From 2b05f1373908521b7ecd16a64b21c1d8f6ea0c7f Mon Sep 17 00:00:00 2001
From: Watson Yuuma Sato <wsato@redhat.com>
Date: Mon, 6 Jul 2026 14:58:27 +0200
Subject: [PATCH] Fix HyperShift Hosted Cluster detection using
 controlPlaneTopology

The previous OVAL check for detecting HyperShift Hosted Clusters was
unreliable because it looked for a hardcoded pod name that didn't match
the actual pod naming pattern used by the Compliance Operator.

Old approach:
- Checked for file: /kubernetes-api-resources/.../pods/api-checks-pod
- Looked for --platform=HyperShift flag in pod command
- Failed because actual pod name is <scan-name>-api-checks-pod

New approach:
- Checks infrastructure.config.openshift.io/cluster object
- Looks for .status.controlPlaneTopology == "External"
- More reliable and independent of pod naming

This fix ensures that rules with "platform: not ocp4-on-hypershift-hosted"
are properly skipped on HyperShift Hosted Clusters, where control plane
components run externally in the management cluster.

Impact:
- API server, etcd, and other control plane checks will now correctly
  skip on HyperShift Hosted Clusters
- Fixes false failures like master_taint_noschedule on hosted clusters

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
---
 .../applicability/oval/installed_app_is_ocp4.xml  | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/shared/applicability/oval/installed_app_is_ocp4.xml b/shared/applicability/oval/installed_app_is_ocp4.xml
index 19a6245b8427..e40e86906d39 100644
--- a/shared/applicability/oval/installed_app_is_ocp4.xml
+++ b/shared/applicability/oval/installed_app_is_ocp4.xml
@@ -29,10 +29,6 @@
       <literal_component>/kubernetes-api-resources/hypershift/version</literal_component>
   </local_variable>
 
-  <local_variable id="ocp4_operator_deployment_dump_location" datatype="string" comment="The actual filepath of the file to scan." version="1">
-      <literal_component>/kubernetes-api-resources/api/v1/namespaces/openshift-compliance/pods/api-checks-pod</literal_component>
-  </local_variable>
-
   <unix:file_test id="test_file_for_ocp4" check="only one" comment="Find the actual file to be scanned." version="1">
       <unix:object object_ref="object_file_for_ocp4"/>
   </unix:file_test>
@@ -91,13 +87,13 @@
 
 
   <ind:yamlfilecontent_object id="object_hypershift_hosted" version="1">
-      <ind:filepath var_ref="ocp4_operator_deployment_dump_location"/>
-      <ind:yamlpath>.spec.containers[:].command[:]</ind:yamlpath>
+      <ind:filepath var_ref="ocp4_infra_dump_location"/>
+      <ind:yamlpath>.status.controlPlaneTopology</ind:yamlpath>
   </ind:yamlfilecontent_object>
 
   <ind:yamlfilecontent_state id="state_hypershift_hosted" version="1">
-      <ind:value datatype="record" entity_check="at least one">
-          <field name="#" datatype="string" operation="pattern match" entity_check="at least one">^--platform=HyperShift$</field>
+      <ind:value datatype="record">
+          <field name="#" datatype="string" operation="pattern match">^External$</field>
       </ind:value>
   </ind:yamlfilecontent_state>
 
@@ -270,7 +266,8 @@
       <description>The application installed on the system is OpenShift 4 on HyperShift Hosted Cluster.</description>
     </metadata>
     <criteria operator="AND">
-      <criterion comment="Make sure there is HyperShift in the Compliance Operator Command flag" test_ref="test_hypershift_hosted"/>
+      <criterion comment="Make sure controlPlaneTopology is External (HyperShift Hosted Cluster)" test_ref="test_hypershift_hosted"/>
+      <criterion comment="Make sure OCP4 infrastructure/cluster file is present" test_ref="test_file_for_ocp4_infra"/>
     </criteria>
   </definition>