Add OpenShift Route security check

pkg/builtinchecks/yamls/insecure-route-termination.yaml

@@ -0,0 +1,17 @@
+name: insecure-route-termination
+description: >-
+  OpenShift Route allows plaintext HTTP via InsecureEdgeTerminationPolicy: Allow.
+  Credential-bearing endpoints should enforce TLS by using Redirect or None.
+remediation: >-
+  Set spec.tls.insecureEdgeTerminationPolicy to 'Redirect' or 'None'.
+scope:
+  objectKinds:
+    - Any
+template: cel-expression
+params:
+  check: >
+    object.kind == 'Route' &&
+    has(object.spec.tls) &&
+    has(object.spec.tls.insecureEdgeTerminationPolicy) &&
+    object.spec.tls.insecureEdgeTerminationPolicy == 'Allow'
+    ? 'Route allows plaintext HTTP — credential-bearing endpoints should use Redirect or None' : ''

tests/checks/insecure-route-termination.yml

@@ -0,0 +1,45 @@
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: dont-fire-redirect
+spec:
+  to:
+    kind: Service
+    name: my-service
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Redirect
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: dont-fire-none
+spec:
+  to:
+    kind: Service
+    name: my-service
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: None
+---
+apiVersion: route.openshift.io/v1
+kind: Route
+metadata:
+  name: fire-allow-insecure
+spec:
+  to:
+    kind: Service
+    name: my-service
+  tls:
+    termination: edge
+    insecureEdgeTerminationPolicy: Allow
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dont-fire-not-a-route
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80