CMP-4521: Fix HyperShift Hosted Cluster detection using controlPlaneTopology - #15085
Open
yuumasato wants to merge 1 commit into
Open
Conversation
The previous OVAL check for detecting HyperShift Hosted Clusters was unreliable because it looked for a hardcoded pod name that didn't match the actual pod naming pattern used by the Compliance Operator. Old approach: - Checked for file: /kubernetes-api-resources/.../pods/api-checks-pod - Looked for --platform=HyperShift flag in pod command - Failed because actual pod name is <scan-name>-api-checks-pod New approach: - Checks infrastructure.config.openshift.io/cluster object - Looks for .status.controlPlaneTopology == "External" - More reliable and independent of pod naming This fix ensures that rules with "platform: not ocp4-on-hypershift-hosted" are properly skipped on HyperShift Hosted Clusters, where control plane components run externally in the management cluster. Impact: - API server, etcd, and other control plane checks will now correctly skip on HyperShift Hosted Clusters - Fixes false failures like master_taint_noschedule on hosted clusters Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
taimurhafeez
approved these changes
Sep 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
This PR fixes the
ocp4-on-hypershift-hostedCPE, which never fired. Theobject_hypershift_hostedOVAL object matched^--platform=HyperShift$under.spec.containers[:].command[:]of a hardcoded pod dump(
/kubernetes-api-resources/api/v1/namespaces/openshift-compliance/pods/api-checks-pod).That path was wrong: the Compliance Operator names the pod
<scan-name>-api-checks-pod,and it places the
--platform=HyperShiftflag on theapi-resource-collectorinitContainer, not on a regular container. As a result the CPE was structurally
unreachable and never matched.
Instead of chasing the pod manifest, this PR detects HyperShift Hosted Clusters
from the
infrastructure.config.openshift.io/clusterobject, checking.status.controlPlaneTopology == "External". This is the canonical signal for acluster whose control plane runs externally in the management cluster, and it is
independent of Compliance Operator pod naming.
Changes to
shared/applicability/oval/installed_app_is_ocp4.xml:object_hypershift_hostedatocp4_infra_dump_locationwith yamlpath.status.controlPlaneTopology, matching^External$.test_file_for_ocp4_infracriterion to theocp4-on-hypershift-hosteddefinition so it only evaluates when the infrastructure/cluster file is present.
ocp4_operator_deployment_dump_locationvariable.Rationale:
Every rule gated
platform: not ocp4-on-hypershift-hosted(46 in ocp4-cis,54 in ocp4-high, 4 in ocp4-stig) was executing inside hosted clusters against
control-plane namespaces that do not exist there (openshift-kube-apiserver,
openshift-etcd, ...), producing false FAILs (e.g.
master_taint_noschedule).With this fix those rules are correctly reported as NOT-APPLICABLE on HyperShift
Hosted Clusters.
Jira: https://issues.redhat.com/browse/CMP-4521
Review Hints:
To confirm the detection signal on a cluster:
External-> HyperShift Hosted Cluster (control plane external)HighlyAvailable/SingleReplica-> traditional OCP (control plane local)