https://archive-ce-3-17.netlify.app/assets/js/9910857d.93d90c18.js

1"use strict";(self.webpackChunktigera_docs=self.webpackChunktigera_docs||[]).push([["1038"],{42427:function(e,r,n){n.r(r),n.d(r,{default:()=>d,frontMatter:()=>o,metadata:()=>s,assets:()=>c,toc:()=>l,contentTitle:()=>a});var s=JSON.parse('{"id":"reference/resources/compliance-reports/overview","title":"Compliance reports","description":"Schedule reports and configure report scope.","source":"@site/calico-enterprise_versioned_docs/version-3.17/reference/resources/compliance-reports/overview.mdx","sourceDirName":"reference/resources/compliance-reports","slug":"/reference/resources/compliance-reports/overview","permalink":"/calico-enterprise/3.17/reference/resources/compliance-reports/overview","draft":false,"unlisted":false,"editUrl":"https://github.com/tigera/docs/edit/main/calico-enterprise_versioned_docs/version-3.17/reference/resources/compliance-reports/overview.mdx","tags":[],"version":"3.17","frontMatter":{"description":"Schedule reports and configure report scope."},"sidebar":"calicoEnterpriseSidebar","previous":{"title":"Compliance reports","permalink":"/calico-enterprise/3.17/reference/resources/compliance-reports/"},"next":{"title":"Inventory report","permalink":"/calico-enterprise/3.17/reference/resources/compliance-reports/inventory"}}'),t=n("85893"),i=n("50065");let o={description:"Schedule reports and configure report scope."},a="Compliance reports",c={},l=[{value:"Concepts",id:"concepts",level:2},{value:"In-scope asset",id:"in-scope-asset",level:3},{value:"Ingress protected",id:"ingress-protected",level:3},{value:"Egress protected",id:"egress-protected",level:3},{value:"Allows ingress traffic from another namespace",id:"allows-ingress-traffic-from-another-namespace",level:3},{value:"Allows egress traffic to another namespace",id:"allows-egress-traffic-to-another-namespace",level:3},{value:"Allows ingress traffic from the internet",id:"allows-ingress-traffic-from-the-internet",level:3},{value:"Allows egress traffic to the internet",id:"allows-egress-traffic-to-the-internet",level:3},{value:"Envoy enabled",id:"envoy-enabled",level:3}];function p(e){let r={a:"a",code:"code",em:"em",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",ul:"ul",...(0,i.a)(),...e.components};return(0,t.jsxs)(t.Fragment,{children:[(0,t.jsx)(r.header,{children:(0,t.jsx)(r.h1,{id:"compliance-reports",children:"Compliance reports"})}),"\n",(0,t.jsx)(r.p,{children:"The Calico Enterprise compliance reporting feature provides the following compliance reports:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsx)(r.li,{children:(0,t.jsx)(r.a,{href:"/calico-enterprise/3.17/reference/resources/compliance-reports/inventory",children:"Inventory"})}),"\n",(0,t.jsx)(r.li,{children:(0,t.jsx)(r.a,{href:"/calico-enterprise/3.17/reference/resources/compliance-reports/network-access",children:"Network Access"})}),"\n",(0,t.jsx)(r.li,{children:(0,t.jsx)(r.a,{href:"/calico-enterprise/3.17/reference/resources/compliance-reports/policy-audit",children:"Policy Audit"})}),"\n",(0,t.jsx)(r.li,{children:(0,t.jsx)(r.a,{href:"/calico-enterprise/3.17/reference/resources/compliance-reports/cis-benchmark",children:"CIS Benchmark"})}),"\n"]}),"\n",(0,t.jsxs)(r.p,{children:["Create a ",(0,t.jsx)(r.a,{href:"/calico-enterprise/3.17/reference/resources/globalreport",children:(0,t.jsx)(r.code,{children:"GlobalReport"})})," resource to automatically schedule report generation, and specify the report scope (resources to include in the report)."]}),"\n",(0,t.jsx)(r.h2,{id:"concepts",children:"Concepts"}),"\n",(0,t.jsx)(r.h3,{id:"in-scope-asset",children:"In-scope asset"}),"\n",(0,t.jsx)(r.p,{children:"An asset (Pod or HostEndpoint) is flagged as in-scope by endpoint labels, namespace and/or namespace labels, and service\naccount and/or service account labels."}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.em,{children:"How this applies to the report"}),":\nThe report includes all resources that were in-scope at any point during the report interval. The resource is included\nwhen it is first flagged as in-scope according to the configured label selector and name selections. The resource is\nincluded even if the resource is deleted or goes out-of-scope before the end of the report interval."]}),"\n",(0,t.jsx)(r.h3,{id:"ingress-protected",children:"Ingress protected"}),"\n",(0,t.jsx)(r.p,{children:"An endpoint is ingress protected if it has at least one Ingress policy that is applied to it."}),"\n",(0,t.jsx)(r.p,{children:"A service is ingress protected if all of the inscope endpoints within that service are ingress protected."}),"\n",(0,t.jsx)(r.p,{children:"A namespace is ingress protected if all of the inscope endpoints within that namespace are ingress protected."}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.em,{children:"How this applies to the report"}),":\nAn endpoint is ingress protected only if it was ingress protected throughout the entire report interval."]}),"\n",(0,t.jsx)(r.h3,{id:"egress-protected",children:"Egress protected"}),"\n",(0,t.jsx)(r.p,{children:"As per ingress, but with egress policy rules. Note that egress statistics are not obtained for services."}),"\n",(0,t.jsx)(r.h3,{id:"allows-ingress-traffic-from-another-namespace",children:"Allows ingress traffic from another namespace"}),"\n",(0,t.jsx)(r.p,{children:"An endpoint is flagged as allowing ingress traffic from another namespace if it has one or more policies that apply to\nit with an ingress allow rule that:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsx)(r.li,{children:"has an explicit namespace selector configured, or"}),"\n",(0,t.jsx)(r.li,{children:"has no source selector or source CIDR configured, or"}),"\n",(0,t.jsx)(r.li,{children:"(for GlobalNetworkPolicy) has no source CIDR."}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:"A service is flagged as allowing ingress traffic from another namespace if any of the inscope endpoints within that\nservice are flagged."}),"\n",(0,t.jsx)(r.p,{children:"A namespace is flagged as allowing ingress traffic from another namespace if all of the inscope endpoints within that\nnamespace are flagged."}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.em,{children:"How this applies to the report"}),":\nAn endpoint is flagged as allowing ingress traffic from another namespace if it was flagged at any time during the\nreport interval."]}),"\n",(0,t.jsx)(r.h3,{id:"allows-egress-traffic-to-another-namespace",children:"Allows egress traffic to another namespace"}),"\n",(0,t.jsx)(r.p,{children:"As per ingress, but with egress policy rules and destination selector/CIDR. Note that egress statistics are not obtained\nfor services."}),"\n",(0,t.jsx)(r.h3,{id:"allows-ingress-traffic-from-the-internet",children:"Allows ingress traffic from the internet"}),"\n",(0,t.jsx)(r.p,{children:"An endpoint is flagged as allowing ingress traffic from the internet if it has one or more policies that apply to it\nwith an ingress allow rule that:"}),"\n",(0,t.jsxs)(r.ul,{children:["\n",(0,t.jsx)(r.li,{children:"has no source selector or source CIDR configured, or"}),"\n",(0,t.jsx)(r.li,{children:"has a source CIDR in the non-private IP ranges and has no source selector, or"}),"\n",(0,t.jsx)(r.li,{children:"has a source selector that matches one or more NetworkSets that contain at least one non-

1private IP."}),"\n"]}),"\n",(0,t.jsx)(r.p,{children:"A service is flagged as allowing ingress traffic from the internet if any of the inscope endpoints within that service\nare flagged."}),"\n",(0,t.jsx)(r.p,{children:"A namespace is flagged as allowing ingress traffic from the internet if all of the inscope endpoints within that\nnamespace are flagged."}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.em,{children:"How this applies to the report"}),":\nAn endpoint is flagged as allowing ingress traffic from the internet if it was flagged as such at any time during the\nreport interval."]}),"\n",(0,t.jsx)(r.h3,{id:"allows-egress-traffic-to-the-internet",children:"Allows egress traffic to the internet"}),"\n",(0,t.jsx)(r.p,{children:"As per ingress, but with egress policy rules and destination selector/CIDR. Note that egress statistics are not obtained\nfor services."}),"\n",(0,t.jsx)(r.h3,{id:"envoy-enabled",children:"Envoy enabled"}),"\n",(0,t.jsx)(r.p,{children:"An endpoint is flagged as Envoy Enabled if the associated Pod Spec and Annotations indicate that an Istio init and main\ncontainer are deployed in the Pod. Provided Istio is appropriately configured on the cluster, this can be extrapolated\nto be indication of whether mTLS is enabled for the endpoint."}),"\n",(0,t.jsx)(r.p,{children:"A service is flagged as Envoy enabled if all of the inscope endpoints within that service are flagged."}),"\n",(0,t.jsx)(r.p,{children:"A namespace is flagged as Envoy enabled if all of the inscope endpoints within that namespace are flagged."}),"\n",(0,t.jsxs)(r.p,{children:[(0,t.jsx)(r.em,{children:"How this applies to the report"}),":\nAn endpoint is flagged as Envoy enabled if it was flagged as such throughout the entire report interval."]})]})}function d(e={}){let{wrapper:r}={...(0,i.a)(),...e.components};return r?(0,t.jsx)(r,{...e,children:(0,t.jsx)(p,{...e})}):p(e)}},50065:function(e,r,n){n.d(r,{Z:function(){return a},a:function(){return o}});var s=n(67294);let t={},i=s.createContext(t);function o(e){let r=s.useContext(i);return s.useMemo(function(){return"function"==typeof e?e(r):{...r,...e}},[r,e])}function a(e){let r;return r=e.disableParentContext?"function"==typeof e.components?e.components(t):e.components||t:o(e.components),s.createElement(i.Provider,{value:r},e.children)}}}]);