Red Hat Summit Red Hat SummitSupportConsoleDevelopersStart a trialContact

Chapter 3. Using the Compliance Operator

You can configure RHACS to use the Compliance Operator for compliance reporting and remediation with OpenShift Container Platform clusters. Results from the Compliance Operator are reported in the RHACS Compliance Dashboard.

The Compliance Operator automates the review of numerous technical implementations and compares them with certain aspects of industry standards, benchmarks, and baselines.

The Compliance Operator is not an auditor. To comply or certify to these various standards, you must engage an authorized auditor such as a Qualified Security Assessor (QSA), Joint Authorization Board (JAB), or other industry-recognized regulatory authority to assess your environment.

The Compliance Operator makes recommendations based on generally available information and practices that relate to such standards and can assist with remediation, but actual compliance is your responsibility. You are required to work with an authorized auditor to achieve compliance with a standard.

For the latest updates, see the Compliance Operator release notes.

3.1.1. Installing the Compliance Operator
Copy link

Install the Compliance Operator using Operator Hub.

Procedure

Install the Operator by performing the following steps:

  1. Navigate in the web console to the Operators OperatorHub page.
  2. Enter compliance operator into the Filter by keyword box to find the Compliance Operator.
  3. Select the Compliance Operator to view the details page.
  4. Read the information about the Operator, and then click Install.

3.1.2. Configuring the ScanSettingBinding object
Copy link

Create a ScanSettingBinding object in the openshift-compliance namespace to scan the cluster by using the cis and cis-node profiles.

Note

This example uses cis and cis-node profiles, but OpenShift Container Platform provides additional profiles. See "Understanding the Compliance Operator" in the "Additional resources" section for more information.

Procedure

Select one of the following options:

  • Use the CLI to create the YAML file and object. For example:

    1. Create a file called sscan.yaml using the following text: 

      apiVersion: compliance.openshift.io/v1alpha1
kind: ScanSettingBinding
metadata:
  name: cis-compliance
profiles:
  - name: ocp4-cis-node
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
  - name: ocp4-cis
    kind: Profile
    apiGroup: compliance.openshift.io/v1alpha1
settingsRef:
  name: default
  kind: ScanSetting
  apiGroup: compliance.openshift.io/v1alpha1

    2. Create the ScanSettingBinding object by running the following command: 

      $ oc create -f sscan.yaml -n openshift-compliance

      If successful, the following message is displayed: 

      $ scansettingbinding.compliance.openshift.io/cis-compliance created

  • Use the web console to create the object by performing the following steps:

    1. Change the active project to openshift-compliance.
    2. Click + to open the Import YAML page.
    3. Paste the YAML from the previous example and then click Create.

Additional resources

Optional: If you installed the Compliance Operator after installing RHACS, restart Sensor in the secured cluster by performing one of the following options:

  • Run the following command: 

    $ oc -n stackrox delete pod -lapp=sensor

  • In the OpenShift Container Platform web console, perform the following steps:

    1. Change the active project to stackrox.
    2. Navigate to Workloads Pods.
    3. Locate the pod with the name starting with sensor-, and then click Actions Delete Pod.

Verification

After performing these steps, run a compliance scan in RHACS and ensure that ocp4-cis and ocp4-cis-node results are displayed. See "Running a compliance scan" in the "Additional resources" section for more information.

Additional resources

Red Hat logoGithubredditYoutubeTwitter

Learn

Try, buy, & sell

Communities

About Red Hat

We deliver hardened solutions that make it easier for enterprises to work across platforms and environments, from the core datacenter to the network edge.

Making open source more inclusive

Red Hat is committed to replacing problematic language in our code, documentation, and web properties. For more details, see the Red Hat Blog.

About Red Hat Documentation

We help Red Hat users innovate and achieve their goals with our products and services with content they can trust. Explore our recent updates.

Legal Notice

Theme

© 2026 Red HatBack to top