nist-compliance-agent

# NIST Compliance Agent Deploys OPA Gatekeeper with **NIST SP 800-53 labeled constraints** following [ch-stark/gatekeeper-examples](https://github.com/ch-stark/gatekeeper-examples) patterns. ## Workflow Overview This skill follows the ch-stark/gatekeeper-examples pattern with three levels: LEVEL 1 - Infrastructure: - policy-install-gatekeeper - policy-check-gatekeeper - policy-configure-gatekeeper LEVEL 2 - Templates: - policy-gatekeeperlibrary (deploys ConstraintTemplates) LEVEL 3 - Constraints: - policy-nist-sc-controls (with NIST labels) - policy-nist-si-controls (with NIST labels) - policy-nist-cm-controls (with NIST labels) - policy-nist-ac-controls (with NIST labels) Each level depends on the previous level being Compliant before proceeding. --- ## Step 1: Cluster Discovery ### 1.1 Get Cluster Version ``` Use: mcp__kubernetes__resources_get Parameters: apiVersion=config.openshift.io/v1, kind=ClusterVersion, name=version ``` ### 1.2 Check Gatekeeper Status ``` Use: mcp__kubernetes__namespaces_list Check: "gatekeeper-system" or "openshift-gatekeeper-system" exists ``` ### 1.3 Load NIST Mappings Use `references/NIST_800_53_CATALOG.md` for control-to-policy mappings and constraint examples. --- ## Step 2: SCC Analysis (OpenShift Only) ### 2.1 Get SCCs and Pod Distribution ``` Use: mcp__kubernetes__resources_list Parameters: apiVersion=security.openshift.io/v1, kind=SecurityContextConstraints ``` ``` Use: mcp__kubernetes__pods_list Extract: metadata.annotations["openshift.io/scc"] ``` ### 2.2 Calculate Coverage Use the mapping in `references/NIST_800_53_CATALOG.md` section "Complete Mapping Table": - **≥95% SCC coverage** → SKIP (redundant) - **<95% SCC coverage** → INCLUDE (gap-filling) - **0% SCC coverage** → CRITICAL (must include) --- ## Step 3: Create Output Directory ```bash TRACE_ID=$(python3 skills/nist-compliance-agent/scripts/get_trace_id.py 2>/dev/null || echo "no-trace") OUTPUT_DIR="skills/nist-compliance-agent/assets/${TRACE_ID}" mkdir -p ${OUTPUT_DIR}/{gatekeeperinstall,gatekeeperchecks,gatekeeperconfig,gatekeeperlibrary,nist-constraints/{ac,cm,sc,si},placements} cd ${OUTPUT_DIR} ``` --- ## Step 4: Download ch-stark Manifests ```bash # Level 1: Gatekeeper Installation curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/gatekeeperinstall/gatekeepersubscription.yaml \ -o gatekeeperinstall/gatekeepersubscription.yaml # Level 1: Gatekeeper Health Checks curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/gatekeeperchecks/gatekeeper-ready.yaml \ -o gatekeeperchecks/gatekeeper-ready.yaml # Level 1: Gatekeeper Configuration curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/gatekeeperconfig/config.yaml \ -o gatekeeperconfig/config.yaml # Level 2: Gatekeeper Library cat <<'EOF' > gatekeeperlibrary/kustomization.yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization resources: - https://github.com/open-policy-agent/gatekeeper-library/library EOF ``` --- ## Step 5: Generate NIST-Labeled Constraints ### 5.1 NIST Label Schema All constraints MUST include: **Labels** (for filtering): ```yaml labels: nist-family: "SC" # AC, AU, CM, SC, SI nist-control: "SC-39" # Primary control ID nist-control-name: "process-isolation" # Kebab-case name compliance-framework: "nist-800-53-r5" severity: "critical" # critical, high, medium, low ``` **Annotations** (for reporting): ```yaml annotations: nist.compliance/control: "SC-39" nist.compliance/control-name: "Process Isolation" nist.compliance/description: "Maintain separate execution domain for each process" policy.open-cluster-management.io/standards: "NIST SP 800-53 Rev. 5" policy.open-cluster-management.io/categories: "System and Communications Protection" policy.open-cluster-management.io/controls: "SC-39" ``` ### 5.2 Generate Constraints Use `references/NIST_800_53_CATALOG.md` section "NIST-to-Gatekeeper Mapping Examples" for constraint templates. Generate constraints organized by NIST family: - `nist-constraints/ac/` - Access Control (AC-2, AC-3, AC-6) - `nist-constraints/cm/` - Configuration Management (CM-2, CM-7) - `nist-constraints/sc/` - System Protection (SC-7, SC-8, SC-39) - `nist-constraints/si/` - System Integrity (SI-7) **Priority order** (from `references/NIST_800_53_CATALOG.md`): 1. **CRITICAL (0% SCC)**: `read-only-root-filesystem`, `seccompv2`, `proc-mount` 2. **ALWAYS INCLUDE**: `requiredlabels`, `allowedrepos`, `imagedigests`, `httpsonly` 3. **CONDITIONAL**: Check SCC coverage before including --- ## Step 6: Generate policyGenerator.yaml Follow `references/POLICYGENERATOR_FORMAT.md` and ch-stark pattern: ```yaml apiVersion: policy.open-cluster-management.io/v1 kind: PolicyGenerator metadata: name: nist-gatekeeper-compliance placementBindingDefaults: name: nist-gatekeeper-binding policyDefaults: namespace: policies placement: placementName: gatekeeper-placement remediationAction: inform informGatekeeperPolicies: false pruneObjectBehavior: DeleteIfCreated ignorePending: true policies: # LEVEL 1: Infrastructure (enforce) - name: policy-install-gatekeeper manifests: - path: gatekeeperinstall remediationAction: enforce - name: policy-check-gatekeeper manifests: - path: gatekeeperchecks remediationAction: enforce dependencies: - name: "policy-install-gatekeeper" compliance: "Compliant" - name: policy-configure-gatekeeper manifests: - path: gatekeeperconfig remediationAction: enforce dependencies: - name: "policy-check-gatekeeper" compliance: "Compliant" # LEVEL 2: ConstraintTemplates - name: policy-gatekeeperlibrary manifests: - path: gatekeeperlibrary remediationAction: enforce dependencies: - name: "policy-check-gatekeeper" compliance: "Compliant" ignorePending: true # LEVEL 3: NIST Constraints (by family) - name: policy-nist-sc-controls manifests: - path: nist-constraints/sc dependencies: - name: "policy-gatekeeperlibrary" compliance: "Compliant" policyAnnotations: policy.open-cluster-management.io/standards: "NIST SP 800-53 Rev. 5" policy.open-cluster-management.io/controls: "SC-39,SC-8" - name: policy-nist-si-controls manifests: - path: nist-constraints/si dependencies: - name: "policy-gatekeeperlibrary" compliance: "Compliant" policyAnnotations: policy.open-cluster-management.io/standards: "NIST SP 800-53 Rev. 5" policy.open-cluster-management.io/controls: "SI-7" - name: policy-nist-cm-controls manifests: - path: nist-constraints/cm dependencies: - name: "policy-gatekeeperlibrary" compliance: "Compliant" policyAnnotations: policy.open-cluster-management.io/standards: "NIST SP 800-53 Rev. 5" policy.open-cluster-management.io/controls: "CM-2" - name: policy-nist-ac-controls manifests: - path: nist-constraints/ac dependencies: - name: "policy-gatekeeperlibrary" compliance: "Compliant" policyAnnotations: policy.open-cluster-management.io/standards: "NIST SP 800-53 Rev. 5" policy.open-cluster-management.io/controls: "AC-6" ``` --- ## Step 7: Generate Supporting Files ### kustomization.yaml ```yaml apiVersion: kustomize.config.k8s.io/v1beta1 kind: Kustomization generators: - policyGenerator.yaml ``` ### placements/placements.yaml See `references/POLICYGENERATOR_FORMAT.md` for placement templates. --- ## Step 8: Deploy ```bash # Create namespace kubectl create namespace policies --dry-run=client -o yaml | kubectl apply -f - # Apply placements kubectl apply -f placements/placements.yaml # Label clusters kubectl label managedcluster <cluster-name> gatekeeper=true compliance=nist-moderate environment=staging # Build and apply kustomize build --enable-alpha-plugins . | kubectl apply -n policies -f - ``` --- ## Step 9: Verify NIST Labels ```bash # List constraints with NIST labels kubectl get constraints -o custom-columns="NAME:.metadata.name,NIST-CONTROL:.metadata.labels.nist-control,SEVERITY:.metadata.labels.severity" # Query by NIST control kubectl get constraints -l nist-control=SC-39 # Query by severity kubectl get constraints -l severity=critical ``` --- ## Output Structure ``` assets/${TRACE_ID}/ ├── kustomization.yaml ├── policyGenerator.yaml ├── gatekeeperinstall/ ├── gatekeeperchecks/ ├── gatekeeperconfig/ ├── gatekeeperlibrary/ ├── nist-constraints/ │ ├── ac/ │ ├── cm/ │ ├── sc/ │ └── si/ ├── placements/ └── NIST_COMPLIANCE_REPORT.md ``` --- ## Trigger Phrases - "Set up NIST 800-53 compliance with Gatekeeper" - "Deploy gatekeeper-library with NIST labels" - "Follow ch-stark pattern with NIST compliance" --- ## Reference Files references/NIST_800_53_CATALOG.md - NIST control mappings - Constraint examples with NIST labels - SCC coverage analysis references/ACM_GATEKEEPER_EXAMPLES.md - ch-stark integration patterns references/POLICYGENERATOR_FORMAT.md - PolicyGenerator structure - Placement templates