🛡️ devops-policies-cnspec-vmware

Security scanning, asset inventory, and compliance-as-code for VMware vSphere Foundation 9.0 using cnspec and cnquery by Mondoo.

---

📋 What This Repo Does

Tool	Purpose
🔒 cnspec	Security policy scanning, vulnerability assessment, compliance checks
🔍 cnquery	Asset inventory, health queries, capacity reporting, incident response

---

🗂️ Repository Structure

├── 📂 .buildkite/
│   ├── 📄 pipeline.yml              # Main Buildkite pipeline
│   ├── 📄 pipeline.scheduled.yml    # Scheduled scans (daily/weekly)
│   └── 📂 scripts/                  # Pipeline helper scripts
├── 📂 policies/
│   ├── 🔒 security/                 # ESXi & vCenter hardening policies
│   ├── 📋 compliance/               # CIS, STIG, custom frameworks
│   └── ⚙️ operational/              # Operational best-practice policies
├── 📂 queries/
│   ├── 🖥️ inventory/                # Asset inventory query packs
│   ├── 🩺 health/                   # Health check query packs
│   └── 📊 capacity/                 # Capacity & utilization query packs
├── 📂 scripts/                      # Utility scripts
└── 📂 reports/                      # Report templates & output (gitignored)

---

✅ Prerequisites

Requirement	Version
	Security & compliance scanner
	Asset inventory & query engine
	With network access to vCenter
	Optional — for dashboards

---

🚀 Quick Start

# Install cnspec + cnquery
bash -c "$(curl -sSL https://install.mondoo.com/sh)"

# Interactive shell — explore your vSphere environment
cnquery shell vsphere administrator@vsphere.local@vcenter.lab.local --ask-pass

# Run a security scan with custom policies
cnspec scan vsphere administrator@vsphere.local@vcenter.lab.local \
  --ask-pass \
  --policy-bundle policies/security/esxi-hardening.mql.yaml

# Run an inventory query pack
cnquery scan vsphere administrator@vsphere.local@vcenter.lab.local \
  --ask-pass \
  --querypack-bundle queries/inventory/full-inventory.mql.yaml

---

🏗️ Buildkite Pipelines

Pipeline	Trigger	Description
⚡ pipeline.yml	PR / push	Validates policies, lint, dry-run
🕐 pipeline.scheduled.yml	Cron (daily)	Full security scan + inventory + vulnerability assessment

🔑 Required Buildkite Secrets

Secret	Description
VSPHERE_SERVER	vCenter FQDN
VSPHERE_USER	SSO username (user@domain)
VSPHERE_PASSWORD	SSO password
MONDOO_SERVICE_TOKEN	Mondoo Platform token (optional)
GITGUARDIAN_API_KEY	GitGuardian secret scanning
SLACK_WEBHOOK_URL	Slack notifications (optional)

---

📦 Policies & Query Packs

🔒 Security Policies (cnspec)

Policy	Checks	Target
esxi-hardening.mql.yaml	16	ESXi hosts — SSH, lockdown, TLS 1.3, FIPS, firewall, vSwitch
vcenter-hardening.mql.yaml	10	vCenter — password policy, session timeout, TLS, logging
vm-hardening.mql.yaml	13	VMs — isolation, devices, HW v22, EFI, Tools

📋 Compliance Policies (cnspec)

Policy	Framework	Controls
cis-esxi9.mql.yaml	CIS Benchmark	16 scored controls across 7 sections

⚙️ Operational Policies (cnspec)

Policy	Checks	Focus
best-practices.mql.yaml	9	HA, DRS, admission control, snapshots, host state

🔍 Query Packs (cnquery)

Pack	Queries	Purpose
full-inventory.mql.yaml	8	Complete asset inventory — DCs, clusters, hosts, VMs, datastores
host-health.mql.yaml	10	Uptime, services, hardware sensors, alarms, snapshots
cluster-capacity.mql.yaml	8	Utilization, overcommit, powered-off waste, storage

---

✏️ Writing Custom Policies

Policies use MQL (Mondoo Query Language). Example:

policies:
  - uid: my-esxi-check
    name: "My ESXi Check"
    groups:
      - checks:
          - uid: ssh-disabled

queries:
  - uid: ssh-disabled
    title: "SSH must be disabled on ESXi"
    mql: |
      esxi.host {
        services.where(key == "TSM-SSH") {
          running == false
        }
      }

📖 See MQL vSphere Resource Reference for all available resources.

---

🧪 Local Testing

# Copy and configure credentials
cp .env.example .env

# Run everything
./scripts/run-local.sh all

# Or pick a specific mode
./scripts/run-local.sh scan       # Security scans only
./scripts/run-local.sh vuln       # Vulnerability scan only
./scripts/run-local.sh inventory  # Asset inventory
./scripts/run-local.sh health     # Host health checks
./scripts/run-local.sh capacity   # Capacity report
./scripts/run-local.sh shell      # Interactive cnquery shell

---

📄 License