Skip to content

Commit 2a5901e

Browse files
sheriff-rhsheriff-rh
authored
Merge pull request #61958 from sheriff-rh/CMP-2030
2 parents 3d92b72 + e7b168f commit 2a5901e

File tree

3 files changed

+167
-0
lines changed

3 files changed

+167
-0
lines changed

‎modules/compliance-operator-hcp-install.adoc

Lines changed: 109 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/compliance_operator/compliance-operator-installation.adoc
4+
5+
:_content-type: PROCEDURE
6+
[id="installing-compliance-operator-hcp_{context}"]
7+
= Installing the Compliance Operator on Hosted control planes
8+
9+
The Compliance Operator can be installed in Hosted control planes using the OperatorHub by creating a `Subscription` file.
10+
11+
:FeatureName: Hosted control planes
12+
include::snippets/technology-preview.adoc[]
13+
14+
.Prerequisites
15+
16+
* You must have `admin` privileges.
17+
18+
.Procedure
19+
20+
. Define a `Namespace` object similar to the following:
21+
+
22+
.Example `namespace-object.yaml`
23+
[source,yaml]
24+
----
25+
apiVersion: v1
26+
kind: Namespace
27+
metadata:
28+
labels:
29+
openshift.io/cluster-monitoring: "true"
30+
pod-security.kubernetes.io/enforce: privileged <1>
31+
name: openshift-compliance
32+
----
33+
<1> In {product-title} {product-version}, the pod security label must be set to `privileged` at the namespace level.
34+
35+
. Create the `Namespace` object by running the following command:
36+
+
37+
[source,terminal]
38+
----
39+
$ oc create -f namespace-object.yaml
40+
----
41+
42+
. Define an `OperatorGroup` object:
43+
+
44+
.Example `operator-group-object.yaml`
45+
[source,yaml]
46+
----
47+
apiVersion: operators.coreos.com/v1
48+
kind: OperatorGroup
49+
metadata:
50+
name: compliance-operator
51+
namespace: openshift-compliance
52+
spec:
53+
targetNamespaces:
54+
- openshift-compliance
55+
----
56+
57+
. Create the `OperatorGroup` object by running the following command:
58+
+
59+
[source,terminal]
60+
----
61+
$ oc create -f operator-group-object.yaml
62+
----
63+
64+
. Define a `Subscription` object:
65+
+
66+
.Example `subscription-object.yaml`
67+
[source,yaml]
68+
----
69+
apiVersion: operators.coreos.com/v1alpha1
70+
kind: Subscription
71+
metadata:
72+
name: compliance-operator-sub
73+
namespace: openshift-compliance
74+
spec:
75+
channel: "stable"
76+
installPlanApproval: Automatic
77+
name: compliance-operator
78+
source: redhat-operators
79+
sourceNamespace: openshift-marketplace
80+
config:
81+
nodeSelector:
82+
node-role.kubernetes.io/worker: ""
83+
env:
84+
- name: PLATFORM
85+
value: "HyperShift"
86+
----
87+
88+
. Create the `Subscription` object by running the following command:
89+
+
90+
[source,terminal]
91+
----
92+
$ oc create -f subscription-object.yaml
93+
----
94+
95+
.Verification
96+
97+
. Verify the installation succeeded by inspecting the CSV file by running the following command:
98+
+
99+
[source,terminal]
100+
----
101+
$ oc get csv -n openshift-compliance
102+
----
103+
104+
. Verify that the Compliance Operator is up and running by running the following command:
105+
+
106+
[source,terminal]
107+
----
108+
$ oc get deploy -n openshift-compliance
109+
----

‎security/compliance_operator/compliance-operator-installation.adoc

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,18 @@ If the `restricted` Security Context Constraints (SCC) have been modified to con
3131
You can create a custom SCC for the Compliance Operator scanner pod service account. For more information, see xref:../../security/compliance_operator/compliance-operator-advanced.adoc#compliance-custom-scc_compliance-advanced[Creating a custom SCC for the Compliance Operator].
3232
====
3333

34+
// only applies to 4.11+
35+
include::modules/compliance-operator-hcp-install.adoc[leveloffset=+1]
36+
37+
[role="_additional-resources"]
38+
.Additional resources
39+
40+
// 4.13+
41+
* xref:../../hosted_control_planes/index.adoc#hcp-overview[Hosted control planes overview]
42+
//
43+
// 4.11-4.12, commenting out of 4.13-main
44+
//* xref:../../architecture/control-plane.adoc#hosted-control-planes-overview_control-plane[Overview of hosted control planes (Technology Preview)]
45+
3446
[id="additional-resources-installing-the-compliance-operator"]
3547
[role="_additional-resources"]
3648
== Additional resources

‎security/compliance_operator/compliance-operator-release-notes.adoc

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,52 @@ For an overview of the Compliance Operator, see xref:../../security/compliance_o
1515

1616
To access the latest release, see xref:../../security/compliance_operator/compliance-operator-updating.adoc#olm-preparing-upgrade_compliance-operator-updating[Updating the Compliance Operator].
1717

18+
[id="compliance-operator-release-notes-1-1-0"]
19+
== OpenShift Compliance Operator 1.1.0
20+
21+
The following advisory is available for the OpenShift Compliance Operator 1.1.0:
22+
23+
* link:https://access.redhat.com/errata/RHBA-2023:3630[RHBA-2023:3630 - OpenShift Compliance Operator bug fix and enhancement update]
24+
25+
[id="compliance-operator-1-1-0-new-features-and-enhancements"]
26+
=== New features and enhancements
27+
28+
* A start and end timestamp is now available in the `ComplianceScan` custom resource definition (CRD) status.
29+
30+
* The Compliance Operator can now be deployed on Hosted Control Planes using the OperatorHub by creating a `Subscription` file. For more information, see xref:../../security/compliance_operator/compliance-operator-installation.html#installing-compliance-operator-hcp_compliance-operator-installation[Installing the Compliance Operator on Hosted Control Planes].
31+
32+
[id="compliance-operator-1-1-0-bug-fixes"]
33+
=== Bug fixes
34+
35+
* Before this update, some Compliance Operator rule instructions were not present. After this update, instructions are improved for the following rules:
36+
+
37+
** `classification_banner`
38+
** `oauth_login_template_set`
39+
** `oauth_logout_url_set`
40+
** `oauth_provider_selection_set`
41+
** `ocp_allowed_registries`
42+
** `ocp_allowed_registries_for_import`
43+
+
44+
(link:https://issues.redhat.com/browse/OCPBUGS-10473[*OCPBUGS-10473*])
45+
46+
* Before this update, check accuracy and rule instructions were unclear. After this update, the check accuracy and instructions are improved for the following `sysctl` rules:
47+
+
48+
** `kubelet-enable-protect-kernel-sysctl`
49+
** `kubelet-enable-protect-kernel-sysctl-kernel-keys-root-maxbytes`
50+
** `kubelet-enable-protect-kernel-sysctl-kernel-keys-root-maxkeys`
51+
** `kubelet-enable-protect-kernel-sysctl-kernel-panic`
52+
** `kubelet-enable-protect-kernel-sysctl-kernel-panic-on-oops`
53+
** `kubelet-enable-protect-kernel-sysctl-vm-overcommit-memory`
54+
** `kubelet-enable-protect-kernel-sysctl-vm-panic-on-oom`
55+
+
56+
(link:https://issues.redhat.com/browse/OCPBUGS-11334[*OCPBUGS-11334*])
57+
58+
* Before this update, the `ocp4-alert-receiver-configured` rule did not include instructions. With this update, the `ocp4-alert-receiver-configured` rule now includes improved instructions. (link:https://issues.redhat.com/browse/OCPBUGS-7307[*OCPBUGS-7307*])
59+
60+
* Before this update, the `rhcos4-sshd-set-loglevel-info` rule would fail for the `rhcos4-e8` profile. With this update, the remediation for the `sshd-set-loglevel-info` rule was updated to apply the correct configuration changes, allowing subsequent scans to pass after the remediation is applied. (link:https://issues.redhat.com/browse/OCPBUGS-7816[*OCPBUGS-7816*])
61+
62+
* Before this update, a new installation of {product-title} with the latest Compliance Operator install failed on the `scheduler-no-bind-address` rule. With this update, the `scheduler-no-bind-address` rule has been disabled on newer versions of {product-title} since the parameter was removed. (link:https://issues.redhat.com/browse/OCPBUGS-8347[*OCPBUGS-8347*])
63+
1864
[id="compliance-operator-release-notes-1-0-0"]
1965
== OpenShift Compliance Operator 1.0.0
2066

0 commit comments

Comments
 (0)