CMP-4444: Add rule kubevirt-vcpu-metrics-enabled (CIS OCP-Virt 6.2)

[taimurhafeez]

Supersedes #14961

Tested on OCP 4.22

oc get csv -n openshift-cnv
NAME                                         DISPLAY                          VERSION               RELEASE   REPLACES                                   PHASE
kubevirt-hyperconverged-operator.v4.22.2     OpenShift Virtualization         4.22.2                          kubevirt-hyperconverged-operator.v4.22.0   Succeeded

Result when there is no schedstats=enable

oc get ccr -n openshift-compliance 
NAME                                                             STATUS   SEVERITY
cis-vm-ext-node-worker-kubevirt-nested-virtualization-disabled   PASS     medium
cis-vm-ext-node-worker-kubevirt-seccomp-profile-permissions      PASS     medium
cis-vm-ext-node-worker-kubevirt-vcpu-metrics-enabled             FAIL     medium

Result with schedstats=enable

oc get ccr -n openshift-compliance 
NAME                                                             STATUS   SEVERITY
cis-vm-ext-node-worker-kubevirt-nested-virtualization-disabled   PASS     medium
cis-vm-ext-node-worker-kubevirt-seccomp-profile-permissions      PASS     medium
cis-vm-ext-node-worker-kubevirt-vcpu-metrics-enabled             PASS     medium

[openshift-ci]

Hi @taimurhafeez. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Vincent056]

/lgtm

[Vincent056]

/ok-to-test

[Vincent056]

Rule content is byte-identical to #14961, which I validated in depth (built datastream + oscap-chroot truth table, 5/5) - and the live before/after results here match.

/approve

[openshift-ci]

@taimurhafeez: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	d597fe7	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.