CMP-4434: Add manual rule kubevirt-use-multi-network-policies CIS OCP-Virt 4.3

[taimurhafeez]

Summary

• Add manual rule kubevirt-use-multi-network-policies for CIS OCP-Virt 4.3 (Use multi-network policies, Level 2)
• Rule is manual because MultiNetworkPolicy is not a registered resource type on test clusters (OCP 4.22, disabled in Cluster Network Operator) — a CEL check would fetch an unregistered type and produce misleading results
• Audit procedure: oc get multi-networkpolicies -A
• Update build_cel_content.py to warn (instead of error) when a CEL profile references rules without CEL checks, allowing manual rules in CEL profiles
• Update CEL documentation to reflect manual rule support

Test plan

• ./build_product ocp4 --cel-content=ocp4 completes with warning, no errors
• Manual rule is excluded from build/ocp4-cel-content.yaml (expected — no CEL expression)
• Existing CEL rules in cis-vm-extension profile are unaffected

Co Authored by Claude.

[openshift-ci]

Hi @taimurhafeez. Thanks for your PR.

I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Tip

We noticed you've done this a few times! Consider joining the org to skip this step and gain /lgtm and other bot rights. We recommend asking approvers on your previous PRs to sponsor you.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Anna-Koudelkova]

/ok-to-test

[Vincent056]

LGTM on the rule content (matches the plan decision to ship CIS 4.3 as Manual — MultiNetworkPolicy CRD is disabled by default). Two asks: (1) rebase to drop the duplicated build-script/docs change once #14920 merges; (2) mention in the description that the audit requires useMultiNetworkPolicy: true in the Cluster Network Operator config.

[rhmdnd]

Looks good, but we'll need to rebase and add something more to the description that points users to CustomRules as a way to automate this finding.

[Vincent056]

/lgtm
/approve

[yuumasato]

After reading these manual rule descriptions a few times, I think they are a bit backwards.

First thing in the description should be what the rule is or should be checking for, then we can say we cannot automate the rule, then suggest how they can do it themselves.
Additionally, it looks like the rule description is a bit misaligned.
For example:

    Ensure that at least one <tt>MultiNetworkPolicy</tt> object exists in each namespace
    defined in the cluster. Where each <tt>MultiNetworkPollicy</tt> must match a VM and the
    <tt>NetworkAttachmentDefinition</tt> the VM is connected to.

    Because the required multi-network policy configuration is specific
    to each cluster's secondary network topology, this rule cannot be
    evaluated automatically and always reports a manual status.

    Organizations that use secondary networks should consider creating
    a CustomRule with a CEL expression.

Then, ideally have an example CEL expression that users an use as a base to write their own expression.

[yuumasato]

We can do this improvement in a follow up PR.

[yuumasato]

/lgtm

[Vincent056]

/ok-to-test

[openshift-ci]

@taimurhafeez: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-aws-openshift-node-compliance	968e89b	link	false	/test e2e-aws-openshift-node-compliance

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

Lance's concerns have been addressed.