CMP-3580: Implement checks for unsupported API server configs

[rhmdnd]

CIS has guidance that recommends checking Kubernetes and OpenShift API
servers for any unsupported configuration options (control 1.2.33 in
newer versions and 1.2.31 in recent versions). This commit adds two new
rules to check the API servers for unsupported configs so that users
have some automated way of checking this control, even though OpenShift
doesn't use this feature by default.

[rhmdnd]

/test 4.18-e2e-aws-ocp4-cis

[rhmdnd]

Strange - these didn't get picked up in the OCP4 cis testing.

[rhmdnd]

Adding in the platform.

[yuumasato]

The rule still didn't show up in the test's artifacts.
Could it be that it is still not using the PR sources to build? Although I see the following in the logs:

2025/10/02 14:00:23 Using content image: registry.build09.ci.openshift.org/ci-op-pcld3z78/pipeline@sha256:4e75e0a42dd7be2834916360232767bee51f2b9d5af9f06b7e492c31c1ba0502

[rhmdnd]

The rule is getting build and put in the datastream, but it still doesn't seem to run in CI.

[rhmdnd]

Looks like we're passing the content image from the PR correctly - https://github.com/openshift/release/blob/master/ci-operator/config/ComplianceAsCode/content/ComplianceAsCode-content-master__4.18.yaml#L225

[yuumasato]

@rhmdnd component doesn't seem to be used anywhere. Regardless, --content-image=$CONTENT_IMAGE seems correct.
From the logs:

+ go test . '-run=^TestPlatformCompliance$' -test-type=platform -content-image=registry.build11.ci.openshift.org/ci-op-mv6gph1y/pipeline@sha256:01d6114df7283f8cb722b017747c4de25eb5f42baa6d761eb34b6de17d0793f8 -content-directory=/go/src/github.com/ComplianceAsCode/content

[yuumasato]

This PR looks good to me, @rhmdnd
But would you like to use this PR as testing grounds to understand why it doesn't show up in the tests?

[rhmdnd]

/test 4.18-e2e-aws-ocp4-cis

[yuumasato]

@rhmdnd On an OCP 4.20 the rule is falling. When I probe manually I get this:

$ oc get kubeapiserver cluster -o yaml | grep unsupported 
  unsupportedConfigOverrides: null
$  oc get kubeapiserver cluster -o jsonpath={.spec.unsupportedConfigOverrides}
null

So the key seems to exist, its value is null though.

[yuumasato]

I get the same unsupportedConfigOverrides: null result on OCP 4.19.

[yuumasato]

This is what I get in the logs:

14926 D: oscap: Message received. [oscap(3):oscap(7fc023377940):oval_probe_ext.c:579:oval_probe_comm]
14927 D: oscap: name=(null), value=0x7fbfbc01ea10 [oscap(3):oscap(7fc023377940):seap-message.c:71:SEAP_msg_free]
14928 I: oscap: Test 'oval:ssg-test_file_for_api_server_kube_no_unsupported_config_overrides:tst:1' requires that only one object defined by 'oval:ssg-object_file_for_api_server_kube_no_unsupported_config_overrides:obj:1' exists on the system. [oscap(3):oscap(7fc023377940):oval_resultTest.c:912:_oval_result_test_evaluate_items]
14929 I: oscap: 0 objects defined by 'oval:ssg-object_file_for_api_server_kube_no_unsupported_config_overrides:obj:1' exist on the system. [oscap(3):oscap(7fc023377940):oval_resultTest.c:918:_oval_result_test_evaluate_items]
14930 I: oscap: Test 'oval:ssg-test_file_for_api_server_kube_no_unsupported_config_overrides:tst:1' does not contain any state to compare object with. [oscap(3):oscap(7fc023377940):oval_resultTest.c:920:_oval_result_test_evaluate_items]
14931 I: oscap: No item matching object 'oval:ssg-object_file_for_api_server_kube_no_unsupported_config_overrides:obj:1' was found on the system. (flag=does not exist) [oscap(3):oscap(7fc023377940):oval_resultTest.c:954:_oval_result_test_evaluate_items]
14932 I: oscap: Test 'oval:ssg-test_file_for_api_server_kube_no_unsupported_config_overrides:tst:1' evaluated as false. [oscap(3):oscap(7fc023377940):oval_resultTest.c:1164:oval_result_test_eval]
14933 I: oscap: Definition 'oval:ssg-api_server_kube_no_unsupported_config_overrides:def:1' evaluated as false. [oscap(3):oscap(7fc023377940):oval_resultDefinition.c:170:oval_result_definition_eval]
14934 Result^M    fail

[rhmdnd]

/test 4.18-e2e-aws-ocp4-cis

[openshift-ci]

@rhmdnd: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/4.18-e2e-aws-ocp4-cis	aa80d2f	link	true	/test 4.18-e2e-aws-ocp4-cis
ci/prow/e2e-aws-openshift-node-compliance	aa80d2f	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[yuumasato]

Rules are passing when tested manually.
But the ocp4-cis and platform-compliance tests are still not showing the new unsupported-override rules.