From 54d48359c88734e68c278f0aa046c4cc21702972 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Fri, 24 Jul 2026 12:22:26 +0100 Subject: [PATCH 1/2] CMP-4434: Add manual rule kubevirt-use-multi-network-policies (CIS OCP-Virt 4.3) --- .../rule.yml | 32 +++++++++++++++++++ build-scripts/build_cel_content.py | 6 ++-- docs/manual/developer/13_cel_content.md | 13 ++++---- .../ocp4/profiles/cis-vm-extension.profile | 1 + 4 files changed, 44 insertions(+), 8 deletions(-) create mode 100644 applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml new file mode 100644 index 000000000000..b03754dc9a83 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml @@ -0,0 +1,32 @@ +documentation_complete: true + +title: 'Use Multi-Network Policies' + +description: |- + Multi-network policies should be used to control traffic between + virtual machines on secondary networks. Standard Kubernetes + NetworkPolicy resources only govern traffic on the primary + pod network. Without MultiNetworkPolicy resources, traffic + on secondary networks attached via NetworkAttachmentDefinition + objects is unrestricted, allowing any VM to communicate with any + other VM on the same secondary network. + +rationale: |- + Secondary networks configured through Multus bypass the default + Kubernetes network policy enforcement. If multi-network policies are + not applied, workloads on those networks have unrestricted + connectivity, increasing the risk of lateral movement and + unauthorized access between virtual machines. Deploying + MultiNetworkPolicy resources ensures that traffic on + secondary networks is subject to the same segmentation controls + as the primary cluster network. + +severity: medium + +ocil_clause: 'multi-network policies are not in use' + +ocil: |- + Run the following command to check for multi-network policies: + 
$ oc get multi-networkpolicies -A
+ Verify that multi-network policies exist and are configured for + namespaces that use secondary networks. diff --git a/build-scripts/build_cel_content.py b/build-scripts/build_cel_content.py index 74786b6b9185..c58f3820bc51 100755 --- a/build-scripts/build_cel_content.py +++ b/build-scripts/build_cel_content.py @@ -339,8 +339,10 @@ def generate_cel_content(cel_rules, profiles): for rule_id in profile.selected: if rule_id not in cel_rule_ids: rule_name = rule_id_to_name(rule_id) - raise ValueError( - f"profile '{profile_name}' references unknown rule '{rule_name}'" + logging.warning( + "profile '%s' references rule '%s' without CEL checks " + "(manual rule) - skipping from CEL content", + profile_name, rule_name, ) cel_profile = profile_to_cel_dict(profile, cel_rule_ids) diff --git a/docs/manual/developer/13_cel_content.md b/docs/manual/developer/13_cel_content.md index 91cbddf9c15d..d4fd977096a9 100644 --- a/docs/manual/developer/13_cel_content.md +++ b/docs/manual/developer/13_cel_content.md @@ -141,7 +141,7 @@ selections: - kubevirt-persistent-reservation-disabled ``` -**Important:** CEL profiles can only select CEL rules. If a profile includes both CEL and OVAL rules, only the CEL rules will be included in the generated CEL content file. +**Important:** CEL profiles can select both CEL rules and manual rules (rules without `cel/shared.yml`). Only CEL rules are included in the generated CEL content file; manual rules are skipped with a build warning. ## Creating a CEL Rule @@ -347,8 +347,8 @@ The build system validates CEL content automatically: **Profile Validation:** - `selected` field must contain at least one rule -- All selected rules must exist in CEL rules -- Profile cannot reference OVAL rules +- Rules without CEL checks (manual rules) are skipped with a warning +- Only CEL rules are included in the generated content **Content Validation:** - No duplicate rule names (after underscore-to-hyphen conversion) @@ -434,9 +434,10 @@ cel-spec '{"resource": {"spec": {"enabled": true}}}' 'resource.spec.enabled == t **Error: `CEL profile 'profile-name' has no rules`** - Add rules to the `selections` field in the profile -**Error: `profile 'profile-name' references unknown rule 'rule-name'`** -- Verify the rule exists and has CEL checks (has `cel/shared.yml` with `expression` and `inputs`) -- Check the rule ID matches the profile selection +**Warning: `profile 'profile-name' references rule 'rule-name' without CEL checks (manual rule)`** +- This is expected for manual rules that have no automated CEL check +- The rule will be skipped from CEL content output but remains in the profile selections +- If this is unintentional, verify the rule has `cel/shared.yml` with `expression` and `inputs` ### CEL Content Not Generated diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index a988efb13ced..374822c9e50f 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -31,3 +31,4 @@ selections: - kubevirt-no-vm-device-passthrough - kubevirt-no-shareable-disks - kubevirt-disk-error-policy-not-ignore + - kubevirt-use-multi-network-policies From e45ff9e5f2a097aa4ec6b6a46ade7781c075ffb5 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 11:44:41 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review- explains manual status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 --- .../kubevirt-use-multi-network-policies/rule.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml index b03754dc9a83..cc3cc635c8b1 100644 --- a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml +++ b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml @@ -3,13 +3,13 @@ documentation_complete: true title: 'Use Multi-Network Policies' description: |- - Multi-network policies should be used to control traffic between - virtual machines on secondary networks. Standard Kubernetes - NetworkPolicy resources only govern traffic on the primary - pod network. Without MultiNetworkPolicy resources, traffic - on secondary networks attached via NetworkAttachmentDefinition - objects is unrestricted, allowing any VM to communicate with any - other VM on the same secondary network. + Because the required multi-network policy configuration is specific + to each cluster's secondary network topology, this rule cannot be + evaluated automatically and always reports a manual status. + Organizations that use secondary networks should consider creating + a CustomRule with a CEL expression that verifies + MultiNetworkPolicy resources exist in the namespaces where + NetworkAttachmentDefinition objects are deployed. rationale: |- Secondary networks configured through Multus bypass the default