# Bsi Compliance Agent

> Deploys OPA Gatekeeper policies for BSI IT-Grundschutz compliance (SYS.1.6 Containerisation, APP.4.4 Kubernetes) following ch-stark patterns with BSI requirement labels.

- Skill: `redhat-et/bsi-compliance-agent` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add redhat-et/bsi-compliance-agent`
- Raw SKILL.md: https://api.skillmd.com/api/skills/redhat-et/bsi-compliance-agent/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: redhat-et (https://skillmd.com/u/redhat-et)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/redhat-et/bsi-compliance-agent

---


# BSI Compliance Agent

Deploys OPA Gatekeeper policies for BSI IT-Grundschutz compliance on OpenShift clusters. Covers SYS.1.6 (Containerisation) and APP.4.4 (Kubernetes) modules with BSI requirement labels.

Reference: https://access.redhat.com/articles/7045834

---

## Step 1: Cluster Discovery

### 1.1 Get Cluster Version

```
Use: mcp__kubernetes__resources_get
Parameters: apiVersion=config.openshift.io/v1, kind=ClusterVersion, name=version
```

### 1.2 Check Gatekeeper Status

```
Use: mcp__kubernetes__namespaces_list
Check: "gatekeeper-system" or "openshift-gatekeeper-system" exists
```

### 1.3 Load BSI Mappings

Use `references/BSI_IT_GRUNDSCHUTZ.md` for requirement-to-policy mappings.

---

## Step 2: SCC Analysis

### 2.1 Get SCCs

```
Use: mcp__kubernetes__resources_list
Parameters: apiVersion=security.openshift.io/v1, kind=SecurityContextConstraints
```

### 2.2 Get Pod SCC Distribution

```
Use: mcp__kubernetes__pods_list
Extract: metadata.annotations["openshift.io/scc"]
Calculate: percentage of pods using each SCC
```

### 2.3 Calculate Coverage

Use mapping from `references/BSI_IT_GRUNDSCHUTZ.md`:
- 95%+ restricted-v2: SKIP privileged, capabilities, host-namespace policies
- <95%: INCLUDE these policies
- 0% coverage: CRITICAL GAP (always include)

---

## Step 3: Create Output Directory

```bash
TRACE_ID=$(python3 skills/bsi-compliance-agent/scripts/get_trace_id.py 2>/dev/null || echo "no-trace")
OUTPUT_DIR="skills/bsi-compliance-agent/assets/${TRACE_ID}"
mkdir -p ${OUTPUT_DIR}/{gatekeeperinstall,gatekeeperchecks,gatekeeperconfig,gatekeeperlibrary,bsi-constraints/{sys16,app44},placements}
cd ${OUTPUT_DIR}
```

---

## Step 4: Download ch-stark Manifests

```bash
# Level 1: Gatekeeper Installation
curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/gatekeeperinstall/gatekeepersubscription.yaml \
  -o gatekeeperinstall/gatekeepersubscription.yaml

# Level 1: Gatekeeper Health Checks
curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/gatekeeperchecks/gatekeeper-ready.yaml \
  -o gatekeeperchecks/gatekeeper-ready.yaml

# Level 1: Gatekeeper Configuration
curl -sL https://raw.githubusercontent.com/ch-stark/gatekeeper-examples/main/gatekeeperconfig/config.yaml \
  -o gatekeeperconfig/config.yaml

# Level 2: Gatekeeper Library
cat <<'EOF' > gatekeeperlibrary/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - https://github.com/open-policy-agent/gatekeeper-library/library
EOF
```

---

## Step 5: Generate BSI-Labeled Constraints

### 5.1 BSI Label Schema

All constraints must include:

Labels:
  bsi-module: "SYS.1.6" or "APP.4.4"
  bsi-requirement: "A11"
  bsi-requirement-name: "resource-limits"
  compliance-framework: "bsi-it-grundschutz"
  severity: "critical" or "high" or "medium"

Annotations:
  bsi.compliance/module: "SYS.1.6"
  bsi.compliance/requirement: "A11"
  bsi.compliance/requirement-name: "Configuring Container Resources"
  bsi.compliance/level: "basic" or "elevated"
  policy.open-cluster-management.io/standards: "BSI IT-Grundschutz"
  policy.open-cluster-management.io/controls: "SYS.1.6.A11"

### 5.2 Generate Constraints by BSI Module

Use `references/BSI_IT_GRUNDSCHUTZ.md` for constraint examples.

SYS.1.6 Containerisation (bsi-constraints/sys16/):
  - bsi-sys16-a11-resource-limits.yaml (ALWAYS INCLUDE)
  - bsi-sys16-a15-readonly-rootfs.yaml (CRITICAL - ALWAYS INCLUDE)

APP.4.4 Kubernetes (bsi-constraints/app44/):
  - bsi-app44-a9-allowed-registries.yaml (ALWAYS INCLUDE)
  - bsi-app44-a9-image-digests.yaml (ALWAYS INCLUDE)
  - bsi-app44-a10-required-labels.yaml (ALWAYS INCLUDE)

### 5.3 Priority Order

1. CRITICAL (0% SCC): k8spspreadonlyrootfilesystem (SYS.1.6.A15)
2. ALWAYS INCLUDE: resource limits, allowed repos, image digests, required labels
3. CONDITIONAL: Check SCC coverage before including

---

## Step 6: Generate policyGenerator.yaml

```yaml
apiVersion: policy.open-cluster-management.io/v1
kind: PolicyGenerator
metadata:
  name: bsi-it-grundschutz-compliance
placementBindingDefaults:
  name: bsi-compliance-binding
policyDefaults:
  namespace: policies
  placement:
    placementName: bsi-placement
  remediationAction: inform
  informGatekeeperPolicies: false
  pruneObjectBehavior: DeleteIfCreated
  ignorePending: true

policies:
  # LEVEL 1: Infrastructure
  - name: policy-install-gatekeeper
    manifests:
      - path: gatekeeperinstall
    remediationAction: enforce

  - name: policy-check-gatekeeper
    manifests:
      - path: gatekeeperchecks
    remediationAction: enforce
    dependencies:
      - name: "policy-install-gatekeeper"
        compliance: "Compliant"

  - name: policy-configure-gatekeeper
    manifests:
      - path: gatekeeperconfig
    remediationAction: enforce
    dependencies:
      - name: "policy-check-gatekeeper"
        compliance: "Compliant"

  # LEVEL 2: ConstraintTemplates
  - name: policy-gatekeeperlibrary
    manifests:
      - path: gatekeeperlibrary
    remediationAction: enforce
    dependencies:
      - name: "policy-check-gatekeeper"
        compliance: "Compliant"
    ignorePending: true

  # LEVEL 3: BSI Constraints
  - name: policy-bsi-sys16-containerisation
    manifests:
      - path: bsi-constraints/sys16
    dependencies:
      - name: "policy-gatekeeperlibrary"
        compliance: "Compliant"
    policyAnnotations:
      policy.open-cluster-management.io/standards: "BSI IT-Grundschutz"
      policy.open-cluster-management.io/categories: "Containerisation"
      policy.open-cluster-management.io/controls: "SYS.1.6.A11,SYS.1.6.A15"

  - name: policy-bsi-app44-kubernetes
    manifests:
      - path: bsi-constraints/app44
    dependencies:
      - name: "policy-gatekeeperlibrary"
        compliance: "Compliant"
    policyAnnotations:
      policy.open-cluster-management.io/standards: "BSI IT-Grundschutz"
      policy.open-cluster-management.io/categories: "Kubernetes"
      policy.open-cluster-management.io/controls: "APP.4.4.A9,APP.4.4.A10"
```

---

## Step 7: Generate kustomization.yaml

```yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
generators:
  - policyGenerator.yaml
```

---

## Step 8: Generate Placements

```yaml
apiVersion: cluster.open-cluster-management.io/v1beta1
kind: Placement
metadata:
  name: bsi-placement
  namespace: policies
spec:
  predicates:
    - requiredClusterSelector:
        labelSelector:
          matchExpressions:
            - key: vendor
              operator: In
              values:
                - OpenShift
            - key: compliance
              operator: In
              values:
                - bsi-it-grundschutz
```

---

## Step 9: Deploy

```bash
# Create namespace
kubectl create namespace policies --dry-run=client -o yaml | kubectl apply -f -

# Apply placements
kubectl apply -f placements/

# Label clusters for BSI compliance
kubectl label managedcluster <cluster-name> compliance=bsi-it-grundschutz

# Build and apply
kustomize build --enable-alpha-plugins . | kubectl apply -n policies -f -
```

---

## Step 10: Verify BSI Labels

```bash
# List all BSI constraints
kubectl get constraints -l compliance-framework=bsi-it-grundschutz

# Query by BSI module
kubectl get constraints -l bsi-module=SYS.1.6
kubectl get constraints -l bsi-module=APP.4.4

# Query by requirement
kubectl get constraints -l bsi-requirement=A15

# Query by severity
kubectl get constraints -l severity=critical
```

---

## Step 11: User Feedback

Ask user: "Any changes needed to the generated files?"

If user provides feedback:
1. Identify which file needs changes
2. Make the requested changes
3. Show updated file
4. Ask again until user confirms

---

## Output Structure

```
assets/${TRACE_ID}/
├── kustomization.yaml
├── policyGenerator.yaml
├── gatekeeperinstall/
├── gatekeeperchecks/
├── gatekeeperconfig/
├── gatekeeperlibrary/
├── bsi-constraints/
│   ├── sys16/
│   │   ├── bsi-sys16-a11-resource-limits.yaml
│   │   └── bsi-sys16-a15-readonly-rootfs.yaml
│   └── app44/
│       ├── bsi-app44-a9-allowed-registries.yaml
│       ├── bsi-app44-a9-image-digests.yaml
│       └── bsi-app44-a10-required-labels.yaml
├── placements/
└── BSI_COMPLIANCE_REPORT.md
```

---

## BSI Requirement to Constraint Mapping

SYS.1.6 Containerisation:
  A11 (Resource limits): k8scontainerlimits - ALWAYS INCLUDE
  A12 (No privileged): k8spspprivileged - SKIP (SCC 95%)
  A13 (Drop capabilities): k8spspcapabilities - SKIP (SCC 95%)
  A14 (Network isolation): k8srequiredlabels - ALWAYS INCLUDE
  A15 (Read-only FS): k8spspreadonlyrootfilesystem - CRITICAL GAP
  A16 (No host resources): k8spsphostnamespace - SKIP (SCC 95%)

APP.4.4 Kubernetes:
  A9 (Secure images): k8sallowedrepos, k8simageDigests - ALWAYS INCLUDE
  A10 (Secure config): k8srequiredlabels, k8srequiredannotations - ALWAYS INCLUDE
  A11 (Protect nodes): k8spsphostnamespace - SKIP (SCC 95%)

---

## Reference Files

references/BSI_IT_GRUNDSCHUTZ.md
  - BSI module mappings (SYS.1.6, APP.4.4)
  - Requirement-to-policy mappings
  - SCC coverage analysis
  - BSI-labeled constraint examples

---

## Trigger Phrases

- "Make my cluster BSI compliant"
- "Deploy BSI IT-Grundschutz policies"
- "Set up BSI compliance for OpenShift"
- "Apply German security standards to my cluster"

---

## When to Use This Skill

Use for:
- BSI IT-Grundschutz compliance
- German federal security requirements
- SYS.1.6 and APP.4.4 module implementation

Do NOT use for:
- NIST 800-53 compliance -> use rhacm-unified-policy-agent
- Custom policy requirements -> use custom-rego-policy-generator