OpenShift Virtualization Security Labs Overview
Overview
These labs walk the Red Hat OpenShift Virtualization hardening guide (December 2025) on a cluster that already has OpenShift Virtualization installed. You audit every control, compare it to the secure default, and record what you would change to reach a hardened baseline.
This is a product deep-dive, not a 101/201/301 skill level. Harden the OpenShift platform first (101-10, 201-07). Guest operating system CIS/STIG work inside the VM is out of scope.
Kata sandboxed pods are 201-09; this pathway is full virtual machines on the kubevirt-hyperconverged stack.
Audience and prerequisites:
-
OpenShift cluster with OpenShift Virtualization (CNV) in
openshift-cnv -
Cluster-admin (or equivalent) for HyperConverged, RBAC
who-can, and node debug -
A running VM to inspect: this environment uses
rhel-webserverin projectrhel-webserver -
Credentials and console links are on the home page
Modules are sequential. Later labs reuse the HyperConverged object, VM, and any NetworkAttachmentDefinitions you already inspected. Cleanup records progress only; it does not delete those objects.
Virtualization labs index
| Lab | Title |
|---|---|
Scope and HyperConverged |
|
Feature Gates and Trusted Config |
|
Host Devices, KSM, and File Permissions |
|
Migration, Exec, VNC, and Shared Types |
|
Per-VM Devices and Memory Overcommit |
|
DataVolume Cloning and Disk Isolation |
|
VLAN, MAC Spoof, and MultiNetworkPolicy |
|
Host Firmware and Kernel |
The guide uses CIS-style Level 1 / Level 2 labels. It is not an official CIS benchmark yet. Level 2 controls in this pathway are Kernel Samepage Merging, dedicated VLANs, and MultiNetworkPolicy.