From 5a579b58f0c378ae2028ec0f3f82ae37d77664f5 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Fri, 24 Jul 2026 12:22:26 +0100 Subject: [PATCH 1/2] CMP-4434: Add manual rule kubevirt-use-multi-network-policies (CIS OCP-Virt 4.3) --- .../rule.yml | 32 +++++++++++++++++++ .../ocp4/profiles/cis-vm-extension.profile | 1 + 2 files changed, 33 insertions(+) create mode 100644 applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml diff --git a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml new file mode 100644 index 000000000000..b03754dc9a83 --- /dev/null +++ b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml @@ -0,0 +1,32 @@ +documentation_complete: true + +title: 'Use Multi-Network Policies' + +description: |- + Multi-network policies should be used to control traffic between + virtual machines on secondary networks. Standard Kubernetes + NetworkPolicy resources only govern traffic on the primary + pod network. Without MultiNetworkPolicy resources, traffic + on secondary networks attached via NetworkAttachmentDefinition + objects is unrestricted, allowing any VM to communicate with any + other VM on the same secondary network. + +rationale: |- + Secondary networks configured through Multus bypass the default + Kubernetes network policy enforcement. If multi-network policies are + not applied, workloads on those networks have unrestricted + connectivity, increasing the risk of lateral movement and + unauthorized access between virtual machines. Deploying + MultiNetworkPolicy resources ensures that traffic on + secondary networks is subject to the same segmentation controls + as the primary cluster network. + +severity: medium + +ocil_clause: 'multi-network policies are not in use' + +ocil: |- + Run the following command to check for multi-network policies: + 
$ oc get multi-networkpolicies -A
+ Verify that multi-network policies exist and are configured for + namespaces that use secondary networks. diff --git a/products/ocp4/profiles/cis-vm-extension.profile b/products/ocp4/profiles/cis-vm-extension.profile index 9c3e034f0bb9..18ed330ae882 100644 --- a/products/ocp4/profiles/cis-vm-extension.profile +++ b/products/ocp4/profiles/cis-vm-extension.profile @@ -30,6 +30,7 @@ selections: - kubevirt-enforce-trusted-tls-registries - kubevirt-no-vm-device-passthrough - kubevirt-no-shareable-disks + - kubevirt-use-multi-network-policies - kubevirt-disk-error-policy-not-ignore - kubevirt-sriov-vlan-required - kubevirt-localnet-vlan-required From 968e89ba5e08f9e790c6c4b812585d4562313311 Mon Sep 17 00:00:00 2001 From: taimurhafeez Date: Thu, 6 Aug 2026 11:44:41 +0100 Subject: [PATCH 2/2] Update description with CustomRule guidance per review- explains manual status and points organizations to CustomRules for automation. Co-Authored-By: Claude Opus 4.6 --- .../kubevirt-use-multi-network-policies/rule.yml | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml index b03754dc9a83..cc3cc635c8b1 100644 --- a/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml +++ b/applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml @@ -3,13 +3,13 @@ documentation_complete: true title: 'Use Multi-Network Policies' description: |- - Multi-network policies should be used to control traffic between - virtual machines on secondary networks. Standard Kubernetes - NetworkPolicy resources only govern traffic on the primary - pod network. Without MultiNetworkPolicy resources, traffic - on secondary networks attached via NetworkAttachmentDefinition - objects is unrestricted, allowing any VM to communicate with any - other VM on the same secondary network. + Because the required multi-network policy configuration is specific + to each cluster's secondary network topology, this rule cannot be + evaluated automatically and always reports a manual status. + Organizations that use secondary networks should consider creating + a CustomRule with a CEL expression that verifies + MultiNetworkPolicy resources exist in the namespaces where + NetworkAttachmentDefinition objects are deployed. rationale: |- Secondary networks configured through Multus bypass the default