Chapter 3. Using the Compliance Operator

• Use the CLI to create the YAML file and object. For example:

  1. Create a file called sscan.yaml using the following text:

     apiVersion: compliance.openshift.io/v1alpha1
     kind: ScanSettingBinding
     metadata:
       name: cis-compliance
     profiles:
       - name: ocp4-cis-node
         kind: Profile
         apiGroup: compliance.openshift.io/v1alpha1
       - name: ocp4-cis
         kind: Profile
         apiGroup: compliance.openshift.io/v1alpha1
     settingsRef:
       name: default
       kind: ScanSetting
       apiGroup: compliance.openshift.io/v1alpha1

     Copy to Clipboard Toggle word wrap

  2. Create the ScanSettingBinding object by running the following command:

     $ oc create -f sscan.yaml -n openshift-compliance

     Copy to Clipboard Toggle word wrap

     If successful, the following message is displayed:

     $ scansettingbinding.compliance.openshift.io/cis-compliance created

     Copy to Clipboard Toggle word wrap

• Use the web console to create the object by performing the following steps:

  1. Change the active project to openshift-compliance.
  2. Click + to open the Import YAML page.
  3. Paste the YAML from the previous example and then click Create.

Additional resources

• Understanding the Compliance Operator
• Compliance Operator scans in OpenShift Container Platform

• Run the following command:

  $ oc -n stackrox delete pod -lapp=sensor

  Copy to Clipboard Toggle word wrap

• In the OpenShift Container Platform web console, perform the following steps:

  1. Change the active project to stackrox.
  2. Navigate to Workloads Pods.
  3. Locate the pod with the name starting with sensor-, and then click Actions Delete Pod.

Additional resources

• Running a compliance scan in RHACS