CMP-4426: Add HyperConverged CEL rules for CIS OCP-Virt 1.4/1.6/1.7 by Vincent056 · Pull Request #14917 · ComplianceAsCode/content

Vincent056 · 2026-07-23T07:24:51Z

Summary

Adds three CEL rules for the CIS OCP-Virt benchmark's HyperConverged controls, one commit per Jira:

Commit	CIS	Rule
CMP-4426	1.4	`kubevirt-downward-metrics-disabled` — downwardMetrics feature gate off (absent/false compliant)
CMP-4427	1.7	`kubevirt-ksm-disabled` — any `ksmConfiguration` fails (an empty selector enables KSM on ALL nodes; KSM is a cross-VM memory side channel)
CMP-4428	1.6	`kubevirt-no-jsonpatch-annotations` — no unsupported kubevirt/CDI/network-addons/SSP jsonpatch annotations

All three read the hyperconvergeds list (same input as the existing rules, no new RBAC needed) and are added to the cis-vm-extension profile selections.

Testing

Each rule ships cel/tests/cases.yaml fixtures with compliant and non-compliant cases, evaluated through celctl (the compliance-operator scanner engine):

celctl cac lint + cac test: 13/13 cases pass
Live cluster (OCP 4.22 + CNV): cac live AND a full operator scan (ProfileBundle with celContentFile → ScanSettingBinding) — downward-metrics PASS, jsonpatch PASS, and ksm-disabled correctly reports FAIL on a cluster whose HCO serves ksmConfiguration: {} (KubeVirt treats the empty selector as enable-everywhere)

🤖 Generated with Claude Code

openshift-ci · 2026-07-23T07:25:04Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

abushkin-redhat · 2026-07-27T10:40:28Z

Hey Vincent,

I reviewed the PR and it looks good. I think it's ready to merge.

/lgtm

rhmdnd

Overall looks good. Minor recommendations on test name improvement can be addressed in a follow up. Primary concern is if we can simplify the HyperConvergeds resource lookup by removing it from the expression (that would also remove testing surface area from each rule).

rhmdnd

/lgtm

…rt 1.4) Automated check that the downwardMetrics feature gate is disabled on the kubevirt-hyperconverged resource. Exposing host metrics to guests leaks node-level information across the isolation boundary. Absent or false is compliant (disabled by default); only an explicit true fails. Fixtures: 4 cases via celctl (cel-go, the scanner engine) - 4/4 pass; lint OK; live on OCP 4.22 + CNV: PASS. Added to cis-vm-extension profile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Automated check that Kernel Samepage Merging is disabled. KSM is a known cross-VM memory side channel; it is enabled by configuring a nodeLabelSelector under .spec.ksmConfiguration on the kubevirt-hyperconverged resource. IMPORTANT semantics, verified empirically on a stock OpenShift Virtualization install: the HyperConverged operator serves 'ksmConfiguration: {}' BY DEFAULT and this does NOT enable KSM (/sys/kernel/mm/ksm/run stays 0 on the nodes). The rule therefore treats absent, null and empty-object ksmConfiguration as compliant, and fails only when a nodeLabelSelector is present (an empty selector selects all nodes). A presence-only check would false-positive on every default install. Fixtures: 5 cases via celctl - 5/5 pass; lint OK; live on a stock cluster (HCO serving ksmConfiguration {}): PASS. Added to cis-vm-extension profile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…t 1.6) Automated check that the kubevirt-hyperconverged resource carries none of the unsupported jsonpatch annotations (kubevirt.kubevirt.io/jsonpatch, containerizeddataimporter.kubevirt.io/jsonpatch, networkaddonsconfigs.kubevirt.io/jsonpatch, ssp.kubevirt.io/jsonpatch) that patch operand resources outside the supported API. Environments with an authorized patch waive the rule. Fixtures: 5 cases via celctl - 5/5 pass; lint OK; live on OCP 4.22 + CNV: PASS. Added to cis-vm-extension profile. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Requested by rhmdnd: clear prose names (e.g. 'missing HyperConverged configuration is non-compliant') instead of arrow style with parenthetical qualifiers. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

openshift-ci · 2026-08-07T21:02:34Z

@Vincent056: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	`1308913`	link	false	`/test e2e-aws-openshift-node-compliance`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

rhmdnd

/lgtm

openshift-ci Bot added the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 23, 2026

Vincent056 force-pushed the cmp-4426-hco-cel-rules branch from a03687f to 363faec Compare July 24, 2026 06:24

Vincent056 marked this pull request as ready for review July 24, 2026 06:29

openshift-ci Bot removed the do-not-merge/work-in-progress Used by openshift-ci bot. label Jul 24, 2026

Vincent056 mentioned this pull request Jul 24, 2026

ocp-test-profiles: skip rules with no CI-tested profile instead of failing with division by 0 #14924

Closed

abushkin-redhat approved these changes Jul 27, 2026

View reviewed changes

jan-cerny added the OpenShift OpenShift product related. label Jul 28, 2026

Vincent056 force-pushed the cmp-4426-hco-cel-rules branch 2 times, most recently from 9ec4e77 to d9977f7 Compare August 4, 2026 15:41