CMP-4447: Fix the five shipped CIS OCP-Virt CEL rules (false positives and eval errors)

applications/openshift-virtualization/kubevirt-enforce-trusted-tls-registries/cel/shared.yml

@@ -14,4 +14,5 @@ inputs:
 
 expression: |-
   !has(hco.spec.storageImport) ||
+  !has(hco.spec.storageImport.insecureRegistries) ||
   hco.spec.storageImport.insecureRegistries.size() == 0

applications/openshift-virtualization/kubevirt-enforce-trusted-tls-registries/cel/tests/cases.yaml

@@ -3,13 +3,13 @@
 # Seeded from real API objects; see provenance. Versions only, nothing cluster-identifiable.
 provenance:
   fetched_with: celctl cac scaffold --from-cluster
-  date: '2026-07-14'
+  date: '2026-07-23'
   openshift_version: 4.22.0
   kubernetes_version: v1.35.5
   source_api_versions:
     hco: hco.kubevirt.io/v1beta1
 cases:
-  - name: no storageImport -> compliant
+  - name: no storageImport block is compliant
     expect: true
     inputs:
       hco:
@@ -19,35 +19,40 @@ cases:
           name: kubevirt-hyperconverged
           namespace: openshift-cnv
         spec: {}
-  - name: insecureRegistries empty -> compliant
+  - name: storageImport without an insecureRegistries key is compliant
     expect: true
     inputs:
       hco:
+        apiVersion: hco.kubevirt.io/v1beta1
+        kind: HyperConverged
         metadata:
           name: kubevirt-hyperconverged
           namespace: openshift-cnv
         spec:
           storageImport:
-            insecureRegistries: []
-  - name: insecureRegistries set -> non-compliant
-    expect: false
+            importProxy: {}
+  - name: hyperconverged with empty insecureRegistries is compliant
+    expect: true
     inputs:
       hco:
+        apiVersion: hco.kubevirt.io/v1beta1
+        kind: HyperConverged
         metadata:
           name: kubevirt-hyperconverged
           namespace: openshift-cnv
         spec:
           storageImport:
-            insecureRegistries:
-              - registry.example.internal:5000
-  - name: storageImport present without insecureRegistries key (no-such-key maps to FAIL in the scanner,
-      see CMP-4450)
+            insecureRegistries: []
+  - name: hyperconverged with insecureRegistries entries is non-compliant
     expect: false
     inputs:
       hco:
+        apiVersion: hco.kubevirt.io/v1beta1
+        kind: HyperConverged
         metadata:
           name: kubevirt-hyperconverged
           namespace: openshift-cnv
         spec:
           storageImport:
-            scratchSpaceStorageClass: fast
+            insecureRegistries:
+              - registry.internal:5000

applications/openshift-virtualization/kubevirt-no-permitted-host-devices/cel/shared.yml

@@ -1,8 +1,9 @@
 check_type: Platform
 
 failure_reason: |-
-    The '.spec.permittedHostDevices' field is set in the 'kubevirt-hyperconverged'
-    resource, allowing host devices to be used by virtualization workloads.
+    The '.spec.permittedHostDevices' field in the 'kubevirt-hyperconverged'
+    resource permits one or more host devices (pciHostDevices, mediatedDevices
+    or usbHostDevices) to be used by virtualization workloads.
 
 inputs:
   - name: hcoList
@@ -21,6 +22,9 @@ expression: |
   ).all(h,
       !has(h.spec.permittedHostDevices) ||
       h.spec.permittedHostDevices == null ||
-      (has(h.spec.permittedHostDevices.pciHostDevices) && size(h.spec.permittedHostDevices.pciHostDevices) == 0) &&
-      (has(h.spec.permittedHostDevices.mediatedDevices) && size(h.spec.permittedHostDevices.mediatedDevices) == 0)
+      (
+        (!has(h.spec.permittedHostDevices.pciHostDevices) || size(h.spec.permittedHostDevices.pciHostDevices) == 0) &&
+        (!has(h.spec.permittedHostDevices.mediatedDevices) || size(h.spec.permittedHostDevices.mediatedDevices) == 0) &&
+        (!has(h.spec.permittedHostDevices.usbHostDevices) || size(h.spec.permittedHostDevices.usbHostDevices) == 0)
+      )
   )

applications/openshift-virtualization/kubevirt-no-permitted-host-devices/cel/tests/cases.yaml

@@ -3,13 +3,13 @@
 # Seeded from real API objects; see provenance. Versions only, nothing cluster-identifiable.
 provenance:
   fetched_with: celctl cac scaffold --from-cluster
-  date: '2026-07-14'
+  date: '2026-07-23'
   openshift_version: 4.22.0
   kubernetes_version: v1.35.5
   source_api_versions:
     hcoList: hco.kubevirt.io/v1beta1
 cases:
-  - name: permittedHostDevices absent -> compliant
+  - name: absent permittedHostDevices block is compliant
     expect: true
     inputs:
       hcoList:
@@ -22,7 +22,39 @@ cases:
               name: kubevirt-hyperconverged
               namespace: openshift-cnv
             spec: {}
-  - name: pciHostDevices configured -> non-compliant
+  - name: explicitly empty device lists are compliant
+    expect: true
+    inputs:
+      hcoList:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: hco.kubevirt.io/v1beta1
+            kind: HyperConverged
+            metadata:
+              name: kubevirt-hyperconverged
+              namespace: openshift-cnv
+            spec:
+              permittedHostDevices:
+                pciHostDevices: []
+                mediatedDevices: []
+                usbHostDevices: []
+  - name: empty pciHostDevices list alone is compliant
+    expect: true
+    inputs:
+      hcoList:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: hco.kubevirt.io/v1beta1
+            kind: HyperConverged
+            metadata:
+              name: kubevirt-hyperconverged
+              namespace: openshift-cnv
+            spec:
+              permittedHostDevices:
+                pciHostDevices: []
+  - name: configured pciHostDevices are non-compliant
     expect: false
     inputs:
       hcoList:
@@ -38,9 +70,9 @@ cases:
               permittedHostDevices:
                 pciHostDevices:
                   - pciDeviceSelector: 10DE:1EB8
-                    resourceName: nvidia.com/GPU
-  - name: both device lists explicitly empty -> compliant
-    expect: true
+                    resourceName: nvidia.com/T4
+  - name: configured usbHostDevices are non-compliant
+    expect: false
     inputs:
       hcoList:
         apiVersion: v1
@@ -53,10 +85,12 @@ cases:
               namespace: openshift-cnv
             spec:
               permittedHostDevices:
-                pciHostDevices: []
-                mediatedDevices: []
-  - name: only pciHostDevices [] present (no devices permitted; current expression requires both keys,
-      see CMP-4447)
+                usbHostDevices:
+                  - resourceName: kubevirt.io/usb-storage
+                    selectors:
+                      - vendor: 0781
+                        product: '5567'
+  - name: configured mediatedDevices are non-compliant
     expect: false
     inputs:
       hcoList:
@@ -70,8 +104,10 @@ cases:
               namespace: openshift-cnv
             spec:
               permittedHostDevices:
-                pciHostDevices: []
-  - name: no HyperConverged present -> non-compliant (size != 1)
+                mediatedDevices:
+                  - mdevNameSelector: GRID T4-2Q
+                    resourceName: nvidia.com/GRID_T4-2Q
+  - name: missing HyperConverged resource is non-compliant
     expect: false
     inputs:
       hcoList:

applications/openshift-virtualization/kubevirt-no-vms-overcommitting-guest-memory/cel/shared.yml

@@ -1,21 +1,20 @@
 check_type: Platform
 
 failure_reason: |-
-    The '.spec.template.spec.domain.resources.overcommitGuestOverhead' field exists and is
-    set to "true" in the 'VirtualMachine' resource, allowing VMs to
-    overcommit KubeVirt's memory which may lead to guests crashing and
-    interrupting workloads causing malfunctions.
+    One or more 'VirtualMachine' resources set
+    '.spec.template.spec.domain.resources.overcommitGuestOverhead' to "true",
+    allowing VMs to overcommit KubeVirt's memory which may lead to guests
+    crashing and interrupting workloads causing malfunctions.
 
 inputs:
   - name: vms
     kubernetes_input_spec:
       api_version: kubevirt.io/v1
-      resource: VirtualMachine
+      resource: virtualmachines
 
 expression: |
-  vms.all(h,
-      !has(h.spec.template.spec.domain.resources) ||
-      !has(h.spec.template.spec.domain.resources.overcommitGuestOverhead) ||
-      (has(h.spec.template.spec.domain.resources.overcommitGuestOverhead) &&
-       h.spec.template.spec.domain.resources.overcommitGuestOverhead == false)
+  vms.items.all(v,
+      !has(v.spec.template.spec.domain.resources) ||
+      !has(v.spec.template.spec.domain.resources.overcommitGuestOverhead) ||
+      v.spec.template.spec.domain.resources.overcommitGuestOverhead == false
   )

applications/openshift-virtualization/kubevirt-no-vms-overcommitting-guest-memory/cel/tests/cases.yaml

@@ -0,0 +1,101 @@
+# CEL rule unit-test fixtures. Evaluated by tests/unit/kubernetes/test_cel_rules.py
+# via celctl (cel-go, the Compliance Operator scanner engine).
+# Seeded from real API objects; see provenance. Versions only, nothing cluster-identifiable.
+provenance:
+  fetched_with: celctl cac scaffold --from-cluster
+  date: '2026-07-23'
+  openshift_version: 4.22.0
+  kubernetes_version: v1.35.5
+  source_api_versions:
+    vms: kubevirt.io/v1
+cases:
+  - name: no VirtualMachines present is compliant
+    expect: true
+    inputs:
+      vms:
+        apiVersion: v1
+        kind: List
+        items: []
+  - name: VM without overcommitGuestOverhead is compliant
+    expect: true
+    inputs:
+      vms:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: kubevirt.io/v1
+            kind: VirtualMachine
+            metadata:
+              name: vm-plain
+              namespace: default
+            spec:
+              template:
+                spec:
+                  domain:
+                    resources:
+                      requests:
+                        memory: 2Gi
+  - name: VM with overcommitGuestOverhead disabled is compliant
+    expect: true
+    inputs:
+      vms:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: kubevirt.io/v1
+            kind: VirtualMachine
+            metadata:
+              name: vm-explicit-false
+              namespace: default
+            spec:
+              template:
+                spec:
+                  domain:
+                    resources:
+                      overcommitGuestOverhead: false
+  - name: VM with overcommitGuestOverhead enabled is not compliant
+    expect: false
+    inputs:
+      vms:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: kubevirt.io/v1
+            kind: VirtualMachine
+            metadata:
+              name: vm-ok
+              namespace: default
+            spec:
+              template:
+                spec:
+                  domain:
+                    resources:
+                      requests:
+                        memory: 2Gi
+          - apiVersion: kubevirt.io/v1
+            kind: VirtualMachine
+            metadata:
+              name: vm-overcommit
+              namespace: default
+            spec:
+              template:
+                spec:
+                  domain:
+                    resources:
+                      overcommitGuestOverhead: true
+  - name: VM without a resources block is compliant
+    expect: true
+    inputs:
+      vms:
+        apiVersion: v1
+        kind: List
+        items:
+          - apiVersion: kubevirt.io/v1
+            kind: VirtualMachine
+            metadata:
+              name: vm-noresources
+              namespace: default
+            spec:
+              template:
+                spec:
+                  domain: {}

applications/openshift-virtualization/kubevirt-nonroot-feature-gate-is-enabled/cel/shared.yml

@@ -1,8 +1,10 @@
 check_type: Platform
 
 failure_reason: |-
-    The '.spec.featureGates.nonRoot' field is missing or not set to 'true' in
-    the 'kubevirt-hyperconverged' resource.
+    The '.spec.featureGates.nonRoot' field is present and not set to 'true' in
+    the 'kubevirt-hyperconverged' resource. On OpenShift Virtualization 4.18
+    and later the field is removed and non-root execution is always enforced,
+    so an absent field is compliant.
 
 inputs:
   - name: hcoList
@@ -19,7 +21,7 @@ expression: |
       h.metadata.name == 'kubevirt-hyperconverged' &&
       h.metadata.namespace == 'openshift-cnv'
   ).all(h,
-      has(h.spec.featureGates) &&
-      has(h.spec.featureGates.nonRoot) &&
+      !has(h.spec.featureGates) ||
+      !has(h.spec.featureGates.nonRoot) ||
       h.spec.featureGates.nonRoot == true
   )