Chapter 3. Managing compliance

Procedure

1. In the RHACS portal, click Compliance Dashboard.

2. Optional: By default, information on all standards is displayed in the compliance results.

   To display information about specific standards only, perform the following steps:

   1. Click Manage standards.
   2. By default, all standards are selected. Clear the checkbox for any specific standard that you do not want to display.

   3. Click Save.

      Standards that are not selected do not appear in the dashboard display, including the widgets, in the compliance results tables accessible from the dashboard, and in the PDF files created by using the Export button. However, when exporting the results as a CSV file, all default standards are included.

3. Click Scan environment.

   Note

   Scanning the entire environment takes about 2 minutes to complete. This time might vary depending on the number of clusters and nodes in your environment.

Verification

1. In the RHACS portal, click Configuration Management.
2. In the CIS Kubernetes v1.5 widget, click Scan.
3. RHACS displays a message which indicates that a compliance scan is in progress.

Procedure

1. In the RHACS portal, click Compliance Dashboard.
2. Click either the clusters, namespaces, or nodes tab to open the details page.
3. Enter your filtering criteria in the search bar, and then click Enter.

Procedure

1. In the RHACS portal, click Compliance Dashboard.

2. Click the Export tab to do any of the following tasks:

   • To generate an executive report, select Download Page as PDF.

   • To generate an evidence report, select Download Evidence as CSV.

     Tip

     The Export option appears on all compliance pages and filtered views.

Procedure

1. In the RHACS portal, click Compliance OpenShift Schedules.
2. Click Create scan schedule.

3. In the Create scan schedule page, provide the following information:

   • Name: Enter a name to identify different compliance scans.
   • Description: Specify the reason for each compliance scan.

   • Schedule: Adjust the scan schedule to fit your required schedule:

     • Frequency: From the drop-down list, select how often you want to run the scan. If you do not select a frequency, Daily is selected automatically.

       The following values are associated with how often you want to perform the scan:

       • Daily
       • Weekly
       • Monthly

     • On day(s): From the list, select one or more days of the week on which you want to perform the scan.

       The following values are associated with the days of the week on which you want to perform the scan:

       • Monday
       • Tuesday
       • Wednesday
       • Thursday
       • Friday
       • Saturday
       • Sunday
       • The first of the month

       • The middle of the month

         Note

         These values are only applicable if you specify the frequency of scan as Weekly or Monthly.

     • Time: Start to type the time in hh:mm at which you want to run the scan. From the list that is displayed, select a time.
4. Click Next.
5. Select one or more healthy clusters that you want to include in the scan.
6. Click Next.
7. Select one or more profiles that you want to include in the scan.
8. Click Next.

9. Optional: To configure email delivery destinations for manually triggered reports, perform the following steps:

   Note

   You can add one or more delivery destinations.

   1. Expand Add delivery destination.

   2. In the Delivery destination page, provide the following information:

      • Email notifier: Select an email notifier from the drop-down list.

        Optional: To configure the setting for a new email notifier integration, perform the following steps:

        1. From Select a notifier drop-down list, click Create email notifier.

        2. In the Create email notifier page, provide the following information:

           • Integration name: Enter a unique name for the email notifier. This name helps you identify and manage this specific email notifier configuration.
           • Email server: Specify the address of the SMTP server that you want to use to send the emails.
           • Username: Enter the username that is required for authentication with the SMTP server. This is often the email address used for sending the emails.
           • Password: Enter the password associated with the SMTP username. This password is used for authentication with the SMTP server.
           • From: This address usually represents the sender of the emails and is visible to the recipients. This is optional.
           • Sender: Enter the name of the sender, which is displayed together with the From email address. This name helps recipients identify who sent the email.
           • Default recipient: Enter the default email address that should receive the notifications if no specific recipient is specified. This ensures that there is always a recipient for the emails.
           • Annotation key for recipient: Specify the annotation key to define a recipient that you want to notify about the policy violations related to a specific deployment or namespace. This is optional.
           • Optional: Select the Enable unauthenticated SMTP checkbox, if your SMTP server does not require authentication. This is not recommended due to security reasons.
           • Optional: Select the Disable TLS certificate validation (insecure) checkbox, if you want to disable TLS certificate validation. This is not recommended due to security reasons.

           • Optional: In the Use STARTTLS (requires TLS to be disabled) field, select the type of STARTTLS for securing the connection to the SMTP server from the drop-down list.

             Important

             To use this option, you must disable TLS certificate validation.

             The following values are associated with the type of STARTTLS for securing the connection to the SMTP server:

             • Disabled

               Data is not encrypted.

             • Plain

               Encodes username and password in base64.

             • Login

               Sends username and password as separate base64-encoded strings for added security.

        3. Click Save integration.
      • Distribution list: Enter one or more comma-separated email addresses of the recipients who should receive the report.

      • Email template: The default template is automatically applied.

        Optional: To customize the email subject and body as needed, perform the following steps:

        1. Click the pencil icon.

        2. In the Edit email template page, provide the following information:

           • Email subject: Enter the desired subject line for the email. This subject is displayed in the recipient’s inbox and should clearly indicate the purpose of the email.
           • Email body: Compose the text of the email. This is the main content of the email and can include text, placeholders for dynamic content and any formatting necessary to get your message across effectively.
        3. Click Apply.
10. Click Next.
11. Review your scan configuration, and then click Save.

Verification

1. In the RHACS portal, click Compliance OpenShift Schedules.
2. Select the compliance scan that you have created.
3. In the Clusters section, verify that the operator status is healthy.

4. Optional: To edit the scan schedule, perform the following steps:

   1. From the Actions drop-down list, which is in the upper right of the page, select Edit scan schedule.
   2. Make your changes.
   3. Click Save.

5. Optional: To manually send a scan report:

   Note
   • You can only send a scan report manually if you have configured an email delivery destination.
   • Compliance reporting is only available for clusters running Compliance Operator version 1.6.0 or later.

   • From the Actions drop-down list, which is in the upper right of the page, select Send report.

     You receive a confirmation that you have requested to send a report.

6. Optional: To download a scan report, perform the following steps:

   Note

   Compliance reporting is only available for clusters running Compliance Operator version 1.6.0 or later.

   1. From the Actions drop-down list, which is in the upper right of the page, select Generate download.

      You receive a confirmation that the report generation has started.

   2. Click the All report jobs tab.
   3. Optional: Set View only my jobs to on.
   4. Locate the report job that you created.
   5. Wait until the download is complete, and then click Ready for download.
   6. Optional: To delete the report job, click the overflow menu and then select Delete download.