Skip to content

[enterprise-4.12] : Clarified relationship between rules and profiles #92530

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Apr 23, 2025
Merged

[enterprise-4.12] : Clarified relationship between rules and profiles #92530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 26 additions & 0 deletions modules/compliance-profile-types.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
// Module included in the following assemblies:
//
// * security/compliance_operator/co-concepts/compliance-operator-understanding.adoc
// * security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc

:_mod-docs-content-type: REFERENCE
[id="compliance_profile_types_{context}"]
= Compliance Operator profile types

Compliance Operator rules are organized into profiles. Profiles can target the Platform or Nodes for {product-title}, and some benchmarks include `rhcos4` Node profiles.

Platform:: Platform profiles evaluate your {product-title} cluster components. For example, a Platform-level rule can confirm whether APIServer configurations are using strong encryption cyphers.

Node:: Node profiles evaluate the OpenShift or {op-system} configuration of each host. You can use two Node profiles: `ocp4` Node profiles and `rhcos4` Node profiles. The `ocp4` Node profiles evaluate the OpenShift configuration of each host. For example, they can confirm whether `kubeconfig` files have the correct permissions to meet a compliance standard. The `rhcos4` Node profiles evaluate the {op-system-first} configuration of each host. For example, they can confirm whether the SSHD service is configured to disable password logins.

[IMPORTANT]
====
For benchmarks that have Node and Platform profiles, such as PCI-DSS, you must run both profiles in your {product-title} environment.

For benchmarks that have `ocp4` Platform, `ocp4` Node, and `rhcos4` Node profiles, such as FedRAMP High, you must run all three profiles in your {product-title} environment.
====

[NOTE]
====
In a cluster with many Nodes, both `ocp4` Node and `rhcos4` Node scans might take a long time to complete.
====
16 changes: 1 addition & 15 deletions modules/compliance-profiles.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,18 +214,4 @@ title: Record Attempts to Alter Logon and Logout Events
warning: Manual editing of these files may indicate nefarious activity, such as an
attacker attempting to remove evidence of an intrusion.
----
====

[id="compliance_profile_types_{context}"]
== Compliance Operator profile types

There are two types of compliance profiles available: Platform and Node.

Platform:: Platform scans target your {product-title} cluster.

Node:: Node scans target the nodes of the cluster.

[IMPORTANT]
====
For compliance profiles that have Node and Platform applications, such as `pci-dss` compliance profiles, you must run both in your {product-title} environment.
====
====
6 changes: 1 addition & 5 deletions security/compliance_operator/co-concepts/compliance-operator-understanding.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,4 @@ The Compliance Operator is available for {op-system-first} deployments only.

include::modules/compliance-profiles.adoc[leveloffset=+1]

[id="additional-resources_compliance-operator-understanding"]
[role="_additional-resources"]
== Additional resources

* xref:../../../security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc#compliance-operator-supported-profiles[Supported compliance profiles]
include::modules/compliance-profile-types.adoc[leveloffset=+2]
6 changes: 1 addition & 5 deletions security/compliance_operator/co-scans/compliance-operator-supported-profiles.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,8 +27,4 @@ The Compliance Operator might report incorrect results on some managed platforms

include::modules/compliance-supported-profiles.adoc[leveloffset=+1]

[id="additional-resources-compliance-operator-"]
[role="_additional-resources"]
== Additional resources

* xref:../../../security/compliance_operator/co-concepts/compliance-operator-understanding.adoc#compliance_profile_types_understanding-compliance[Compliance Operator profile types]
include::modules/compliance-profile-types.adoc[leveloffset=+2]