Add OpenShift Route security check

[sthadka]

Summary

• Add insecure-route-termination check for OpenShift Routes with InsecureEdgeTerminationPolicy: Allow
• Uses existing cel-expression template with objectKinds: [Any] and a kind guard for Route objects
• No Go code changes — pure YAML check definition

New Check

Check	Severity	What it detects
insecure-route-termination	Medium	OpenShift Routes permitting plaintext HTTP via InsecureEdgeTerminationPolicy: Allow

Notes

• The check uses objectKinds: [Any] with a object.kind == 'Route' guard since Route is an OpenShift-specific CRD
• The kind guard short-circuits evaluation for non-Route objects, so there is no performance impact on non-OpenShift clusters

Test plan

• Test manifest includes Routes with Redirect (pass), None (pass), Allow (fail), and a non-Route Service (pass)
• Uses existing cel-expression template — no new dependencies

---

Note: This PR was created with AI assistance using Claude Code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: bc1575b4-9349-46de-b952-28c74dcf0098

📥 Commits

Reviewing files that changed from the base of the PR and between 40d93ed and cbeef3a.

📒 Files selected for processing (1)

• e2etests/bats-tests.sh

🚧 Files skipped from review as they are similar to previous changes (1)

• e2etests/bats-tests.sh

---

📝 Walkthrough

Summary by CodeRabbit

• New Features
  • Added a new built-in Kubernetes/OpenShift check for Route resources with insecure TLS edge termination policy set to Allow, with guidance to remediate by using a secure policy (e.g., Redirect or None).
• Tests
  • Added a YAML test manifest including both matching and non-matching Route examples.
  • Added an end-to-end test to confirm the linter reports exactly one finding when the check should trigger.

Walkthrough

Adds a built-in YAML check for OpenShift Routes that flags spec.tls.insecureEdgeTerminationPolicy: Allow, along with YAML test cases and a Bats test for matching and non-matching Route objects and a non-Route control case.

Changes

Insecure route termination

Layer / File(s)	Summary
Check definition pkg/builtinchecks/yamls/insecure-route-termination.yaml	Defines the insecure-route-termination built-in check with metadata, remediation, and CEL matching for Route objects whose insecure edge termination policy is Allow.
Test fixture and e2e check tests/checks/insecure-route-termination.yml, e2etests/bats-tests.sh	Adds Route cases for Redirect, None, and Allow, plus a Service control case, and adds a Bats test that runs the new check and asserts one JSON report.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	It clearly summarizes the main change: adding a security check for OpenShift Routes.
Description check	✅ Passed	It directly describes the added Route check, its implementation, and test coverage.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch security/openshift-route-checks

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/checks/insecure-route-termination.yml`:
- Around line 1-45: Add the missing Bats coverage for the insecure route
termination check so the new fixture is exercised by the harness. Update
e2etests/bats-tests.sh with a case for
tests/checks/insecure-route-termination.yml, using the same pattern as the other
check tests. Make the assertion target the fire-allow-insecure Route and verify
the expected diagnostic for insecureEdgeTerminationPolicy set to Allow, while
keeping the Redirect/None and non-Route resources as non-failing cases.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 177f5147-3046-47b9-8672-cb10c7e73836

📥 Commits

Reviewing files that changed from the base of the PR and between eab6d87 and 49a39cd.

📒 Files selected for processing (2)

• pkg/builtinchecks/yamls/insecure-route-termination.yaml
• tests/checks/insecure-route-termination.yml