CMP-4434: Add manual rule kubevirt-use-multi-network-policies CIS OCP-Virt 4.3

[taimurhafeez]

Summary

• Add manual rule kubevirt-use-multi-network-policies for CIS OCP-Virt 4.3 (Use multi-network policies, Level 2)
• Rule is manual because MultiNetworkPolicy is not a registered resource type on test clusters (OCP 4.22, disabled in Cluster Network Operator) — a CEL check would fetch an unregistered type and produce misleading results
• Audit procedure: oc get multi-networkpolicies -A
• Update build_cel_content.py to warn (instead of error) when a CEL profile references rules without CEL checks, allowing manual rules in CEL profiles
• Update CEL documentation to reflect manual rule support

Test plan

• ./build_product ocp4 --cel-content=ocp4 completes with warning, no errors
• Manual rule is excluded from build/ocp4-cel-content.yaml (expected — no CEL expression)
• Existing CEL rules in cis-vm-extension profile are unaffected

Co Authored by Claude.

[openshift-ci]

Hi @taimurhafeez. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Anna-Koudelkova]

/ok-to-test

[Vincent056]

LGTM on the rule content (matches the plan decision to ship CIS 4.3 as Manual — MultiNetworkPolicy CRD is disabled by default). Two asks: (1) rebase to drop the duplicated build-script/docs change once #14920 merges; (2) mention in the description that the audit requires useMultiNetworkPolicy: true in the Cluster Network Operator config.

[rhmdnd]

Looks good, but we'll need to rebase and add something more to the description that points users to CustomRules as a way to automate this finding.

[openshift-ci]

@taimurhafeez: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	e45ff9e	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

[openshift-ci]

PR needs rebase.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.