[yashshree2002]

The rule text (description, OCIL, expected path) already talked about openshift-apiserver, but the check logic still pointed at openshift-kube-apiserver (copy-paste from the kube-apiserver rule).

So the scan:

Read kube-apiserver’s ConfigMap (audit-log-path = /var/log/kube-apiserver/audit.log)
Compared it to OpenShift API Server’s expected value (/var/log/openshift-apiserver/audit.log)
Always FAIL, even on a correctly configured cluster
Sibling rule api_server_audit_log_path (kube-apiserver) correctly PASSed. Same ConfigMap, different expected value → permanent false FAIL for this rule.

Correct API path:

default_api_path
Before: /api/v1/namespaces/openshift-kube-apiserver/configmaps/config
After: /api/v1/namespaces/openshift-apiserver/configmaps/config

This is the core OCPBUGS-126610 fix: inspect the OpenShift API Server ConfigMap.

Cluster setting warning
Before:

warnings:
    - general: |-
        {{{ openshift_cluster_setting("/api/v1/namespaces/openshift-apiserver/configmaps/config") | indent(8) }}}

After:

warnings:
- general: |-
    {{{ openshift_filtered_cluster_setting({custom_api_path: dump_path}) | indent(4) }}}

Expected result after fix
On a OCP cluster where:
oc get cm config -n openshift-apiserver -o json | jq -r '.data["config.yaml"]' | jq '.apiServerArguments["audit-log-path"]' → ["/var/log/openshift-apiserver/audit.log"]
ocp4-cis-openshift-api-server-audit-log-path should PASS instead of always FAIL.

File changed

applications/openshift/openshift-api-server/openshift_api_server_audit_log_path/rule.yml

[openshift-ci]

Hi @yashshree2002. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

This datastream diff is auto generated by the check Compare DS/Generate Diff

Click here to see the full diff

New content has different text for rule 'xccdf_org.ssgproject.content_rule_openshift_api_server_audit_log_path'.
--- xccdf_org.ssgproject.content_rule_openshift_api_server_audit_log_path
+++ xccdf_org.ssgproject.content_rule_openshift_api_server_audit_log_path
@@ -17,7 +17,13 @@
 
 [warning]:
 This rule's check operates on the cluster configuration dump.
-Therefore, you need to use a tool that can query the OCP API, retrieve the /api/v1/namespaces/openshift-apiserver/configmaps/config API endpoint to the local /api/v1/namespaces/openshift-apiserver/configmaps/config file.
+Therefore, you need to use a tool that can query the OCP API, retrieve the following:
+{{if ne .hypershift_cluster "None"}}/api/v1/namespaces/{{.hypershift_namespace_prefix}}-{{.hypershift_cluster}}/configmaps/openshift-apiserver{{else}}/api/v1/namespaces/openshift-apiserver/configmaps/config{{end}}
+    API endpoint, filter with with the jq utility using the following filter
+    {{if ne .hypershift_cluster "None"}}.data."config.yaml"{{else}}.data."config.yaml" | fromjson{{end}}
+    and persist it to the local
+    /api/v1/namespaces/openshift-apiserver/configmaps/config#45ae2c88fe28d39a42f19e165a1612353224e9663eb369000e03c7efcd10ef59
+    file.
 
 [reference]:
 CIP-003-8 R6