CMP-4425: Grant scanner RBAC for OpenShift Virtualization resources#1293
CMP-4425: Grant scanner RBAC for OpenShift Virtualization resources#1293Vincent056 wants to merge 1 commit into
Conversation
The CEL scanner runs as the api-resource-collector service account, whose ClusterRole is a curated allow-list. CIS OpenShift Virtualization benchmark rules need to read VirtualMachine, CDI, NetworkAttachmentDefinition and SriovNetwork resources; without RBAC a CEL fetch degrades to an empty result and produces misleading compliance status. Add get/list/watch for kubevirt.io, instancetype.kubevirt.io, cdi.kubevirt.io, k8s.cni.cncf.io and sriovnetwork.openshift.io (hco.kubevirt.io already granted), and regenerate the CSV clusterPermissions. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
|
Skipping CI for Draft Pull Request. |
|
@Vincent056: This pull request references CMP-4425 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the story to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: Vincent056 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
🤖 To deploy this PR, run the following command: |
|
@Vincent056: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
What
Adds
get/list/watchRBAC to theapi-resource-collectorClusterRole for the OpenShift Virtualization resource types needed by the CIS OpenShift Virtualization benchmark CEL content:kubevirt.io— virtualmachines, virtualmachineinstancesinstancetype.kubevirt.io— virtualmachineclusterinstancetypes, virtualmachineclusterpreferencescdi.kubevirt.io— cdisk8s.cni.cncf.io— network-attachment-definitions, multi-networkpoliciessriovnetwork.openshift.io— sriovnetworks(
hco.kubevirt.iois already granted.) The CSVclusterPermissionswere regenerated viamake bundle.Why
The CEL scanner runs as the
api-resource-collectorservice account, whose ClusterRole is a curated allow-list (no wildcard). When a CEL rule references a resource the SA cannot read, the fetch is denied and the SDK degrades to an empty resource map, which yields a misleading PASS/FAIL rather than an error. Granting read access to these OCP-Virt types lets the benchmark's VM/network rules evaluate correctly out of the box.Testing
Read-only RBAC addition;
make bundlevalidates clean. End-to-end validation against a CNV cluster will follow once a test cluster is available (tracked in CMP-4475).Jira: https://issues.redhat.com/browse/CMP-4425
🤖 Generated with Claude Code