CMP-4432: Add secondary-network CEL rules for CIS OCP-Virt 4.1/4.2 (SR-IOV + NAD split) - #14919
Open
Vincent056 wants to merge 2 commits into
Open
CMP-4432: Add secondary-network CEL rules for CIS OCP-Virt 4.1/4.2 (SR-IOV + NAD split)#14919Vincent056 wants to merge 2 commits into
Vincent056 wants to merge 2 commits into
Conversation
|
Skipping CI for Draft Pull Request. |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
Two rules, split by resource so applicability is clean: - kubevirt-sriov-vlan-required: every SriovNetwork declares .spec.vlan > 0. Requires the SR-IOV Network Operator; on clusters without it the resource type does not exist and the check errors - CPE applicability for CEL (CMP-4483) will mark it Not Applicable. Documented in the rule. - kubevirt-localnet-vlan-required: every OVN localnet NetworkAttachmentDefinition declares vlanID in its CNI config. Works on every cluster (NAD CRD ships with multus). Parsed-JSON key access guarded with 'in' so configs without a topology key are ignored, never a no-such-key FAIL. An earlier combined rule ERRORed wholesale on clusters without the SR-IOV operator (verified via an operator scan on a stock AWS cluster) because one failed input fetch prevents binding for the whole expression - hence the split. Fixtures: 9 cases via celctl - all pass. Verified via operator scan on OCP 4.21 + CNV: localnet rule evaluates and passes; sriov rule errors without the SR-IOV operator as documented. RBAC ships with compliance-operator#1293 (merged). Added to cis-vm-extension profile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Two rules, split by resource (same rationale as CMP-4432): - kubevirt-sriov-spoofchk-on: every SriovNetwork sets spoofChk "on" (explicit, per the benchmark). Requires the SR-IOV Network Operator; Not Applicable handling via CMP-4483 where absent. - kubevirt-bridge-mac-spoof-filtering: every bridge-type NetworkAttachmentDefinition sets macspoofchk: true. Works on every cluster; parsed-JSON access guarded with 'in'. Fixtures: 10 cases via celctl - all pass. Verified via operator scan on OCP 4.21 + CNV: bridge rule evaluates against real NADs. Added to cis-vm-extension profile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Vincent056
force-pushed
the
cmp-4432-network-cel-rules
branch
from
July 24, 2026 06:28
da67e07 to
f99655d
Compare
Vincent056
changed the title
Vincent056
marked this pull request as ready for review
July 24, 2026 06:29
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
@Vincent056: The following tests failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds four CEL rules for the CIS OCP-Virt secondary-network controls — each control split into an SR-IOV rule and a NAD rule so applicability is clean:
kubevirt-sriov-vlan-required(SriovNetwork.spec.vlan > 0),kubevirt-localnet-vlan-required(localnet NADvlanID)kubevirt-sriov-spoofchk-on(SriovNetworkspoofChk: "on"),kubevirt-bridge-mac-spoof-filtering(bridge NADmacspoofchk: true)Why split: a combined rule ERRORs wholesale on clusters without the SR-IOV Network Operator — one failed input fetch (
sriovnetworkstype not registered) prevents binding for the whole expression. Verified via an operator scan on a stock AWS cluster. With the split, the NAD rules work on every cluster (the NAD CRD ships with multus); only the two SR-IOV rules depend on the operator and will be marked Not Applicable by the CEL CPE work (CMP-4483) — documented in each rule.All parsed-JSON key access is guarded with
in(configs withouttopology/typekeys are ignored, never a no-such-key FAIL). Scanner RBAC merged in ComplianceAsCode/compliance-operator#1293. Rules added to thecis-vm-extensionprofile selections.CIS 4.3 (multi-network policies, CMP-4434) ships as a Manual rule in the Manual-rules PR (MultiNetworkPolicy CRD disabled by default cluster-wide).
Testing
celctl cac lint+cac test: 19/19 fixture cases across the 4 ruleskubevirt-localnet-vlan-requiredPASS;kubevirt-bridge-mac-spoof-filteringcorrectly FAILs when a bridge NAD withoutmacspoofchkis present and PASSes when only compliant NADs exist; the two SR-IOV rules report the documented not-applicable ERROR on a cluster without the SR-IOV operatorvlan/spoofChk: SR-IOV rules correctly report non-compliant🤖 Generated with Claude Code