Skip to content

CMP-4434: Add manual rule kubevirt-use-multi-network-policies CIS OCP-Virt 4.3 #14928

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
yuumasato merged 2 commits into from
Aug 12, 2026
Merged

CMP-4434: Add manual rule kubevirt-use-multi-network-policies CIS OCP-Virt 4.3 #14928

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5a579b5
CMP-4434: Add manual rule kubevirt-use-multi-network-policies (CIS O…
taimurhafeez Jul 24, 2026
968e89b
Update description with CustomRule guidance per review- explains manual
taimurhafeez Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions applications/openshift-virtualization/kubevirt-use-multi-network-policies/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
documentation_complete: true

title: 'Use Multi-Network Policies'

description: |-

@yuumasato yuumasato Aug 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After reading these manual rule descriptions a few times, I think they are a bit backwards.

First thing in the description should be what the rule is or should be checking for, then we can say we cannot automate the rule, then suggest how they can do it themselves.
Additionally, it looks like the rule description is a bit misaligned.
For example:

    Ensure that at least one <tt>MultiNetworkPolicy</tt> object exists in each namespace
    defined in the cluster. Where each <tt>MultiNetworkPollicy</tt> must match a VM and the
    <tt>NetworkAttachmentDefinition</tt> the VM is connected to.

    Because the required multi-network policy configuration is specific
    to each cluster's secondary network topology, this rule cannot be
    evaluated automatically and always reports a manual status.

    Organizations that use secondary networks should consider creating
    a CustomRule with a CEL expression.

Then, ideally have an example CEL expression that users an use as a base to write their own expression.

@yuumasato yuumasato Aug 11, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We can do this improvement in a follow up PR.

Because the required multi-network policy configuration is specific
to each cluster's secondary network topology, this rule cannot be
evaluated automatically and always reports a manual status.
Organizations that use secondary networks should consider creating
a CustomRule with a CEL expression that verifies
<tt>MultiNetworkPolicy</tt> resources exist in the namespaces where
<tt>NetworkAttachmentDefinition</tt> objects are deployed.

rationale: |-
Secondary networks configured through Multus bypass the default
Kubernetes network policy enforcement. If multi-network policies are
not applied, workloads on those networks have unrestricted
connectivity, increasing the risk of lateral movement and
unauthorized access between virtual machines. Deploying
<tt>MultiNetworkPolicy</tt> resources ensures that traffic on
secondary networks is subject to the same segmentation controls
as the primary cluster network.

severity: medium

ocil_clause: 'multi-network policies are not in use'

ocil: |-
Run the following command to check for multi-network policies:
<pre>$ oc get multi-networkpolicies -A</pre>
Verify that multi-network policies exist and are configured for
namespaces that use secondary networks.
1 change: 1 addition & 0 deletions products/ocp4/profiles/cis-vm-extension.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,6 +30,7 @@ selections:
- kubevirt-enforce-trusted-tls-registries
- kubevirt-no-vm-device-passthrough
- kubevirt-no-shareable-disks
- kubevirt-use-multi-network-policies
- kubevirt-disk-error-policy-not-ignore
- kubevirt-sriov-vlan-required
- kubevirt-localnet-vlan-required
Expand Down
Loading