Lula Integration in CI

[CloudBeard]

Is your feature request related to a problem? Please describe.

Integrate Lula into the CI process to verify UDS Core configuration against compliance controls. This integration will determine if the controls are satisfied and provide evidence to demonstrate compliance to assessors in an automated and continuous manner.

This approach enables early detection of changes that may impact compliance, offering a mechanism to prevent non-compliant changes if desired. It ensures compliance in a quantitative way, providing assurance and clarity.

Describe the solution you'd like

• Integrate Lula Lint Task from uds-common to lula lint new/modified OSCAL files in CI.

• Integrate Lula Validate Task from uds-common to run lula validate against OSCAL and supporting files to determine pass fail for compliance controls.

• Integrate Lula Evaluate Task from uds-common to run lula evaluate after upgrade to compare previous assessment-results (OSCAL) to current to determine changes.

• Update location of current OSCAL files.

Describe alternatives you've considered

Considered GitHub Actions to perform the same functionality but following the Task pattern provides a better mechanism for usage outside of GitHub.

Additional context

Is dependent on creation of tasks issues being completed first.

[brandtkeller]

One proposed structure for the repository:

.
|-- README.md
|-- oscal.yaml <-- this file imports all children + UDS specific controls + stores assessments for use in pipeline threshold
|-- src
|   |-- istio
|   |   |-- component.yaml <-- these are composed and 
|   |-- loki
|   |   |-- component.yaml
|   |-- pepr
|   |   |-- component.yaml
|   |-- neuvector
|   |   |-- component.yaml

Idea here is this structure supports a single location for Lula to execute validations from and establishes greater compliance awareness. Even OSCAL without any Lula validations is still valuable to reporting. Having numbers for controls present vs those satisfied is a point of iteration.

Future exploration could mean looking at how to make this data transient. Including the compliance information as files in each package or composing during bundle for inclusion, transport and discovery in target environments.