/fault.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/faults/fault.md.j2 rename to scenarios/templates/documentation/library/faults/fault.md.j2 diff --git a/scenarios/sre/templates/documentation/library/scenarios/README.md.j2 b/scenarios/templates/documentation/library/scenarios/README.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/scenarios/README.md.j2 rename to scenarios/templates/documentation/library/scenarios/README.md.j2 diff --git a/scenarios/sre/templates/documentation/library/scenarios/scenario.md.j2 b/scenarios/templates/documentation/library/scenarios/scenario.md.j2 similarity index 92% rename from scenarios/sre/templates/documentation/library/scenarios/scenario.md.j2 rename to scenarios/templates/documentation/library/scenarios/scenario.md.j2 index 24951539a..149ae2b78 100644 --- a/scenarios/sre/templates/documentation/library/scenarios/scenario.md.j2 +++ b/scenarios/templates/documentation/library/scenarios/scenario.md.j2 @@ -20,7 +20,7 @@ {% for disruption in scenario.disruptions %} {% for injection in disruption.injections %} -- [{{ faults[injection.id].name }}](../../../../scenarios/sre/docs/faults.md#{{ faults[injection.id].name.split() | join("-") }}) +- [{{ faults[injection.id].name }}](../../../../scenarios/docs/faults.md#{{ faults[injection.id].name.split() | join("-") }}) {% endfor %} {% endfor %} diff --git a/scenarios/sre/templates/documentation/library/scenarios/statistics.md.j2 b/scenarios/templates/documentation/library/scenarios/statistics.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/scenarios/statistics.md.j2 rename to scenarios/templates/documentation/library/scenarios/statistics.md.j2 diff --git a/scenarios/sre/templates/documentation/library/waiters/README.md.j2 b/scenarios/templates/documentation/library/waiters/README.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/waiters/README.md.j2 rename to scenarios/templates/documentation/library/waiters/README.md.j2 diff --git a/scenarios/sre/templates/documentation/library/waiters/waiter.md.j2 b/scenarios/templates/documentation/library/waiters/waiter.md.j2 similarity index 100% rename from scenarios/sre/templates/documentation/library/waiters/waiter.md.j2 rename to scenarios/templates/documentation/library/waiters/waiter.md.j2 diff --git a/scenarios/sre/templates/library/indexes/applications/1.yaml.j2 b/scenarios/templates/library/indexes/applications/1.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/applications/1.yaml.j2 rename to scenarios/templates/library/indexes/applications/1.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/applications/2.yaml.j2 b/scenarios/templates/library/indexes/applications/2.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/applications/2.yaml.j2 rename to scenarios/templates/library/indexes/applications/2.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/1.yaml.j2 b/scenarios/templates/library/indexes/faults/1.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/1.yaml.j2 rename to scenarios/templates/library/indexes/faults/1.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/10.yaml.j2 b/scenarios/templates/library/indexes/faults/10.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/10.yaml.j2 rename to scenarios/templates/library/indexes/faults/10.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/11.yaml.j2 b/scenarios/templates/library/indexes/faults/11.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/11.yaml.j2 rename to scenarios/templates/library/indexes/faults/11.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/12.yaml.j2 b/scenarios/templates/library/indexes/faults/12.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/12.yaml.j2 rename to scenarios/templates/library/indexes/faults/12.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/13.yaml.j2 b/scenarios/templates/library/indexes/faults/13.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/13.yaml.j2 rename to scenarios/templates/library/indexes/faults/13.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/14.yaml.j2 b/scenarios/templates/library/indexes/faults/14.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/14.yaml.j2 rename to scenarios/templates/library/indexes/faults/14.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/15.yaml.j2 b/scenarios/templates/library/indexes/faults/15.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/15.yaml.j2 rename to scenarios/templates/library/indexes/faults/15.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/16.yaml.j2 b/scenarios/templates/library/indexes/faults/16.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/16.yaml.j2 rename to scenarios/templates/library/indexes/faults/16.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/17.yaml.j2 b/scenarios/templates/library/indexes/faults/17.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/17.yaml.j2 rename to scenarios/templates/library/indexes/faults/17.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/18.yaml.j2 b/scenarios/templates/library/indexes/faults/18.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/18.yaml.j2 rename to scenarios/templates/library/indexes/faults/18.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/19.yaml.j2 b/scenarios/templates/library/indexes/faults/19.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/19.yaml.j2 rename to scenarios/templates/library/indexes/faults/19.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/2.yaml.j2 b/scenarios/templates/library/indexes/faults/2.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/2.yaml.j2 rename to scenarios/templates/library/indexes/faults/2.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/20.yaml.j2 b/scenarios/templates/library/indexes/faults/20.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/20.yaml.j2 rename to scenarios/templates/library/indexes/faults/20.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/21.yaml.j2 b/scenarios/templates/library/indexes/faults/21.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/21.yaml.j2 rename to scenarios/templates/library/indexes/faults/21.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/22.yaml.j2 b/scenarios/templates/library/indexes/faults/22.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/22.yaml.j2 rename to scenarios/templates/library/indexes/faults/22.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/23.yaml.j2 b/scenarios/templates/library/indexes/faults/23.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/23.yaml.j2 rename to scenarios/templates/library/indexes/faults/23.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/24.yaml.j2 b/scenarios/templates/library/indexes/faults/24.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/24.yaml.j2 rename to scenarios/templates/library/indexes/faults/24.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/25.yaml.j2 b/scenarios/templates/library/indexes/faults/25.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/25.yaml.j2 rename to scenarios/templates/library/indexes/faults/25.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/26.yaml.j2 b/scenarios/templates/library/indexes/faults/26.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/26.yaml.j2 rename to scenarios/templates/library/indexes/faults/26.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/27.yaml.j2 b/scenarios/templates/library/indexes/faults/27.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/27.yaml.j2 rename to scenarios/templates/library/indexes/faults/27.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/28.yaml.j2 b/scenarios/templates/library/indexes/faults/28.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/28.yaml.j2 rename to scenarios/templates/library/indexes/faults/28.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/29.yaml.j2 b/scenarios/templates/library/indexes/faults/29.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/29.yaml.j2 rename to scenarios/templates/library/indexes/faults/29.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/3.yaml.j2 b/scenarios/templates/library/indexes/faults/3.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/3.yaml.j2 rename to scenarios/templates/library/indexes/faults/3.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/30.yaml.j2 b/scenarios/templates/library/indexes/faults/30.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/30.yaml.j2 rename to scenarios/templates/library/indexes/faults/30.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/36.yaml.j2 b/scenarios/templates/library/indexes/faults/31.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/36.yaml.j2 rename to scenarios/templates/library/indexes/faults/31.yaml.j2 diff --git a/scenarios/templates/library/indexes/faults/32.yaml.j2 b/scenarios/templates/library/indexes/faults/32.yaml.j2 new file mode 100644 index 000000000..d37dbd303 --- /dev/null +++ b/scenarios/templates/library/indexes/faults/32.yaml.j2 @@ -0,0 +1,50 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/fault.json +--- +alerts: + application: [] +arguments: + jsonSchema: + properties: + kubernetesObject: + properties: + apiVersion: + enum: + - apps/v1 + type: string + kind: + enum: + - Deployment + type: string + metadata: + properties: + name: + type: string + namespace: + type: string + required: + - name + - namespace + type: object + required: + - apiVersion + - kind + - metadata + type: object + required: + - kubernetesObject + type: object +description: This fault deploys a Kubernetes workload with hostNetwork set to true, granting the container access to the host network namespace. +expectation: Kyverno PolicyReport will record a policy failure against the Deployment for violating the disallow-host-namespaces rule. +name: Active Host Network Kubernetes Deployment +platform: Kubernetes +resources: +- https://kubernetes.io/docs/concepts/security/pod-security-standards/ +solutions: + templates: + - steps: + - command: kubectl -n {{ args.kubernetesObject.metadata.namespace }} delete {{ args.kubernetesObject.kind | lower }} {{ args.kubernetesObject.metadata.name }} + text: Delete the non-compliant Deployment that uses hostNetwork. + - text: Author and apply a Kyverno ClusterPolicy that disallows hostNetwork on all workloads. +tags: +- Compliance +- Deployment diff --git a/scenarios/templates/library/indexes/faults/33.yaml.j2 b/scenarios/templates/library/indexes/faults/33.yaml.j2 new file mode 100644 index 000000000..b726746ed --- /dev/null +++ b/scenarios/templates/library/indexes/faults/33.yaml.j2 @@ -0,0 +1,29 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/fault.json +--- +alerts: + application: [] +arguments: + jsonSchema: + properties: + virtualMachine: + properties: + hostname: + type: string + required: + - hostname + type: object + required: + - virtualMachine + type: object +description: This fault enables X11 forwarding in /etc/ssh/sshd_config on a RHEL9 host, violating the requirement for it to be disabled. +expectation: OPA evaluation of the collected SSH configuration data will return false, indicating the host is non-compliant with the applicable benchmark rule. +name: Enabled X11 Forwarding RHEL9 SSHD +platform: RHEL9 +resources: +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/securing_networks/assembly_using-secure-communications-between-two-systems-with-openssh_securing-networks +solutions: + templates: + - steps: + - text: Set X11Forwarding to no in /etc/ssh/sshd_config and restart the sshd service. +tags: +- Compliance diff --git a/scenarios/templates/library/indexes/faults/34.yaml.j2 b/scenarios/templates/library/indexes/faults/34.yaml.j2 new file mode 100644 index 000000000..420292159 --- /dev/null +++ b/scenarios/templates/library/indexes/faults/34.yaml.j2 @@ -0,0 +1,50 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/fault.json +--- +alerts: + application: [] +arguments: + jsonSchema: + properties: + kubernetesObject: + properties: + apiVersion: + enum: + - apps/v1 + type: string + kind: + enum: + - Deployment + type: string + metadata: + properties: + name: + type: string + namespace: + type: string + required: + - name + - namespace + type: object + required: + - apiVersion + - kind + - metadata + type: object + required: + - kubernetesObject + type: object +description: This fault deploys a Pod that violates active security policies, such as pulling from an untrusted image registry or permitting privilege escalation. +expectation: Policy evaluation will flag the Pod as non-compliant, producing a policy failure result for the target resource. +name: Non Compliant Kubernetes Pod Deployment +platform: Kubernetes +resources: +- https://kubernetes.io/docs/concepts/security/pod-security-standards/ +solutions: + templates: + - steps: + - command: kubectl -n {{ args.kubernetesObject.metadata.namespace }} delete {{ args.kubernetesObject.kind | lower }} {{ args.kubernetesObject.metadata.name }} + text: Delete the non-compliant Pod. + - text: Author and apply a policy that enforces the required security controls for the workload. +tags: +- Compliance +- Deployment diff --git a/scenarios/sre/templates/library/indexes/faults/4.yaml.j2 b/scenarios/templates/library/indexes/faults/4.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/4.yaml.j2 rename to scenarios/templates/library/indexes/faults/4.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/5.yaml.j2 b/scenarios/templates/library/indexes/faults/5.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/5.yaml.j2 rename to scenarios/templates/library/indexes/faults/5.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/6.yaml.j2 b/scenarios/templates/library/indexes/faults/6.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/6.yaml.j2 rename to scenarios/templates/library/indexes/faults/6.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/7.yaml.j2 b/scenarios/templates/library/indexes/faults/7.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/7.yaml.j2 rename to scenarios/templates/library/indexes/faults/7.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/8.yaml.j2 b/scenarios/templates/library/indexes/faults/8.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/8.yaml.j2 rename to scenarios/templates/library/indexes/faults/8.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/faults/9.yaml.j2 b/scenarios/templates/library/indexes/faults/9.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/faults/9.yaml.j2 rename to scenarios/templates/library/indexes/faults/9.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/1.yaml.j2 b/scenarios/templates/library/indexes/scenarios/1.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/1.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/1.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/10.yaml.j2 b/scenarios/templates/library/indexes/scenarios/10.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/10.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/10.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/102.yaml.j2 b/scenarios/templates/library/indexes/scenarios/102.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/102.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/102.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/105.yaml.j2 b/scenarios/templates/library/indexes/scenarios/105.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/105.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/105.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/11.yaml.j2 b/scenarios/templates/library/indexes/scenarios/11.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/11.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/11.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/114.yaml.j2 b/scenarios/templates/library/indexes/scenarios/114.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/114.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/114.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/12.yaml.j2 b/scenarios/templates/library/indexes/scenarios/12.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/12.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/12.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/13.yaml.j2 b/scenarios/templates/library/indexes/scenarios/13.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/13.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/13.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/14.yaml.j2 b/scenarios/templates/library/indexes/scenarios/14.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/14.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/14.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/15.yaml.j2 b/scenarios/templates/library/indexes/scenarios/15.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/15.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/15.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/16.yaml.j2 b/scenarios/templates/library/indexes/scenarios/16.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/16.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/16.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/17.yaml.j2 b/scenarios/templates/library/indexes/scenarios/17.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/17.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/17.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/18.yaml.j2 b/scenarios/templates/library/indexes/scenarios/18.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/18.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/18.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/19.yaml.j2 b/scenarios/templates/library/indexes/scenarios/19.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/19.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/19.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/2.yaml.j2 b/scenarios/templates/library/indexes/scenarios/2.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/2.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/2.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/20.yaml.j2 b/scenarios/templates/library/indexes/scenarios/20.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/20.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/20.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/21.yaml.j2 b/scenarios/templates/library/indexes/scenarios/21.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/21.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/21.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/22.yaml.j2 b/scenarios/templates/library/indexes/scenarios/22.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/22.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/22.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/23.yaml.j2 b/scenarios/templates/library/indexes/scenarios/23.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/23.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/23.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/24.yaml.j2 b/scenarios/templates/library/indexes/scenarios/24.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/24.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/24.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/25.yaml.j2 b/scenarios/templates/library/indexes/scenarios/25.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/25.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/25.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/26.yaml.j2 b/scenarios/templates/library/indexes/scenarios/26.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/26.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/26.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/27.yaml.j2 b/scenarios/templates/library/indexes/scenarios/27.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/27.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/27.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/29.yaml.j2 b/scenarios/templates/library/indexes/scenarios/29.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/29.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/29.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/3.yaml.j2 b/scenarios/templates/library/indexes/scenarios/3.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/3.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/3.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/30.yaml.j2 b/scenarios/templates/library/indexes/scenarios/30.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/30.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/30.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/31.yaml.j2 b/scenarios/templates/library/indexes/scenarios/31.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/31.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/31.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/33.yaml.j2 b/scenarios/templates/library/indexes/scenarios/33.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/33.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/33.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/34.yaml.j2 b/scenarios/templates/library/indexes/scenarios/34.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/34.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/34.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/35.yaml.j2 b/scenarios/templates/library/indexes/scenarios/35.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/35.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/35.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/36.yaml.j2 b/scenarios/templates/library/indexes/scenarios/36.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/36.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/36.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/37.yaml.j2 b/scenarios/templates/library/indexes/scenarios/37.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/37.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/37.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/38.yaml.j2 b/scenarios/templates/library/indexes/scenarios/38.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/38.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/38.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/39.yaml.j2 b/scenarios/templates/library/indexes/scenarios/39.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/39.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/39.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/4.yaml.j2 b/scenarios/templates/library/indexes/scenarios/4.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/4.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/4.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/40.yaml.j2 b/scenarios/templates/library/indexes/scenarios/40.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/40.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/40.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/41.yaml.j2 b/scenarios/templates/library/indexes/scenarios/41.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/41.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/41.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/42.yaml.j2 b/scenarios/templates/library/indexes/scenarios/42.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/42.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/42.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/43.yaml.j2 b/scenarios/templates/library/indexes/scenarios/43.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/43.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/43.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/44.yaml.j2 b/scenarios/templates/library/indexes/scenarios/44.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/44.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/44.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/45.yaml.j2 b/scenarios/templates/library/indexes/scenarios/45.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/45.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/45.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/46.yaml.j2 b/scenarios/templates/library/indexes/scenarios/46.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/46.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/46.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/47.yaml.j2 b/scenarios/templates/library/indexes/scenarios/47.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/47.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/47.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/48.yaml.j2 b/scenarios/templates/library/indexes/scenarios/48.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/48.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/48.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/49.yaml.j2 b/scenarios/templates/library/indexes/scenarios/49.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/49.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/49.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/5.yaml.j2 b/scenarios/templates/library/indexes/scenarios/5.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/5.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/5.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/50.yaml.j2 b/scenarios/templates/library/indexes/scenarios/50.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/50.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/50.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/51.yaml.j2 b/scenarios/templates/library/indexes/scenarios/51.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/51.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/51.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/52.yaml.j2 b/scenarios/templates/library/indexes/scenarios/52.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/52.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/52.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/53.yaml.j2 b/scenarios/templates/library/indexes/scenarios/53.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/53.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/53.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/54.yaml.j2 b/scenarios/templates/library/indexes/scenarios/54.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/54.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/54.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/55.yaml.j2 b/scenarios/templates/library/indexes/scenarios/55.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/55.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/55.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/56.yaml.j2 b/scenarios/templates/library/indexes/scenarios/56.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/56.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/56.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/57.yaml.j2 b/scenarios/templates/library/indexes/scenarios/57.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/57.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/57.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/58.yaml.j2 b/scenarios/templates/library/indexes/scenarios/58.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/58.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/58.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/59.yaml.j2 b/scenarios/templates/library/indexes/scenarios/59.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/59.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/59.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/6.yaml.j2 b/scenarios/templates/library/indexes/scenarios/6.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/6.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/6.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/60.yaml.j2 b/scenarios/templates/library/indexes/scenarios/60.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/60.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/60.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/61.yaml.j2 b/scenarios/templates/library/indexes/scenarios/61.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/61.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/61.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/62.yaml.j2 b/scenarios/templates/library/indexes/scenarios/62.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/62.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/62.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/63.yaml.j2 b/scenarios/templates/library/indexes/scenarios/63.yaml.j2 similarity index 92% rename from scenarios/sre/templates/library/indexes/scenarios/63.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/63.yaml.j2 index d730fb8e2..80d574d19 100644 --- a/scenarios/sre/templates/library/indexes/scenarios/63.yaml.j2 +++ b/scenarios/templates/library/indexes/scenarios/63.yaml.j2 @@ -11,7 +11,7 @@ disruptions: kind: Secret metadata: name: email-service-secret - namespace: {{ releases["applications"]["opentelemetry_demo"]["kubernetes"]["namespace"] }} + namespace: {{ releases["applications"]["opentelemetry_demo"]["namespace"] }} id: corrupted-kubernetes-secret-credentials waitFor: postInjection: @@ -21,7 +21,7 @@ disruptions: kind: Deployment metadata: name: email - namespace: {{ releases["applications"]["opentelemetry_demo"]["kubernetes"]["namespace"] }} + namespace: {{ releases["applications"]["opentelemetry_demo"]["namespace"] }} id: delete-workload-pods environment: applications: diff --git a/scenarios/templates/library/indexes/scenarios/64.yaml.j2 b/scenarios/templates/library/indexes/scenarios/64.yaml.j2 new file mode 100644 index 000000000..498db3de6 --- /dev/null +++ b/scenarios/templates/library/indexes/scenarios/64.yaml.j2 @@ -0,0 +1,48 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/scenario.json +--- +category: ciso +complexity: medium +description: This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using Kyverno and generate a policy to prevent it. +disruptions: +- injections: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: active-host-network-kubernetes-deployment + waitFor: + postInjection: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: verify-kyverno-policy-report-creation +environment: + applications: [] +id: 64 +kubernetes_resources: +- apiVersion: apps/v1 + kind: Deployment + name: backend + namespace: benchmarks + spec: + template: + spec: + hostNetwork: false +- apiVersion: wgpolicyk8s.io/v1alpha2 + kind: PolicyReport + metadata: + namespace: benchmarks + results: + - policy: disallow-host-namespaces + result: pass +opa_checks: [] +solutionTemplates: +- disruptionIndex: 0 + injectionIndex: 0 diff --git a/scenarios/templates/library/indexes/scenarios/65.yaml.j2 b/scenarios/templates/library/indexes/scenarios/65.yaml.j2 new file mode 100644 index 000000000..1f27025e8 --- /dev/null +++ b/scenarios/templates/library/indexes/scenarios/65.yaml.j2 @@ -0,0 +1,26 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/scenario.json +--- +category: ciso +complexity: medium +description: This scenario simulates a Kubernetes workload deployed with hostNetwork enabled, violating CIS Kubernetes Benchmark 5.2.4. The agent must detect the violation using kubectl and OPA and generate a policy to prevent it. +disruptions: +- injections: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: active-host-network-kubernetes-deployment +environment: + applications: [] +id: 65 +kubernetes_resources: [] +opa_checks: +- name: host-network-check + expectedOutput: true + expectedFiles: [policy.rego, fetcher.sh] +solutionTemplates: +- disruptionIndex: 0 + injectionIndex: 0 diff --git a/scenarios/templates/library/indexes/scenarios/66.yaml.j2 b/scenarios/templates/library/indexes/scenarios/66.yaml.j2 new file mode 100644 index 000000000..188f81e0c --- /dev/null +++ b/scenarios/templates/library/indexes/scenarios/66.yaml.j2 @@ -0,0 +1,22 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/scenario.json +--- +category: ciso +complexity: medium +description: This scenario simulates a RHEL9 host with X11 forwarding enabled in the SSH configuration, violating CIS RHEL9 Benchmark 5.2.6. The agent must detect the violation using Ansible and OPA and generate a policy to prevent it. +disruptions: +- injections: + - args: + virtualMachine: + hostname: rhel9-benchmark + id: enabled-x11-forwarding-rhel9-sshd +environment: + applications: [] +id: 66 +kubernetes_resources: [] +opa_checks: +- name: x11-forwarding-check + expectedOutput: true + expectedFiles: [policy.rego, fetcher.yml] +solutionTemplates: +- disruptionIndex: 0 + injectionIndex: 0 diff --git a/scenarios/templates/library/indexes/scenarios/67.yaml.j2 b/scenarios/templates/library/indexes/scenarios/67.yaml.j2 new file mode 100644 index 000000000..8e9661017 --- /dev/null +++ b/scenarios/templates/library/indexes/scenarios/67.yaml.j2 @@ -0,0 +1,34 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/scenario.json +--- +category: ciso +complexity: high +description: This scenario simulates a Kubernetes cluster with existing Kyverno policies that have gaps in their security controls. The agent must extend the policies to remediate the violations without modifying the existing policy rules. +disruptions: +- injections: + - args: + kubernetesObject: + apiVersion: apps/v1 + kind: Deployment + metadata: + name: backend + namespace: benchmarks + id: non-compliant-kubernetes-pod-deployment +environment: + applications: [] +id: 67 +kubernetes_resources: +- apiVersion: wgpolicyk8s.io/v1alpha2 + kind: PolicyReport + metadata: + namespace: benchmarks + results: + - policy: container-security-controls + result: pass +opa_checks: +- name: policy-integrity + policyName: service-account-requirements + expectedRules: [] + expectedOutput: true +solutionTemplates: +- disruptionIndex: 0 + injectionIndex: 0 diff --git a/scenarios/sre/templates/library/indexes/scenarios/7.yaml.j2 b/scenarios/templates/library/indexes/scenarios/7.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/7.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/7.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/8.yaml.j2 b/scenarios/templates/library/indexes/scenarios/8.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/8.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/8.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/80.yaml.j2 b/scenarios/templates/library/indexes/scenarios/80.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/80.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/80.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/81.yaml.j2 b/scenarios/templates/library/indexes/scenarios/81.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/81.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/81.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/83.yaml.j2 b/scenarios/templates/library/indexes/scenarios/83.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/83.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/83.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/scenarios/91.yaml.j2 b/scenarios/templates/library/indexes/scenarios/91.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/scenarios/91.yaml.j2 rename to scenarios/templates/library/indexes/scenarios/91.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/waiters/1.yaml.j2 b/scenarios/templates/library/indexes/waiters/1.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/waiters/1.yaml.j2 rename to scenarios/templates/library/indexes/waiters/1.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/waiters/2.yaml.j2 b/scenarios/templates/library/indexes/waiters/2.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/waiters/2.yaml.j2 rename to scenarios/templates/library/indexes/waiters/2.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/waiters/3.yaml.j2 b/scenarios/templates/library/indexes/waiters/3.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/waiters/3.yaml.j2 rename to scenarios/templates/library/indexes/waiters/3.yaml.j2 diff --git a/scenarios/sre/templates/library/indexes/waiters/4.yaml.j2 b/scenarios/templates/library/indexes/waiters/4.yaml.j2 similarity index 100% rename from scenarios/sre/templates/library/indexes/waiters/4.yaml.j2 rename to scenarios/templates/library/indexes/waiters/4.yaml.j2 diff --git a/scenarios/templates/library/indexes/waiters/5.yaml.j2 b/scenarios/templates/library/indexes/waiters/5.yaml.j2 new file mode 100644 index 000000000..860d93f0c --- /dev/null +++ b/scenarios/templates/library/indexes/waiters/5.yaml.j2 @@ -0,0 +1,36 @@ +# yaml-language-server: $schema=../../../../../../schemas/json/library/index/waiter.json +--- +arguments: + jsonSchema: + properties: + kubernetesObject: + properties: + apiVersion: + enum: + - apps/v1 + type: string + kind: + enum: + - Deployment + type: string + metadata: + properties: + name: + type: string + namespace: + type: string + required: + - name + - namespace + type: object + required: + - apiVersion + - kind + - metadata + type: object + required: + - kubernetesObject + type: object +description: Verifies that Kyverno has created a PolicyReport scoped to the target Kubernetes workload. +name: Verify Kyverno Policy Report Creation +platform: Kubernetes diff --git a/scenarios/sre/templates/schemas/json/library/index/scenario.json.j2 b/scenarios/templates/schemas/json/library/index/scenario.json.j2 similarity index 97% rename from scenarios/sre/templates/schemas/json/library/index/scenario.json.j2 rename to scenarios/templates/schemas/json/library/index/scenario.json.j2 index ae7ec9310..e3914f291 100644 --- a/scenarios/sre/templates/schemas/json/library/index/scenario.json.j2 +++ b/scenarios/templates/schemas/json/library/index/scenario.json.j2 @@ -60,6 +60,7 @@ }, "category": { "enum": [ + "ciso", "finops", "sre" ], @@ -114,7 +115,6 @@ "items": { "$ref": "#/$defs/applicationItem" }, - "minItems": 1, "type": "array" } }, @@ -163,6 +163,12 @@ }, "type": "array" }, + "states": { + "items": { + "type": "object" + }, + "type": "array" + }, "tags": { "items": { "type": "string" diff --git a/scenarios/sre/tools/awx-ee/.gitignore b/scenarios/tools/awx-ee/.gitignore similarity index 100% rename from scenarios/sre/tools/awx-ee/.gitignore rename to scenarios/tools/awx-ee/.gitignore diff --git a/scenarios/sre/tools/awx-ee/README.md b/scenarios/tools/awx-ee/README.md similarity index 100% rename from scenarios/sre/tools/awx-ee/README.md rename to scenarios/tools/awx-ee/README.md diff --git a/scenarios/sre/tools/awx-ee/bindep.txt b/scenarios/tools/awx-ee/bindep.txt similarity index 100% rename from scenarios/sre/tools/awx-ee/bindep.txt rename to scenarios/tools/awx-ee/bindep.txt diff --git a/scenarios/sre/tools/awx-ee/execution-environment.yaml b/scenarios/tools/awx-ee/execution-environment.yaml similarity index 89% rename from scenarios/sre/tools/awx-ee/execution-environment.yaml rename to scenarios/tools/awx-ee/execution-environment.yaml index e9f9c24b2..0df30038e 100644 --- a/scenarios/sre/tools/awx-ee/execution-environment.yaml +++ b/scenarios/tools/awx-ee/execution-environment.yaml @@ -29,11 +29,13 @@ additional_build_steps: - RUN . /etc/environment && curl -L "https://dl.k8s.io/release/v1.36.0/bin/linux/${KUBECTL_ARCH}/kubectl" -o kubectl && chmod +x ./kubectl && mv ./kubectl /usr/local/bin/kubectl - RUN . /etc/environment && curl -L "https://get.helm.sh/helm-v4.1.4-linux-${HELM_ARCH}.tar.gz" -o helm.tar.gz && tar -xvf helm.tar.gz && mv ./linux-${HELM_ARCH}/helm /usr/local/bin/helm - RUN . /etc/environment && curl -L "https://awscli.amazonaws.com/awscli-exe-linux-${AWS_ARCH}.zip" -o awscli-exe.zip && unzip awscli-exe.zip && ./aws/install && rm awscli-exe.zip && rm -rf aws + - RUN . /etc/environment && curl -L "https://github.com/open-policy-agent/opa/releases/download/v1.0.0/opa_linux_${ARCH}_static" -o opa && chmod +x ./opa && mv ./opa /usr/local/bin/opa append_final: # Copy binaries from builder stage to final runtime image - COPY --from=builder /usr/local/bin/kubectl /usr/local/bin/kubectl - COPY --from=builder /usr/local/bin/helm /usr/local/bin/helm - COPY --from=builder /usr/local/aws-cli /usr/local/aws-cli + - COPY --from=builder /usr/local/bin/opa /usr/local/bin/opa - RUN ln -s /usr/local/aws-cli/v2/current/bin/aws /usr/local/bin/aws - COPY --from=quay.io/ansible/receptor:devel /usr/bin/receptor /usr/local/bin/receptor - RUN mkdir -p /var/run/receptor diff --git a/scenarios/sre/tools/awx-ee/requirements.txt b/scenarios/tools/awx-ee/requirements.txt similarity index 100% rename from scenarios/sre/tools/awx-ee/requirements.txt rename to scenarios/tools/awx-ee/requirements.txt diff --git a/scenarios/sre/tools/awx-ee/requirements.yml b/scenarios/tools/awx-ee/requirements.yml similarity index 93% rename from scenarios/sre/tools/awx-ee/requirements.yml rename to scenarios/tools/awx-ee/requirements.yml index beaeda4c7..1736ac863 100644 --- a/scenarios/sre/tools/awx-ee/requirements.yml +++ b/scenarios/tools/awx-ee/requirements.yml @@ -2,8 +2,6 @@ collections: - name: amazon.aws version: "11.4.0" - - name: ansible.posix - version: "2.2.2" - name: ansible.windows version: "3.7.0" - name: awx.awx diff --git a/scenarios/sre/tools/awx-ee/tox.ini b/scenarios/tools/awx-ee/tox.ini similarity index 100% rename from scenarios/sre/tools/awx-ee/tox.ini rename to scenarios/tools/awx-ee/tox.ini diff --git a/scenarios/sre/tools/hello-bench/Dockerfile b/scenarios/tools/hello-bench/Dockerfile similarity index 100% rename from scenarios/sre/tools/hello-bench/Dockerfile rename to scenarios/tools/hello-bench/Dockerfile diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/Dockerfile b/scenarios/tools/kubernetes-topology-monitor/Dockerfile similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/Dockerfile rename to scenarios/tools/kubernetes-topology-monitor/Dockerfile diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/Makefile b/scenarios/tools/kubernetes-topology-monitor/Makefile similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/Makefile rename to scenarios/tools/kubernetes-topology-monitor/Makefile diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/README.md b/scenarios/tools/kubernetes-topology-monitor/README.md similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/README.md rename to scenarios/tools/kubernetes-topology-monitor/README.md diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/__init__.py b/scenarios/tools/kubernetes-topology-monitor/__init__.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/__init__.py rename to scenarios/tools/kubernetes-topology-monitor/__init__.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/app.py b/scenarios/tools/kubernetes-topology-monitor/app.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/app.py rename to scenarios/tools/kubernetes-topology-monitor/app.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/.helmignore b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/.helmignore similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/.helmignore rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/.helmignore diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/Chart.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/Chart.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/Chart.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/Chart.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/_helpers.tpl b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/_helpers.tpl similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/_helpers.tpl rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/_helpers.tpl diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role_binding.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role_binding.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role_binding.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/cluster_role_binding.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service_account.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service_account.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service_account.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/service_account.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/statefulset.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/statefulset.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/statefulset.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/templates/statefulset.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/values.yaml b/scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/values.yaml similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/values.yaml rename to scenarios/tools/kubernetes-topology-monitor/charts/kubernetes-topology-monitor/values.yaml diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/event_manager.py b/scenarios/tools/kubernetes-topology-monitor/event_manager.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/event_manager.py rename to scenarios/tools/kubernetes-topology-monitor/event_manager.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/main.py b/scenarios/tools/kubernetes-topology-monitor/main.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/main.py rename to scenarios/tools/kubernetes-topology-monitor/main.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/path_finder.py b/scenarios/tools/kubernetes-topology-monitor/path_finder.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/path_finder.py rename to scenarios/tools/kubernetes-topology-monitor/path_finder.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/requirements.txt b/scenarios/tools/kubernetes-topology-monitor/requirements.txt similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/requirements.txt rename to scenarios/tools/kubernetes-topology-monitor/requirements.txt diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/resource_watcher.py b/scenarios/tools/kubernetes-topology-monitor/resource_watcher.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/resource_watcher.py rename to scenarios/tools/kubernetes-topology-monitor/resource_watcher.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/taxonomy_creator.py b/scenarios/tools/kubernetes-topology-monitor/taxonomy_creator.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/taxonomy_creator.py rename to scenarios/tools/kubernetes-topology-monitor/taxonomy_creator.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/topology_analyzer.py b/scenarios/tools/kubernetes-topology-monitor/topology_analyzer.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/topology_analyzer.py rename to scenarios/tools/kubernetes-topology-monitor/topology_analyzer.py diff --git a/scenarios/sre/tools/kubernetes-topology-monitor/topology_manager.py b/scenarios/tools/kubernetes-topology-monitor/topology_manager.py similarity index 100% rename from scenarios/sre/tools/kubernetes-topology-monitor/topology_manager.py rename to scenarios/tools/kubernetes-topology-monitor/topology_manager.py diff --git a/scenarios/sre/tools/opentelemetry-collector-builder/Dockerfile b/scenarios/tools/opentelemetry-collector-builder/Dockerfile similarity index 100% rename from scenarios/sre/tools/opentelemetry-collector-builder/Dockerfile rename to scenarios/tools/opentelemetry-collector-builder/Dockerfile diff --git a/scenarios/sre/tools/opentelemetry-collector-builder/builder-config.yaml b/scenarios/tools/opentelemetry-collector-builder/builder-config.yaml similarity index 100% rename from scenarios/sre/tools/opentelemetry-collector-builder/builder-config.yaml rename to scenarios/tools/opentelemetry-collector-builder/builder-config.yaml diff --git a/scenarios/sre/tools/opentelemetry-collector-builder/go.mod b/scenarios/tools/opentelemetry-collector-builder/go.mod similarity index 100% rename from scenarios/sre/tools/opentelemetry-collector-builder/go.mod rename to scenarios/tools/opentelemetry-collector-builder/go.mod diff --git a/scenarios/sre/tools/opentelemetry-collector-builder/go.sum b/scenarios/tools/opentelemetry-collector-builder/go.sum similarity index 100% rename from scenarios/sre/tools/opentelemetry-collector-builder/go.sum rename to scenarios/tools/opentelemetry-collector-builder/go.sum diff --git a/schemas/json/faults/active-host-network-kubernetes-deployment.json b/schemas/json/faults/active-host-network-kubernetes-deployment.json new file mode 100644 index 000000000..4481f46a6 --- /dev/null +++ b/schemas/json/faults/active-host-network-kubernetes-deployment.json @@ -0,0 +1,46 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" +} diff --git a/schemas/json/faults/enabled-x11-forwarding-rhel9-sshd.json b/schemas/json/faults/enabled-x11-forwarding-rhel9-sshd.json new file mode 100644 index 000000000..48ed3617c --- /dev/null +++ b/schemas/json/faults/enabled-x11-forwarding-rhel9-sshd.json @@ -0,0 +1,20 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "properties": { + "virtualMachine": { + "properties": { + "hostname": { + "type": "string" + } + }, + "required": [ + "hostname" + ], + "type": "object" + } + }, + "required": [ + "virtualMachine" + ], + "type": "object" +} diff --git a/schemas/json/faults/non-compliant-kubernetes-pod-deployment.json b/schemas/json/faults/non-compliant-kubernetes-pod-deployment.json new file mode 100644 index 000000000..4481f46a6 --- /dev/null +++ b/schemas/json/faults/non-compliant-kubernetes-pod-deployment.json @@ -0,0 +1,46 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" +} diff --git a/schemas/json/library/index/fault.json b/schemas/json/library/index/fault.json index f4ff79ea7..b579b42f9 100644 --- a/schemas/json/library/index/fault.json +++ b/schemas/json/library/index/fault.json @@ -54,7 +54,8 @@ }, "platform": { "enum": [ - "Kubernetes" + "Kubernetes", + "RHEL9" ], "type": "string" }, @@ -106,6 +107,7 @@ "enum": [ "Authentication", "Code", + "Compliance", "Deployment", "Networking", "Performance" diff --git a/schemas/json/library/index/scenario.json b/schemas/json/library/index/scenario.json index 285cbb3a1..2a6541eca 100644 --- a/schemas/json/library/index/scenario.json +++ b/schemas/json/library/index/scenario.json @@ -214,6 +214,22 @@ } } }, + { + "if": { + "properties": { + "id": { + "const": "corrupted-kubernetes-secret-credentials" + } + } + }, + "then": { + "properties": { + "args": { + "$ref": "../../faults/corrupted-kubernetes-secret-credentials.json" + } + } + } + }, { "if": { "properties": { @@ -310,6 +326,22 @@ } } }, + { + "if": { + "properties": { + "id": { + "const": "active-host-network-kubernetes-deployment" + } + } + }, + "then": { + "properties": { + "args": { + "$ref": "../../faults/active-host-network-kubernetes-deployment.json" + } + } + } + }, { "if": { "properties": { @@ -342,6 +374,22 @@ } } }, + { + "if": { + "properties": { + "id": { + "const": "enabled-x11-forwarding-rhel9-sshd" + } + } + }, + "then": { + "properties": { + "args": { + "$ref": "../../faults/enabled-x11-forwarding-rhel9-sshd.json" + } + } + } + }, { "if": { "properties": { @@ -390,6 +438,22 @@ } } }, + { + "if": { + "properties": { + "id": { + "const": "non-compliant-kubernetes-pod-deployment" + } + } + }, + "then": { + "properties": { + "args": { + "$ref": "../../faults/non-compliant-kubernetes-pod-deployment.json" + } + } + } + }, { "if": { "properties": { @@ -567,17 +631,21 @@ "kubernetes-api-server-request-surge", "unsupported-architecture-kubernetes-workload-container-image", "deleted-kubernetes-service", + "corrupted-kubernetes-secret-credentials", "valkey-workload-changed-password", "cordoned-kubernetes-worker-node", "misconfigured-kubernetes-horizontal-pod-autoscaler", "crashing-kubernetes-workload-init-container", "valkey-workload-out-of-memory", "misconfigured-kubernetes-workload-container-readiness-probe", + "active-host-network-kubernetes-deployment", "unassigned-kubernetes-workload-container-resource-limits", "unschedulable-kubernetes-workload-pod-anti-affinity-rule", + "enabled-x11-forwarding-rhel9-sshd", "modified-kubernetes-workload-container-environment-variable", "invalid-kubernetes-service-selector", "disabled-istio-ambient-mode-kubernetes-namespace", + "non-compliant-kubernetes-pod-deployment", "insufficient-kubernetes-workload-container-resources", "strict-mutual-tls-istio-service-mesh-enforcement", "opentelemetry-demo-feature-flag", @@ -662,6 +730,22 @@ } } } + }, + { + "if": { + "properties": { + "id": { + "const": "verify-kyverno-policy-report-creation" + } + } + }, + "then": { + "properties": { + "args": { + "$ref": "../../waiters/verify-kyverno-policy-report-creation.json" + } + } + } } ], "properties": { @@ -673,7 +757,8 @@ "delete-workload-pods", "pause-execution", "restart-kubernetes-workload", - "scale-kubernetes-workload" + "scale-kubernetes-workload", + "verify-kyverno-policy-report-creation" ], "type": "string" } @@ -695,6 +780,7 @@ }, "category": { "enum": [ + "ciso", "finops", "sre" ], @@ -749,7 +835,6 @@ "items": { "$ref": "#/$defs/applicationItem" }, - "minItems": 1, "type": "array" } }, @@ -798,6 +883,12 @@ }, "type": "array" }, + "states": { + "items": { + "type": "object" + }, + "type": "array" + }, "tags": { "items": { "type": "string" diff --git a/schemas/json/waiters/verify-kyverno-policy-report-creation.json b/schemas/json/waiters/verify-kyverno-policy-report-creation.json new file mode 100644 index 000000000..4481f46a6 --- /dev/null +++ b/schemas/json/waiters/verify-kyverno-policy-report-creation.json @@ -0,0 +1,46 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "properties": { + "kubernetesObject": { + "properties": { + "apiVersion": { + "enum": [ + "apps/v1" + ], + "type": "string" + }, + "kind": { + "enum": [ + "Deployment" + ], + "type": "string" + }, + "metadata": { + "properties": { + "name": { + "type": "string" + }, + "namespace": { + "type": "string" + } + }, + "required": [ + "name", + "namespace" + ], + "type": "object" + } + }, + "required": [ + "apiVersion", + "kind", + "metadata" + ], + "type": "object" + } + }, + "required": [ + "kubernetesObject" + ], + "type": "object" +} diff --git a/uv.lock b/uv.lock index 9db319325..e7e795df7 100644 --- a/uv.lock +++ b/uv.lock @@ -662,6 +662,20 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/12/b3/231ffd4ab1fc9d679809f356cebee130ac7daa00d6d6f3206dd4fd137e9e/distro-1.9.0-py3-none-any.whl", hash = "sha256:7bffd925d65168f85027d8da9af6bddab658135b840670a223589bc0c8ef02b2", size = 20277, upload-time = "2023-12-24T09:54:30.421Z" }, ] +[[package]] +name = "docker" +version = "7.2.0" +source = { registry = "https://pypi.org/simple" } +dependencies = [ + { name = "pywin32", marker = "sys_platform == 'win32'" }, + { name = "requests" }, + { name = "urllib3" }, +] +sdist = { url = "https://files.pythonhosted.org/packages/88/7f/731ff914b0255d3d065f45fd4e626d4b8c95dbcbaada049f337a6ac16410/docker-7.2.0.tar.gz", hash = "sha256:cebb93773d334f778e023a7ee352a8d6e13ab1bd3b863a4d4a59dec897df43ac", size = 118731, upload-time = "2026-07-09T14:53:46.39Z" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/75/23/529140fe1aab80fc6992f93a706deec709140a6397439139a054e1515c45/docker-7.2.0-py3-none-any.whl", hash = "sha256:a3f45fdeb9165e2d25d9a1d02ddf3bc70fb572cf5ebbf9b58558c22caf29b71f", size = 148775, upload-time = "2026-07-09T14:53:45.224Z" }, +] + [[package]] name = "durationpy" version = "0.10" @@ -809,6 +823,7 @@ dependencies = [ { name = "ansible-runner" }, { name = "awxkit" }, { name = "boto3" }, + { name = "docker" }, { name = "jsonschema" }, { name = "kubernetes" }, { name = "molecule" }, @@ -829,6 +844,7 @@ requires-dist = [ { name = "ansible-runner", specifier = "==2.4.3" }, { name = "awxkit", specifier = "==24.6.1" }, { name = "boto3", specifier = "==1.43.70" }, + { name = "docker", specifier = "==7.2.0" }, { name = "jsonschema", specifier = "==4.26.0" }, { name = "kubernetes", specifier = "==36.0.3" }, { name = "molecule", specifier = "==26.8.0" }, @@ -1444,6 +1460,22 @@ wheels = [ { url = "https://files.pythonhosted.org/packages/c6/78/397db326746f0a342855b81216ae1f0a32965deccfd7c830a2dbc66d2483/pytokens-0.4.1-py3-none-any.whl", hash = "sha256:26cef14744a8385f35d0e095dc8b3a7583f6c953c2e3d269c7f82484bf5ad2de", size = 13729, upload-time = "2026-01-30T01:03:45.029Z" }, ] +[[package]] +name = "pywin32" +version = "312" +source = { registry = "https://pypi.org/simple" } +wheels = [ + { url = "https://files.pythonhosted.org/packages/83/ff/32aa7d2ed0ab12b323aaa64f9b75e6ad4f8fd09f9ccfc28c79414d46838d/pywin32-312-cp312-cp312-win32.whl", hash = "sha256:dab4f65ac9c4e48400a2a0530c46c3c579cd5905ecd11b80692373915269208b", size = 6371877, upload-time = "2026-06-04T07:49:28.836Z" }, + { url = "https://files.pythonhosted.org/packages/03/d9/77040d3b43df3f3be32ea289433d660d2727f5ba327bc73be835127d9d60/pywin32-312-cp312-cp312-win_amd64.whl", hash = "sha256:b457f6d628a47e8a7346ce22acb7e1a46a4a78b52e1d17e1af56871bd19a93bc", size = 6914841, upload-time = "2026-06-04T07:49:31.85Z" }, + { url = "https://files.pythonhosted.org/packages/e3/cc/7b1ec671775756020a0ee7f4feeaf3c568f0ab86bd3900088cf986937a92/pywin32-312-cp312-cp312-win_arm64.whl", hash = "sha256:6017c58e12f6809fbb0555b75df144c2922a9ffd18e4b9b5afa863b6c1a9d950", size = 6727901, upload-time = "2026-06-04T07:49:34.244Z" }, + { url = "https://files.pythonhosted.org/packages/2d/41/12fbfd7f36ed2146d8bc9de96c2741296bf0d490b98508496cff322e274c/pywin32-312-cp313-cp313-win32.whl", hash = "sha256:7a27df850933d16a8eabfbaeb73d52b273e2da667f80d70b01a89d1f6828d02c", size = 6370184, upload-time = "2026-06-04T07:49:36.253Z" }, + { url = "https://files.pythonhosted.org/packages/ba/db/36a78e3403099d31d9746d13fdcde5accc43c1155f375a34d15983a479a7/pywin32-312-cp313-cp313-win_amd64.whl", hash = "sha256:c53e878d15a1c44788082bfe712a905433473aa38f86375b7cf8b45e3acbaaf9", size = 6914298, upload-time = "2026-06-04T07:49:38.876Z" }, + { url = "https://files.pythonhosted.org/packages/84/37/c1697194092b76de9ed47ca124323f02c57ffc8a45c06f88a3d5acaf01eb/pywin32-312-cp313-cp313-win_arm64.whl", hash = "sha256:59aba5d5940842075343a5ddc6b11f1cdf0d1567fe745290359dfbcc7c2eb831", size = 6727640, upload-time = "2026-06-04T07:49:41.083Z" }, + { url = "https://files.pythonhosted.org/packages/fc/2b/1f3cded5822fd49c02f40544cbb5f58c7cfd6b1694869fd476cb6170ee97/pywin32-312-cp314-cp314-win32.whl", hash = "sha256:a77a90fbb6881238d2ca9c6fd797b25817f3768fe78d214a90137ff055a75f5b", size = 6468928, upload-time = "2026-06-04T07:49:43.188Z" }, + { url = "https://files.pythonhosted.org/packages/21/82/3bf86d2e2808902013132e1ce905a7da0da53790f3836c64bf44d55e24f3/pywin32-312-cp314-cp314-win_amd64.whl", hash = "sha256:a4dd3a848290ef724347b19f301045831d8e802fa4464f491b98b1e0a081432e", size = 7024157, upload-time = "2026-06-04T07:49:45.34Z" }, + { url = "https://files.pythonhosted.org/packages/a4/0e/73f6d6800b4f27655abd9e9f6aaeaefcddb2b946e4674efa2bab184a7f7b/pywin32-312-cp314-cp314-win_arm64.whl", hash = "sha256:9fce94568364e0155e6dfb781ac5d95903be8baf28670632beab1b523f300daa", size = 6839598, upload-time = "2026-06-04T07:49:47.613Z" }, +] + [[package]] name = "pyyaml" version = "6.0.3"