Map OCP Virtualization rules to STIG controls and add stig-virt CEL profile by yuumasato · Pull Request #15043 · ComplianceAsCode/content

yuumasato · 2026-08-25T00:17:54Z

Summary

CMP-4294, CMP-4295, CMP-4296, CMP-4297, CMP-4298, CMP-4299, CMP-4300, CMP-4301, CMP-4302, CMP-4303, CMP-4304, CMP-4305, CMP-4306, CMP-4307, CMP-4308

Map 15 existing kubevirt rules to 9 STIG controls in controls/stig_ocp4.yml
Create stig-virt.profile — a CEL profile that selects kubevirt rules from the STIG control file using filter_rules
Exclude node kubevirt rules from stig-virt — those are automated in the stig-node XCCDF profile
Fix build crash when XCCDF profiles select CEL-only rules (get_variables_of_rules defaulting to empty set)

STIG control mappings

Control	Rules added
CNTR-OS-000090	`kubevirt-restrict-migration-tools-access`, `kubevirt-nested-virtualization-disabled`, `kubevirt-seccomp-profile-permissions`, `kubevirt-cache-directory-permissions`
CNTR-OS-000100	`kubevirt-sriov-spoofchk-on`, `kubevirt-bridge-mac-spoof-filtering`
CNTR-OS-000110	`kubevirt-downward-metrics-disabled`
CNTR-OS-000150	`kubevirt-disk-error-policy-not-ignore`
CNTR-OS-000400	`kubevirt-nonroot-feature-gate-is-enabled`
CNTR-OS-000500	`kubevirt-restrict-vnc-access-to-workloads`
CNTR-OS-000560	`kubevirt-persistent-reservation-disabled`, `kubevirt-no-shareable-disks`, `kubevirt-ksm-disabled`
CNTR-OS-000740	`kubevirt-no-jsonpatch-annotations`
CNTR-OS-001020	`kubevirt-no-permitted-host-devices`

stig-virt profile

Uses the control file as single source of truth (same pattern as the existing stig/stig-node platform split):

scanner_type: CEL
filter_rules: '"kubevirt" in id_ and "ocp4-node" not in platforms'
selections:
    - stig_ocp4:all

10 CEL kubevirt rules (automated) + 2 manual kubevirt rules
3 node kubevirt rules excluded (automated via OVAL in stig-node XCCDF)

Build system fix

ssg/build_yaml.py line 701: rules_and_variables_dict.get(rule) → rules_and_variables_dict.get(rule, set()).
CEL-only rules are excluded from the XCCDF rule tree but can still be selected by XCCDF profiles via control files. Without the default, set.update(None) raises TypeError.

Note on profile filters

Kubevirt filter_rules for pre-V2R6 and RHCOS profiles are in #15042 (version bump PR). This PR only adds the stig-virt profile filter.

Test plan

./build_product ocp4 --datastream --cel-content=ocp4 succeeds
stig-virt CEL profile contains 12 kubevirt rules (10 CEL + 2 manual), no node rules
No kubevirt rules leak into XCCDF STIG profiles
CI passes

🤖 Generated with Claude Code

Map 4 OpenShift Virtualization rules to CNTR-OS-000090 (RBAC access controls) per DISA STIG V2R6 which added OCP Virt checks for seccomp profile permissions, cache directory permissions, migration tools RBAC, and nested virtualization. Rules added: - kubevirt-restrict-migration-tools-access (manual) - kubevirt-nested-virtualization-disabled (OVAL, node) - kubevirt-seccomp-profile-permissions (file_permissions, node) - kubevirt-cache-directory-permissions (file_permissions, node) Closes: CMP-4294, CMP-4295, CMP-4296, CMP-4297 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map 2 OpenShift Virtualization rules to CNTR-OS-000100 (network policy enforcement) per DISA STIG V2R6 which added OCP Virt checks for SR-IOV spoofchk and Bridge CNI MAC-spoof filtering. Rules added: - kubevirt-sriov-spoofchk-on (CEL) - kubevirt-bridge-mac-spoof-filtering (CEL) Closes: CMP-4298 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map OpenShift Virtualization rule to CNTR-OS-000110 (approved authorizations for information flow) per DISA STIG V2R6 which added a check that downward metrics must be disabled on HyperConverged CR. Rules added: - kubevirt-downward-metrics-disabled (CEL) Closes: CMP-4299, CMP-4300 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map OpenShift Virtualization rule to CNTR-OS-000150 (audit records for auditable events) per DISA STIG V2R6 which added a check that VM disk errorPolicy must not be set to "ignore". Rules added: - kubevirt-disk-error-policy-not-ignore (CEL) Closes: CMP-4301 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map OpenShift Virtualization rule to CNTR-OS-000400 (disable root and terminate network connections) per DISA STIG V2R6 which added a check that the nonRoot feature gate must be enabled on HyperConverged CR. Rules added: - kubevirt-nonroot-feature-gate-is-enabled (CEL) Closes: CMP-4302 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map OpenShift Virtualization rule to CNTR-OS-000500 (separate user functionality from management) per DISA STIG V2R6 which added a check to restrict VNC access via token.kubevirt.io:generate rolebinding. Rules added: - kubevirt-restrict-vnc-access-to-workloads (manual) Closes: CMP-4303 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map 3 OpenShift Virtualization rules to CNTR-OS-000560 (prevent unauthorized info transfer via shared resources) per DISA STIG V2R6 which added checks for persistent reservation, shareable disks, and KSM. Rules added: - kubevirt-persistent-reservation-disabled (CEL) - kubevirt-no-shareable-disks (CEL) - kubevirt-ksm-disabled (CEL) Closes: CMP-4304, CMP-4305, CMP-4306 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map OpenShift Virtualization rule to CNTR-OS-000740 (prevent installation of unverified patches) per DISA STIG V2R6 which added a check for jsonpatch annotations on HyperConverged CR. Rules added: - kubevirt-no-jsonpatch-annotations (CEL) Closes: CMP-4307 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Map OpenShift Virtualization rule to CNTR-OS-001020 (disable USB storage kernel module) per DISA STIG V2R6 which added a check that no permitted host devices are configured on HyperConverged CR. Rules added: - kubevirt-no-permitted-host-devices (CEL) Closes: CMP-4308 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Creates a new profile that selects all kubevirt rules from the STIG control file using filter_rules, following the same pattern as the existing stig/stig-node profile split. The scanner_type: CEL ensures this profile is excluded from XCCDF data streams and only appears in CEL content output. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Rules with only CEL checks (cel/shared.yml, no OVAL or template) are excluded from the XCCDF rule tree but can still be selected by XCCDF profiles via control files. get_variables_of_rules() crashed with TypeError because dict.get() returned None for these rules. Default to an empty set since CEL-only rules have no XCCDF variables. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Vincent056 · 2026-08-25T01:50:29Z

Validated this end to end: built the branch (./build_product ocp4 --datastream --cel-content=ocp4), packaged the artifacts into a content image, parsed it through the operator (ProfileBundle VALID, stig-virt appears with all 15 rules) and ran a full scan on a 4.21 cluster.

One design issue to resolve: the three node rules end up MANUAL in this CEL profile. kubevirt-nested-virtualization-disabled, kubevirt-seccomp-profile-permissions and kubevirt-cache-directory-permissions carry no CEL expression, so the scanner emits MANUAL for them — the validation scan shows 5/15 MANUAL: these three plus the two genuinely-manual restrict-* rules. All three are fully automated in cis-vm-extension-node, so the STIG profile silently loses automation the CIS profile has.

Suggestion: either add a companion stig-virt-node XCCDF profile (mirroring the cis-vm-extension/-node split) so they keep their automation, or drop them from this profile and state that v1 is platform-only. Shipping them as MANUAL here will read as a regression next to the CIS profile.

Node kubevirt rules are already automated in the stig-node XCCDF profile, so exclude them from the stig-virt CEL profile to avoid showing them as manual. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

yuumasato · 2026-08-25T12:09:05Z

Thanks for the thorough validation, @Vincent056!

This is addressed now — the stig-virt profile filter was updated to '"kubevirt" in id_ and "ocp4-node" not in platforms', which excludes the 3 node kubevirt rules. The profile now has 12 rules: 10 CEL (automated) + 2 genuinely-manual restrict-* rules.

The 3 node rules (kubevirt-nested-virtualization-disabled, kubevirt-seccomp-profile-permissions, kubevirt-cache-directory-permissions) are already automated via OVAL in the stig-node XCCDF profile, so there's no loss of automation — they just live in a different profile, matching the existing stig/stig-node platform split.

Split stig-virt into a versioned snapshot (stig-virt-v2r6) with the actual selections and filter, and a tip profile (stig-virt) that extends it. Follows the same pattern as the stig/stig-node platform split. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

yuumasato · 2026-08-25T13:56:24Z

Maybe this profile should be named stig-vm-extension?
To follow same pattern as cis-vm-extension?

yuumasato · 2026-08-25T13:56:56Z

Should maybe be renamed to stig-vm-extension-v2r6?

openshift-ci · 2026-08-25T14:30:33Z

@yuumasato: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-platform-compliance	`ac70d17`	link	true	`/test e2e-aws-openshift-platform-compliance`

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Rename to align with the CIS VM extension profile naming convention (cis-vm-extension).

yuumasato and others added 11 commits August 25, 2026 01:54

yuumasato requested review from Mab879, ggbecker, jan-cerny, marcusburghardt and vojtapolasek as code owners August 25, 2026 00:17

Exclude node kubevirt rules from stig-virt CEL profile

f2b319d

Node kubevirt rules are already automated in the stig-node XCCDF profile, so exclude them from the stig-virt CEL profile to avoid showing them as manual. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

yuumasato force-pushed the stig-ocp4-v2r6-virt-rules branch from 3f33ef6 to f2b319d Compare August 25, 2026 12:06

yuumasato mentioned this pull request Aug 25, 2026

Bump OCP4 STIG from V2R2/V2R3 to V2R6 #15042

Open

4 tasks

yuumasato commented Aug 25, 2026

View reviewed changes

Rename stig-virt profile to stig-vm-extension

f58d771

Rename to align with the CIS VM extension profile naming convention (cis-vm-extension).

Navigation Menu

Uh oh!

Map OCP Virtualization rules to STIG controls and add stig-virt CEL profile - #15043

Map OCP Virtualization rules to STIG controls and add stig-virt CEL profile#15043
yuumasato wants to merge 14 commits into
ComplianceAsCode:masterfrom
yuumasato:stig-ocp4-v2r6-virt-rules

yuumasato commented Aug 25, 2026 •

edited

Loading

Uh oh!

Vincent056 commented Aug 25, 2026

Uh oh!

yuumasato commented Aug 25, 2026

Uh oh!

yuumasato Aug 25, 2026

Uh oh!

yuumasato Aug 25, 2026

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

yuumasato commented Aug 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

STIG control mappings

stig-virt profile

Build system fix

Note on profile filters

Test plan

Uh oh!

Vincent056 commented Aug 25, 2026

Uh oh!

yuumasato commented Aug 25, 2026

Uh oh!

yuumasato Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

yuumasato Aug 25, 2026

Choose a reason for hiding this comment

Uh oh!

openshift-ci Bot commented Aug 25, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

yuumasato commented Aug 25, 2026 •

edited

Loading