stackrox · JoukoVirtanen · Oct 1, 2025 · Oct 1, 2025 · Aug 19, 2025 · Aug 19, 2025
diff --git a/central/detection/lifecycle/manager_impl.go b/central/detection/lifecycle/manager_impl.go
@@ -230,7 +230,11 @@ func (m *managerImpl) isAutoLockEnabledForCluster(clusterId string) bool {
 		return false
 	}
 
-	return cluster.GetDynamicConfig().GetAutoLockProcessBaselinesConfig().GetEnabled()
+	if cluster.GetManagedBy() == storage.ManagerType_MANAGER_TYPE_MANUAL {
+		return cluster.GetDynamicConfig().GetAutoLockProcessBaselinesConfig().GetEnabled()
+	}
+
+	return cluster.GetHelmConfig().GetDynamicConfig().GetAutoLockProcessBaselinesConfig().GetEnabled()
 }
 
 func (m *managerImpl) flushIndicatorQueue() {

diff --git a/central/detection/lifecycle/manager_impl_test.go b/central/detection/lifecycle/manager_impl_test.go
@@ -27,19 +27,32 @@ import (
 
 var (
 	clusterAutolockEnabled = &storage.Cluster{
-		ManagedBy: storage.ManagerType_MANAGER_TYPE_MANUAL,
-		DynamicConfig: &storage.DynamicClusterConfig{
-			AutoLockProcessBaselinesConfig: &storage.AutoLockProcessBaselinesConfig{
-				Enabled: true,
+		ManagedBy: storage.ManagerType_MANAGER_TYPE_HELM_CHART,
+		HelmConfig: &storage.CompleteClusterConfig{
+			DynamicConfig: &storage.DynamicClusterConfig{
+				AutoLockProcessBaselinesConfig: &storage.AutoLockProcessBaselinesConfig{
+					Enabled: true,
+				},
 			},
 		},
 	}
 
 	clusterAutolockDisabled = &storage.Cluster{
+		ManagedBy: storage.ManagerType_MANAGER_TYPE_HELM_CHART,
+		HelmConfig: &storage.CompleteClusterConfig{
+			DynamicConfig: &storage.DynamicClusterConfig{
+				AutoLockProcessBaselinesConfig: &storage.AutoLockProcessBaselinesConfig{
+					Enabled: false,
+				},
+			},
+		},
+	}
+
+	clusterAutolockManualEnabled = &storage.Cluster{
 		ManagedBy: storage.ManagerType_MANAGER_TYPE_MANUAL,
 		DynamicConfig: &storage.DynamicClusterConfig{
 			AutoLockProcessBaselinesConfig: &storage.AutoLockProcessBaselinesConfig{
-				Enabled: false,
+				Enabled: true,
 			},
 		},
 	}
@@ -269,6 +282,15 @@ func (suite *ManagerTestSuite) TestAutoLockProcessBaselinesDisabled() {
 	suite.False(enabled)
 }
 
+func (suite *ManagerTestSuite) TestAutoLockProcessBaselinesManual() {
+	clusterId := fixtureconsts.Cluster1
+
+	suite.T().Setenv(features.AutoLockProcessBaselines.EnvVar(), "true")
+	suite.cluster.EXPECT().GetCluster(gomock.Any(), clusterId).Return(clusterAutolockManualEnabled, true, nil)
+	enabled := suite.manager.isAutoLockEnabledForCluster(clusterId)
+	suite.True(enabled)
+}
+
 func (suite *ManagerTestSuite) TestAutoLockProcessBaselinesNoCluster() {
 	clusterId := fixtureconsts.Cluster1
 

diff --git a/deploy/common/k8sbased.sh b/deploy/common/k8sbased.sh
@@ -651,6 +651,10 @@ function launch_sensor {
     	extra_helm_config+=(--set "admissionControl.listenOnEvents=${bool_val}")
     fi
 
+    if [[ "${SECURED_CLUSTER_AUTO_LOCK_PROCESS_BASELINES:-}" == "true" ]]; then
+        extra_helm_config+=(--set "autoLockProcessBaselines.enabled=true")
+    fi
+
     if [[ -n "$ROXCTL_TIMEOUT" ]]; then
       echo "Extending roxctl timeout to $ROXCTL_TIMEOUT"
       extra_config+=("--timeout=$ROXCTL_TIMEOUT")

@@ -29,5 +29,9 @@ clusterConfig:
       disableBypass: {{ ._rox.admissionControl.dynamic.disableBypass }}
       enforceOnUpdates: {{ ._rox.admissionControl.dynamic.enforceOnUpdates }}
     registryOverride: {{ ._rox.registryOverride }}
+    [<- if .FeatureFlags.ROX_AUTO_LOCK_PROCESS_BASELINES >]
+    autoLockProcessBaselinesConfig:
+      enabled: {{ ._rox.autoLockProcessBaselines.enabled }}
+    [<- end >]
   configFingerprint: {{ ._rox._configFP }}
   clusterLabels: {{- toYaml ._rox.clusterLabels | nindent 4 }}
@@ -144,6 +144,8 @@ collector:
     enabled: null # bool
 auditLogs:
   disableCollection: null # bool
+autoLockProcessBaselines:
+  enabled: null # bool
 customize:
   labels: {} # dict
   annotations: {} # dict

@@ -118,6 +118,11 @@ collector:
 auditLogs:
   disableCollection: {{ ne ._rox.env.openshift 4 }}
 
+[<- if .FeatureFlags.ROX_AUTO_LOCK_PROCESS_BASELINES >]
+autoLockProcessBaselines:
+  enabled: false
+[<- end >]
+
 network:
   enableNetworkPolicies: true
 

@@ -130,7 +130,7 @@ var (
 	LLMRiskRecommendation = registerFeature("Intgrate with LLM for risk recommendations", "ROX_LLM_RISK_RECOMMENDATION")
 
 	// Locks process baselines when their deployments leave the observation period
-	AutoLockProcessBaselines = registerFeature("Locks process baselines when their deployments leave the observation period", "ROX_AUTOLOCK_PROCESS_BASELINES")
+	AutoLockProcessBaselines = registerFeature("Locks process baselines when their deployments leave the observation period", "ROX_AUTO_LOCK_PROCESS_BASELINES")
 )
 
 // The following feature flags are related to Scanner V4.

@@ -33,6 +33,18 @@ func TestWithDifferentFeatureFlags(t *testing.T) {
 			},
 			flavor: defaults.RHACSReleaseImageFlavor(),
 		},
+		"auto-lock-process-baselines": {
+			featureFlags: map[string]bool{
+				"ROX_AUTO_LOCK_PROCESS_BASELINES": true,
+			},
+			flavor: defaults.RHACSReleaseImageFlavor(),
+		},
+		"auto-lock-process-baselines-disabled": {
+			featureFlags: map[string]bool{
+				"ROX_AUTO_LOCK_PROCESS_BASELINES": false,
+			},
+			flavor: defaults.RHACSReleaseImageFlavor(),
+		},
 	}
 
 	for testCaseName, testCaseSpec := range testCases {

@@ -0,0 +1,16 @@
+values:
+  imagePullSecrets:
+    allowNone: true
+tests:
+  - name: "Process baseline auto-locking should not exist since the feature flag is disabled even if it is enabled in the secured cluster"
+    values:
+      autoLockProcessBaselines:
+        enabled: true
+    expect: |
+      .secrets["helm-cluster-config"].stringData["config.yaml"] | fromyaml | .clusterConfig.dynamicConfig.autoLockProcessBaselinesConfig.enabled | assertThat(. == null)
+  - name: "Process baseline auto-locking should not exist"
+    values:
+      autoLockProcessBaelines:
+        enabled: false
+    expect: |
+      .secrets["helm-cluster-config"].stringData["config.yaml"] | fromyaml | .clusterConfig.dynamicConfig.autoLockProcessBaselinesConfig.enabled | assertThat(. == null)
@@ -0,0 +1,16 @@
+values:
+  imagePullSecrets:
+    allowNone: true
+tests:
+  - name: "Process baseline auto-locking should be enabled"
+    values:
+      autoLockProcessBaselines:
+        enabled: true
+    expect: |
+      .secrets["helm-cluster-config"].stringData["config.yaml"] | fromyaml | .clusterConfig.dynamicConfig.autoLockProcessBaselinesConfig.enabled | assertThat(. == true)
+  - name: "Process baseline auto-locking should be disabled"
+    values:
+      autoLockProcessBaelines:
+        enabled: false
+    expect: |
+      .secrets["helm-cluster-config"].stringData["config.yaml"] | fromyaml | .clusterConfig.dynamicConfig.autoLockProcessBaselinesConfig.enabled | assertThat(. == false)
@@ -38,7 +38,7 @@ function DynamicConfigurationForm({
 }: DynamicConfigurationFormProps) {
     const { isFeatureFlagEnabled } = useFeatureFlags();
     const isAutoLockProcessBaselinesEnabled = isFeatureFlagEnabled(
-        'ROX_AUTOLOCK_PROCESS_BASELINES'
+        'ROX_AUTO_LOCK_PROCESS_BASELINES'
     );
     const { version } = useMetadata();
 

@@ -4,7 +4,7 @@
 export type FeatureFlagEnvVar =
     | 'ROX_ACTIVE_VULN_MGMT'
     | 'ROX_ADMISSION_CONTROLLER_CONFIG'
-    | 'ROX_AUTOLOCK_PROCESS_BASELINES'
+    | 'ROX_AUTO_LOCK_PROCESS_BASELINES'
     | 'ROX_CLUSTERS_PAGE_MIGRATION_UI'
     | 'ROX_CUSTOMIZABLE_PLATFORM_COMPONENTS'
     | 'ROX_EXTERNAL_IPS'