CMP-3624,CMP-3553: Sshd rules for rhel8 and rhel9 nodes

[yuumasato]

Description:

• Restrict current SSHD Kubernetes remediations to OCP <= 4.12
• Add new macro to create drop-in SSHD MachineConfigs
• Add new drop-in Kubernetes remediations in template and rules with explicit remediation

Rationale:

• The current Kubernetes SSHD remediations create a fixed sshd_config file
  • This does not allow rule level granularity
  • The RHEL8 RHCOS4 remediations break RHEL9 based nodes.
• Fixes CMP-3553 by adding support for SSHD drop-in files and not laying down a generic hardened SSHD configuration.
• Fixes CMP-3617 by adding drop-in support for OCP >=4.13 in sshd_lineinfile template. These rules will still fail on OCP 4.12.
• Fixes CMP-3624 by removing the Include directive from the static sshd_config.

Review Hints:

• Check that SSHD rules creates a single sshd_config file in el8 based nodes
• Check that SSHD rules creates multiple drop-in config files in el9 based nodes

[yuumasato]

Example of how remediations not matching the ocp-version can be found:

$ oc get events | grep SkippingRemediation
116m        Warning   SkippingRemediation                compliancescan/upstream-rhcos4-high-master                                     Skipping ComplianceRemediation 'openshift-compliance/upstream-rhcos4-high-master-sshd-disable-rhosts'. Cluster doesn't match version range <=4.13.0
117m        Warning   SkippingRemediation                compliancescan/upstream-rhcos4-high-worker                                     Skipping ComplianceRemediation 'openshift-compliance/upstream-rhcos4-high-worker-sshd-disable-rhosts'. Cluster doesn't match version range <=4.13.0

And then the second yaml file is applied:

$ oc get rems -oyaml upstream-rhcos4-high-master-sshd-disable-rhosts-1

apiVersion: compliance.openshift.io/v1alpha1
kind: ComplianceRemediation
metadata:
  annotations:
    compliance.openshift.io/ocp-version: '>=4.13.0'
    compliance.openshift.io/xccdf-value-used: var-rekey-limit-size,var-rekey-limit-time,var-sshd-set-login-grace-time,var-sshd-disable-compression,sshd-idle-timeout-value,var-sshd-set-keepalive,var-sshd-priv-separation
  creationTimestamp: "2025-09-29T19:21:59Z"
  generation: 2
  labels:
    compliance.openshift.io/scan-name: upstream-rhcos4-high-master
    compliance.openshift.io/suite: rhcos4-high
  name: upstream-rhcos4-high-master-sshd-disable-rhosts-1
  namespace: openshift-compliance
spec:
  apply: true
  current:
    object:
      apiVersion: machineconfiguration.openshift.io/v1
      kind: MachineConfig
      metadata: {}
      spec:
        config:
          ignition:
            version: 3.1.0
          storage:
            files:
            - contents:
                source: data:,IgnoreRhosts%20yes
              mode: 384
              overwrite: true
              path: /etc/ssh/sshd_config.d/00-complianceascode-IgnoreRhosts.conf
  outdated: {}
  type: Configuration
status:
  applicationState: Applied

[openshift-ci]

@yuumasato: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	c869d6a	link	true	/test e2e-aws-openshift-platform-compliance
ci/prow/e2e-aws-openshift-node-compliance	c869d6a	link	true	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.