Skip to content

Commit 5f7f6be

Browse files
lpettyjolpettyjo
authored
Merge pull request #39324 from kmccarron-rh/profiles
OSDOCS-2975: Add supported profiles table
2 parents d0a9477 + 03c9917 commit 5f7f6be

File tree

4 files changed

+83
-7
lines changed

4 files changed

+83
-7
lines changed

‎_topic_maps/_topic_map.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -727,6 +727,8 @@ Topics:
727727
Topics:
728728
- Name: Compliance Operator release notes
729729
File: compliance-operator-release-notes
730+
- Name: Supported compliance profiles
731+
File: compliance-operator-supported-profiles
730732
- Name: Installing the Compliance Operator
731733
File: compliance-operator-installation
732734
- Name: Compliance Operator scans

‎modules/compliance-supported-profiles.adoc

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
// Module included in the following assemblies:
2+
//
3+
// * security/compliance_operator/
4+
5+
[id="compliance-supported-profiles_{context}"]
6+
= Compliance profiles
7+
8+
The Compliance Operator provides the following compliance profiles:
9+
10+
.Supported compliance profiles
11+
[cols="40%,50%,10%", options="header"]
12+
13+
|===
14+
|Profile name
15+
|Profile title
16+
|Compliance Operator version
17+
18+
|ocp4-cis
19+
|link:https://www.cisecurity.org/cis-benchmarks/[CIS Red Hat OpenShift Container Platform 4 Benchmark]
20+
|0.1.39+
21+
22+
|ocp4-cis-node
23+
|link:https://www.cisecurity.org/cis-benchmarks/[CIS Red Hat OpenShift Container Platform 4 Benchmark]
24+
|0.1.39+
25+
26+
|ocp4-e8
27+
|link:https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers[Australian Cyber Security Centre (ACSC) Essential Eight]
28+
|0.1.39+
29+
30+
|ocp4-moderate
31+
|link:https://nvd.nist.gov/800-53/Rev4/impact/moderate[NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Platform level]
32+
|0.1.39+
33+
34+
|ocp4-moderate-node
35+
|link:https://nvd.nist.gov/800-53/Rev4/impact/moderate[NIST 800-53 Moderate-Impact Baseline for Red Hat OpenShift - Node level]
36+
|0.1.44+
37+
38+
|ocp4-nerc-cip
39+
|link:https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx[North American Electric Reliability Corporation (NERC)]
40+
|0.1.44+
41+
42+
|ocp4-nerc-cip-node
43+
|link:https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx[North American Electric Reliability Corporation (NERC)]
44+
|0.1.44+
45+
46+
|rhcos4-e8
47+
|link:https://www.cyber.gov.au/acsc/view-all-content/publications/hardening-linux-workstations-and-servers[Australian Cyber Security Centre (ACSC) Essential Eight]
48+
|0.1.39+
49+
50+
|rhcos4-moderate
51+
|link:https://nvd.nist.gov/800-53/Rev4/impact/moderate[NIST 800-53 Moderate-Impact Baseline for Red Hat Enterprise Linux CoreOS]
52+
|0.1.39+
53+
54+
|rhcos4-nerc-cip
55+
|link:https://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx[North American Electric Reliability Corporation (NERC)]
56+
|0.1.44+
57+
58+
|===
59+

‎security/compliance_operator/compliance-operator-release-notes.adoc

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,6 @@ These release notes track the development of the Compliance Operator in the {pro
1212

1313
For an overview of the Compliance Operator, see xref:../../security/compliance_operator/compliance-operator-understanding.adoc#understanding-compliance-operator[Understanding the Compliance Operator].
1414

15-
[id="compliance-operator-inclusive-language"]
16-
== Making open source more inclusive
17-
18-
Red Hat is committed to replacing problematic language in our code, documentation, and web properties. We are beginning with these four terms: master, slave, blacklist, and whitelist. Because of the enormity of this endeavor, these changes will be implemented gradually over several upcoming releases. For more details, see link:https://www.redhat.com/en/blog/making-open-source-more-inclusive-eradicating-problematic-language[Red Hat CTO Chris Wright's message].
19-
2015
[id="compliance-operator-release-notes-0-1-44"]
2116
== OpenShift Compliance Operator 0.1.44
2217

@@ -40,13 +35,20 @@ The following advisory is available for the OpenShift Compliance Operator 0.1.44
4035
* This enhancement removes the requirement that you have to extend an existing profile in order to create a tailored profile. This means the `extends` field in the `TailoredProfile` CRD is no longer mandatory. You can now select a list of rule objects to create a tailored profile. Note that you must select whether your profile applies to nodes or the platform by setting the `compliance.openshift.io/product-type:` annotation or by setting the `-node` suffix for the `TailoredProfile` CR.
4136
+
4237
* In this release, the Compliance Operator is now able to schedule scans on all nodes irrespective of their taints. Previously, the scan pods would only tolerated the `node-role.kubernetes.io/master taint`, meaning that they would either ran on nodes with no taints or only on nodes with the `node-role.kubernetes.io/master` taint. In deployments that use custom taints for their nodes, this resulted in the scans not being scheduled on those nodes. Now, the scan pods tolerate all node taints.
38+
+
39+
* In this release, the Compliance Operator supports the following North American Electric Reliability Corporation (NERC) security profiles:
40+
+
41+
** ocp4-nerc-cip
42+
** ocp4-nerc-cip-node
43+
** rhcos4-nerc-cip
44+
+
45+
* In this release, the Compliance Operator supports the NIST 800-53 Moderate-Impact Baseline for the Red Hat OpenShift - Node level, ocp4-moderate-node, security profile.
4346

4447
=== Templating and variable use
4548

4649
* In this release, the remediation template now allows multi-value variables.
4750
+
48-
* With this update, the Compliance Operator can change remediations based on variables that are set in the compliance profile. This is useful for remediations that include deployment-specific values such as time outs, NTP server host names, or similar. Additionally, the `ComplianceCheckResult` objects now use the label `compliance.openshift.io/check-has-value` that lists the variables a check can use.
49-
51+
* With this update, the Compliance Operator can change remediations based on variables that are set in the compliance profile. This is useful for remediations that include deployment-specific values such as time outs, NTP server host names, or similar. Additionally, the `ComplianceCheckResult` objects now use the label `compliance.openshift.io/check-has-value` that lists the variables a check has used.
5052

5153
[id="openshift-compliance-operator-0-1-44-bug-fixes"]
5254
=== Bug fixes

‎security/compliance_operator/compliance-operator-supported-profiles.adoc

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
[id="compliance-operator-supported-profiles"]
2+
= Supported compliance profiles
3+
include::modules/common-attributes.adoc[]
4+
:context: compliance-operator-supported-profiles
5+
6+
There are several profiles available as part of the Compliance Operator (CO) installation.
7+
8+
include::modules/compliance-supported-profiles.adoc[leveloffset=+1]
9+
10+
[id="additional-resources-compliance-operator-"]
11+
== Additional resources
12+
13+
* For more information about viewing the compliance profiles available in your system, see xref:../../security/compliance_operator/compliance-operator-understanding.adoc#compliance_profiles_understanding-compliance[Compliance Operator profiles] in Understanding the Compliance Operator.

0 commit comments

Comments
 (0)