CMP-4110: Implement CIS OpenShift version 1.9.0

[rhmdnd]

• Bump CIS OpenShift version from 1.7.0 to 1.9.0
• Add CIS OpenShift 1.9.0 profile and controls
• Implement CIS OpenShift v1.9.0 section 1
• Add CIS OpenShift v1.9.0 section 2
• Implement CIS OpenShift v1.9.0 section 3
• Implement CIS OpenShift v1.9.0 section 4
• Implement CIS OpenShift v1.9.0 section 5

[Anna-Koudelkova]

Pre-merge verification passed on OCP 4.18 + compliance operator 1.8.2 +content build with this PR.
Verification steps:

1. Install CO 1.8.2. and build content from this PR.
2. Verify CIS 1.9.0 is present

$ oc get profiles | grep cis
ocp4-cis                                  40m   1.7.0
ocp4-cis-1-7                              40m   1.7.0
ocp4-cis-node                             40m   1.7.0
ocp4-cis-node-1-7                         40m   1.7.0
upstream-ocp4-cis                         38m   1.9.0
upstream-ocp4-cis-1-7                     38m   1.7.0
upstream-ocp4-cis-1-9                     38m   1.9.0
upstream-ocp4-cis-node                    38m   1.9.0
upstream-ocp4-cis-node-1-7                38m   1.7.0
upstream-ocp4-cis-node-1-9                38m   1.9.0

3. Create a ssb with the new profiles, check it is ready and check the result of suite, scans, ccr and cr gets created:

$ oc compliance bind -N test profile/upstream-ocp4-cis-1-9 profile/upstream-ocp4-cis-node-1-9
Creating ScanSettingBinding test

$ oc get suite
NAME   PHASE   RESULT
test   DONE    NON-COMPLIANT

$ oc get scans
NAME                                PHASE   RESULT
upstream-ocp4-cis-1-9               DONE    NON-COMPLIANT
upstream-ocp4-cis-node-1-9-master   DONE    COMPLIANT
upstream-ocp4-cis-node-1-9-worker   DONE    COMPLIANT

$ oc get ccr
NAME                                                                                       STATUS   SEVERITY
upstream-ocp4-cis-1-9-accounts-restrict-service-account-tokens                             MANUAL   medium
upstream-ocp4-cis-1-9-accounts-unique-service-account                                      MANUAL   medium
upstream-ocp4-cis-1-9-api-server-admission-control-plugin-alwaysadmit                      PASS     medium
upstream-ocp4-cis-1-9-api-server-admission-control-plugin-alwayspullimages                 PASS     high
upstream-ocp4-cis-1-9-api-server-admission-control-plugin-namespacelifecycle               PASS     medium
...

$ oc get cr
NAME                                                            STATE
upstream-ocp4-cis-1-9-api-server-encryption-provider-cipher-1   NotApplied
upstream-ocp4-cis-1-9-audit-profile-set                         NotApplied
upstream-ocp4-cis-1-9-ingress-controller-tls-cipher-suites      NotApplied

[taimurhafeez]

Passed on OCP 4.21:

1. SSb used:

cat ssb-for-cis190.yaml 
apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: upstream-ocp4-cis-1-9
  namespace: openshift-compliance
profiles:
  - name: upstream-ocp4-cis-1-9
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
settingsRef:
  name: default
  kind: ScanSetting
  apiGroup: compliance.openshift.io/v1alpha1

2. Confirming profiles

oc get profiles | grep cis
ocp4-cis                                  4m54s   1.7.0
ocp4-cis-1-7                              4m54s   1.7.0
ocp4-cis-node                             4m54s   1.7.0
ocp4-cis-node-1-7                         4m54s   1.7.0
upstream-ocp4-cis                         27s     1.9.0
upstream-ocp4-cis-1-7                     27s     1.7.0
upstream-ocp4-cis-1-9                     27s     1.9.0
upstream-ocp4-cis-node                    27s     1.9.0
upstream-ocp4-cis-node-1-7                27s     1.7.0
upstream-ocp4-cis-node-1-9                27s     1.9.0

3. Getting suites, scans, ccrs

oc get compliancesuites -n openshift-compliance
NAME                    PHASE   RESULT
upstream-ocp4-cis-1-9   DONE    NON-COMPLIANT
oc get scans
NAME                    PHASE   RESULT
upstream-ocp4-cis-1-9   DONE    NON-COMPLIANT
oc get ccr
NAME                                                                           STATUS   SEVERITY
upstream-ocp4-cis-1-9-accounts-restrict-service-account-tokens                 MANUAL   medium
upstream-ocp4-cis-1-9-accounts-unique-service-account                          MANUAL   medium
upstream-ocp4-cis-1-9-api-server-admission-control-plugin-alwaysadmit          PASS     medium
....
oc get cr
NAME                                                            STATE
upstream-ocp4-cis-1-9-api-server-encryption-provider-cipher-1   NotApplied
upstream-ocp4-cis-1-9-audit-profile-set                         NotApplied
upstream-ocp4-cis-1-9-ingress-controller-tls-cipher-suites      NotApplied

4. Count rules in both versions:

echo "1.7.0 rules:" && oc get profile upstream-ocp4-cis-1-7 -n openshift-compliance -o jsonpath='{.rules[*]}' | tr ' ' '\n' | wc -l
1.7.0 rules:
99

echo "1.9.0 rules:" && oc get profile upstream-ocp4-cis-1-9 -n openshift-compliance -o jsonpath='{.rules[*]}' | tr ' ' '\n' | wc -l
1.9.0 rules:
95

5. See the rule difference between v 1.7.0 and 1.9.0

comm -23 \
  <(oc get profile upstream-ocp4-cis-1-7 -n openshift-compliance -o jsonpath='{.rules[*]}' | tr ' ' '\n' | sort) \
  <(oc get profile upstream-ocp4-cis-1-9 -n openshift-compliance -o jsonpath='{.rules[*]}' | tr ' ' '\n' | sort)
upstream-ocp4-api-server-basic-auth
upstream-ocp4-api-server-token-auth
upstream-ocp4-controller-insecure-port-disabled
upstream-ocp4-controller-secure-port

[xiaojiey]

/lgtm
Added deprecation check for cis 1-7 profiles:

$ oc get profile upstream-ocp4-cis-1-7 -o=jsonpath={.metadata.annotations.compliance\\.openshift\\.io/profile-status} 
deprecated
$ oc get profile upstream-ocp4-cis-node-1-7 -o=jsonpath={.metadata.annotations.compliance\\.openshift\\.io/profile-status} 
deprecated