Rip out compensating-controls framework (#359)
## Summary Removes the compensating-controls (CC) framework. Prowler and Kingfisher continue to run weekly and produce reports; the Prowler mutelist YAML files stay in place but no longer carry \`CC: <id>\` prefixes — each entry now just keeps a free-form \`Description\` of why it's muted. The CC review cadence proved to be more process overhead than this single-operator homelab needed. ## What changed **Deleted** - \`compensating-controls.yaml\` — the CC registry - \`mise-tasks/review-compensating-controls\` — the staleness-review task - \`docs/how-to/operations/review-compensating-controls.md\` - \`docs/how-to/operations/record-review-evidence.md\` (was aspirational) - \`docs/explanation/compliance-mute-categories.md\` (proposed-future CC/NA/RA work) - 5 orphan \`+review-cc-*\` / \`+compliance-mute-categories\` changelog fragments **Modified** - 6 mutelist YAML files: stripped \`CC: <id>.\` prefix from every \`Description\` / \`statement\` field, kept the free-form text - \`mise-tasks/review-compliance-reports\`: removed CC mentions from docstrings, panel text, and the node-verification table title. Node-verification logic itself is unchanged. - \`docs/reference/operations/security.md\`: removed the "Compensating controls" section - \`docs/how-to/operations/read-compliance-reports.md\`: rewrote step 3 of "Acting on findings" to point at the mutelist YAML directly - \`docs/changelog.d/prowler-iac-mutelist.infra.md\`: rewrote to drop the "two new compensating controls" framing ## What did not change - All Prowler manifests (cronjobs, RBAC, PVs, kustomization) — scans still run on the same schedule - The Kingfisher deployment - The trivy-shim in the Prowler container — that's about Trivy ignorefile plumbing, independent of the CC concept - The mutelist entries themselves — each \`Resources\` list is unchanged; only the prose of \`Description\` was edited - \`CHANGELOG.md\` — historical releases are left as-is ## Test plan - [ ] Wait for human review before deploying — once merged, re-point ArgoCD: \`argocd app set prowler --revision main && argocd app sync prowler\` (no manifest changes besides the ConfigMap, so impact is limited to muted-finding descriptions in next week's report) - [ ] Confirm next weekly Prowler K8s CIS run (Sunday 3am) still completes and produces a report on sifaka - [ ] Confirm next weekly Prowler IaC run still honors \`trivyignore.yaml\` (the trivy shim is untouched but the ignorefile content was rewritten) - [ ] \`mise run review-compliance-reports\` — verify node-verification block still runs and prints the renamed table title Reviewed-on: #359
This commit is contained in:
parent
2fae0f7161
commit
ee51bcafb4
21 changed files with 72 additions and 758 deletions
|
|
@ -1,229 +0,0 @@
|
|||
#!/usr/bin/env -S uv run --script
|
||||
# /// script
|
||||
# requires-python = ">=3.12"
|
||||
# dependencies = ["pyyaml==6.0.3", "rich==15.0.0", "typer==0.25.0"]
|
||||
# ///
|
||||
#MISE description="Review the most stale compensating control"
|
||||
#USAGE flag "--limit <limit>" default="10" help="Number of controls to show in the table"
|
||||
"""Review compensating controls by staleness.
|
||||
|
||||
Reads ``compensating-controls.yaml`` and sorts by ``last-reviewed``.
|
||||
Shows a staleness table, then displays the most stale control with all
|
||||
references found in the codebase.
|
||||
|
||||
After reviewing, update the control entry:
|
||||
|
||||
last-reviewed: YYYY-MM-DD
|
||||
|
||||
Usage: mise run review-compensating-controls [--limit 10]
|
||||
"""
|
||||
|
||||
import subprocess
|
||||
import sys
|
||||
from datetime import date
|
||||
from pathlib import Path
|
||||
from typing import Annotated
|
||||
|
||||
import typer
|
||||
import yaml
|
||||
from rich.console import Console
|
||||
from rich.panel import Panel
|
||||
from rich.table import Table
|
||||
|
||||
CONTROLS_FILE = Path(__file__).parent.parent / "compensating-controls.yaml"
|
||||
REPO_ROOT = Path(__file__).parent.parent
|
||||
|
||||
|
||||
def load_controls(path: Path) -> list[dict]:
|
||||
data = yaml.safe_load(path.read_text())
|
||||
return data.get("controls", [])
|
||||
|
||||
|
||||
def parse_date(raw) -> date | None:
|
||||
if raw is None:
|
||||
return None
|
||||
if isinstance(raw, date):
|
||||
return raw
|
||||
try:
|
||||
return date.fromisoformat(str(raw))
|
||||
except ValueError:
|
||||
return None
|
||||
|
||||
|
||||
def find_references(control_id: str) -> list[str]:
|
||||
"""Find all files referencing a control ID using ripgrep."""
|
||||
try:
|
||||
result = subprocess.run(
|
||||
["rg", "--no-heading", "-n", control_id, str(REPO_ROOT)],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
timeout=10,
|
||||
)
|
||||
lines = result.stdout.strip().splitlines()
|
||||
# Exclude the controls file itself and this script
|
||||
return [
|
||||
ln
|
||||
for ln in lines
|
||||
if "compensating-controls.yaml" not in ln
|
||||
and "review-compensating-controls" not in ln
|
||||
]
|
||||
except (FileNotFoundError, subprocess.TimeoutExpired):
|
||||
return []
|
||||
|
||||
|
||||
def main(
|
||||
limit: Annotated[
|
||||
int, typer.Option(help="Number of controls to show in the table")
|
||||
] = 10,
|
||||
) -> None:
|
||||
console = Console()
|
||||
today = date.today()
|
||||
|
||||
if not CONTROLS_FILE.exists():
|
||||
console.print(
|
||||
f"[bold red]Controls file not found:[/bold red] {CONTROLS_FILE}"
|
||||
)
|
||||
raise typer.Exit(code=1)
|
||||
|
||||
controls = load_controls(CONTROLS_FILE)
|
||||
|
||||
# Parse dates and build sortable entries
|
||||
entries: list[tuple[dict, date | None]] = []
|
||||
for ctrl in controls:
|
||||
reviewed = parse_date(ctrl.get("last-reviewed"))
|
||||
entries.append((ctrl, reviewed))
|
||||
|
||||
# Sort: never-reviewed first, then oldest
|
||||
entries.sort(key=lambda e: (e[1] is not None, e[1] or date.min))
|
||||
|
||||
never_reviewed = sum(1 for _, r in entries if r is None)
|
||||
|
||||
# --- Summary panel ---
|
||||
console.print()
|
||||
console.print(
|
||||
Panel(
|
||||
f"[bold]{len(entries)}[/bold] compensating controls, "
|
||||
f"[bold red]{never_reviewed}[/bold red] never reviewed",
|
||||
title="[bold]Compensating Control Review Queue[/bold]",
|
||||
border_style="cyan",
|
||||
)
|
||||
)
|
||||
console.print()
|
||||
|
||||
# --- Staleness table ---
|
||||
table = Table(show_header=True, header_style="bold")
|
||||
table.add_column("#", justify="right")
|
||||
table.add_column("Control ID")
|
||||
table.add_column("Last Reviewed", justify="right")
|
||||
table.add_column("Age (days)", justify="right")
|
||||
table.add_column("Refs", justify="right")
|
||||
|
||||
for i, (ctrl, reviewed) in enumerate(entries[:limit], 1):
|
||||
control_id = ctrl["id"]
|
||||
refs = len(find_references(control_id))
|
||||
|
||||
if reviewed is None:
|
||||
table.add_row(
|
||||
str(i),
|
||||
f"[red]{control_id}[/red]",
|
||||
"[red]never[/red]",
|
||||
"[red]—[/red]",
|
||||
str(refs),
|
||||
)
|
||||
else:
|
||||
age = (today - reviewed).days
|
||||
style = "yellow" if age > 90 else ""
|
||||
id_str = f"[{style}]{control_id}[/{style}]" if style else control_id
|
||||
date_str = f"[{style}]{reviewed}[/{style}]" if style else str(reviewed)
|
||||
age_str = f"[{style}]{age}[/{style}]" if style else str(age)
|
||||
table.add_row(str(i), id_str, date_str, age_str, str(refs))
|
||||
|
||||
remaining = len(entries) - limit
|
||||
if remaining > 0:
|
||||
table.add_row("", f"[dim]… {remaining} more[/dim]", "", "", "")
|
||||
|
||||
console.print(table)
|
||||
console.print()
|
||||
|
||||
# --- Most stale control detail ---
|
||||
if not entries:
|
||||
console.print("[bold red]No controls found![/bold red]")
|
||||
raise typer.Exit(code=1)
|
||||
|
||||
top_ctrl, top_reviewed = entries[0]
|
||||
control_id = top_ctrl["id"]
|
||||
refs = find_references(control_id)
|
||||
|
||||
detail_lines = [
|
||||
f"[bold cyan]{control_id}[/bold cyan]",
|
||||
f"[dim]Last reviewed: {top_reviewed or 'never'}[/dim]",
|
||||
"",
|
||||
f"[bold]Description:[/bold] {top_ctrl.get('description', '').strip()}",
|
||||
]
|
||||
notes = top_ctrl.get("notes", "").strip()
|
||||
if notes:
|
||||
detail_lines.append(f"[bold]Notes:[/bold] {notes}")
|
||||
|
||||
console.print(
|
||||
Panel(
|
||||
"\n".join(detail_lines),
|
||||
title="[bold]Up For Review[/bold]",
|
||||
border_style="green",
|
||||
)
|
||||
)
|
||||
console.print()
|
||||
|
||||
# --- References ---
|
||||
if refs:
|
||||
ref_table = Table(
|
||||
show_header=True, header_style="bold", title="References in codebase"
|
||||
)
|
||||
ref_table.add_column("File", style="cyan")
|
||||
ref_table.add_column("Line")
|
||||
|
||||
for ref in refs:
|
||||
# rg output: file:line:content
|
||||
parts = ref.split(":", 2)
|
||||
if len(parts) >= 3:
|
||||
filepath = parts[0].replace(str(REPO_ROOT) + "/", "")
|
||||
line_no = parts[1]
|
||||
content = parts[2].strip()
|
||||
ref_table.add_row(f"{filepath}:{line_no}", content)
|
||||
else:
|
||||
ref_table.add_row(ref, "")
|
||||
|
||||
console.print(ref_table)
|
||||
else:
|
||||
console.print(
|
||||
f"[yellow]No references to '{control_id}' found in the codebase.[/yellow]"
|
||||
)
|
||||
console.print()
|
||||
|
||||
# --- Review checklist ---
|
||||
checklist = [
|
||||
"[bold]Verification:[/bold]\n",
|
||||
f"• {notes}\n" if notes else "",
|
||||
"\n[bold]Review each reference:[/bold]\n",
|
||||
"• For each muted finding referencing this control, confirm:\n",
|
||||
" 1. The risk the original check guards against\n",
|
||||
" 2. That this control actually mitigates that risk\n",
|
||||
" 3. That the control is still in effect (not degraded or bypassed)\n",
|
||||
"\n[bold]After review:[/bold]\n",
|
||||
f"• Update compensating-controls.yaml: [cyan]last-reviewed: {today}[/cyan]\n",
|
||||
"• If the control is no longer valid, either:\n",
|
||||
" - Fix the underlying finding and remove the mute, or\n",
|
||||
" - Document a new/updated compensating control\n",
|
||||
"• Commit the change",
|
||||
]
|
||||
|
||||
console.print(
|
||||
Panel(
|
||||
"".join(checklist),
|
||||
title="[bold yellow]Review Guidance[/bold yellow]",
|
||||
border_style="yellow",
|
||||
)
|
||||
)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
typer.run(main)
|
||||
|
|
@ -143,7 +143,10 @@ def _kubectl(args: str, timeout: int = 15) -> subprocess.CompletedProcess:
|
|||
def run_node_verification(console: Console) -> None:
|
||||
"""Verify node-level conditions that Prowler reports as MANUAL.
|
||||
|
||||
Compensating control: node-config-automated-verification
|
||||
Prowler runs inside a pod and can't evaluate kubelet file permissions,
|
||||
kubelet config arguments, etcd CA separation, or cluster-admin RBAC
|
||||
bindings. We SSH into the minikube node and check each condition here,
|
||||
failing loudly if any deviates from expected values.
|
||||
"""
|
||||
checks: list[tuple[str, str, bool]] = [] # (name, detail, passed)
|
||||
|
||||
|
|
@ -278,7 +281,7 @@ def run_node_verification(console: Console) -> None:
|
|||
table = Table(
|
||||
show_header=True,
|
||||
header_style="bold",
|
||||
title="Node Verification (CC: node-config-automated-verification)",
|
||||
title="Node Verification (out-of-band checks for MANUAL findings)",
|
||||
)
|
||||
table.add_column("Check")
|
||||
table.add_column("Detail")
|
||||
|
|
@ -528,8 +531,8 @@ def summarize_report(
|
|||
Panel(
|
||||
f"[bold yellow]{len(latest['unmuted'])} unmuted failure(s) "
|
||||
f"need triage.[/bold yellow]\n\n"
|
||||
"For each: remediate or mute "
|
||||
"(add to mutelist + compensating control).",
|
||||
"For each: remediate, or add a Resource entry to the "
|
||||
"matching check in argocd/manifests/prowler/mutelist/.",
|
||||
title=f"{label} Verdict",
|
||||
border_style="yellow",
|
||||
)
|
||||
|
|
@ -653,7 +656,6 @@ def main(
|
|||
)
|
||||
|
||||
# --- Node-level MANUAL check verification ---
|
||||
# Compensating control: node-config-automated-verification
|
||||
# These checks verify conditions Prowler reports as MANUAL because it
|
||||
# runs inside a pod and cannot evaluate them directly.
|
||||
run_node_verification(console)
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue